@awak-app/simy-cli 0.7.31 → 0.7.32

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.7.31",
+  "version": "0.7.32",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {

package/src/agent.js

@@ -106,6 +106,7 @@ import {
   webApiErrorMessage,
   webApiHeaders,
   webApiUrl,
+  publicImageUrl,
 } from "./web-api.js";
 import {
   defaultRepositoryScanRoot,
@@ -672,9 +673,13 @@ export async function startAgent({
         if (!Array.isArray(payload.organizations)) throw new Error("Invalid organization list.");
         if (session !== requestedSession) return;
         organizationItems = payload.organizations.filter(org => typeof org.id === "string" && typeof org.name === "string")
-          .slice(0, 100).map(org => ({ id: org.id, name: org.name.slice(0, 120),
+          .slice(0, 100).map(org => {
+            const logoUrl = publicImageUrl(org.logoUrl ?? org.logo_url);
+            return { id: org.id, name: org.name.slice(0, 120),
+            ...(logoUrl ? { logoUrl } : {}),
             ...(["ready", "sqm_required", "developer_required", "unavailable"].includes(org.desktopAccess) ? { desktopAccess: org.desktopAccess } : {}),
-            ...(typeof org.slug === 'string' && org.slug && org.slug.length <= 160 && !/[\/\\?#\x00-\x1f]/.test(org.slug) ? { slug: org.slug } : {}) }));
+            ...(typeof org.slug === 'string' && org.slug && org.slug.length <= 160 && !/[\/\\?#\x00-\x1f]/.test(org.slug) ? { slug: org.slug } : {}) };
+          });
         organizationState = "ready";
       } catch {
         if (session === requestedSession) organizationState = "unavailable";

package/src/cli-contract.js

@@ -14,7 +14,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.7.31";
+export const CLI_VERSION = "0.7.32";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function narrativeImageCapabilityMetadata() {

package/src/cli-observability.js

@@ -7,7 +7,7 @@ import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { webApiHeaders, webApiUrl } from './web-api.js';
 // Keep this leaf module package-safe: hooks load it before the full CLI contract.
-const CLI_VERSION = '0.7.31';
+const CLI_VERSION = '0.7.32';
 
 const STORE = 'cli-observability-state.json';
 const LEGACY_CONFIG = 'cli-observability.json';

package/src/team-threads.js

@@ -1,10 +1,7 @@
+import { publicImageUrl } from "./web-api.js";
 function profileAvatar(value) {
-  if (typeof value !== "string" || value.length > 2048) return {};
-  try {
-    const url = new URL(value);
-    if (url.protocol !== "https:" || !url.hostname || url.username || url.password) return {};
-    return { avatarUrl: url.toString() };
-  } catch { return {}; }
+  const url = publicImageUrl(value);
+  return url ? { avatarUrl: url } : {};
 }
 import { createHash } from "node:crypto";
 import { sanitizedText } from "./session-supervision/conversation-context.js";

package/src/web-api.js

@@ -6,6 +6,15 @@ export function webApiHeaders({ token } = {}, extraHeaders = {}) {
   return headers;
 }
 
+// Public profile images never carry the CLI's application credentials.
+export function publicImageUrl(value) {
+  if (typeof value !== "string" || value.length > 2048) return null;
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" && url.hostname && !url.username && !url.password ? url.toString() : null;
+  } catch { return null; }
+}
+
 const APP_DEV_ORIGIN = "https://app-dev.simy.one";
 const APP_DEV_GATEWAY_BASE_URL = "https://app.simy.one/api/local-cli-gateway/";