@dubeyvishal/orbital-cli 1.4.9 → 1.6.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dubeyvishal/orbital-cli",
-  "version": "1.4.9",
+  "version": "1.6.9",
   "description": "A fullstack CLI-based AI platform with chat mode, multi-tool agents, and agentic AI workflows. Includes GitHub login with device authorization, secure authentication, and modular client–server architecture for building intelligent automation tools.",
   "author": "Vishal Dubey",
   "license": "MIT",

package/server/src/config/env.js

@@ -8,7 +8,7 @@ const __dirname = path.dirname(__filename);
 // Load env from the server package root (server/.env) regardless of where the process is started.
 const serverEnvPath = path.resolve(__dirname, "../../.env");
 
-dotenv.config({ path: serverEnvPath });
+dotenv.config({ path: serverEnvPath, quiet: true });
 
 // Note: The Gemini API key is stored in the OS credential manager via keytar.
 // CLI code will hydrate GOOGLE_GENERATIVE_AI_API_KEY from keytar when needed.

package/server/src/index.js

@@ -16,15 +16,28 @@ const CLIENT_ORIGIN = FRONTEND_URL;
 
 app.use(express.json());
 
+// ── CORS: single source of truth for every route ──────────────────────
 app.use(
   cors({
     origin: CLIENT_ORIGIN,
-    methods: ["GET", "POST", "PUT", "DELETE"],
+    methods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
     credentials: true,
   })
 );
 
-app.all("/api/auth/*splat", toNodeHandler(auth));
+// Wrap the better-auth handler so it can never override the origin with "*".
+const authHandler = toNodeHandler(auth);
+app.all("/api/auth/*splat", (req, res) => {
+  const _setHeader = res.setHeader.bind(res);
+  res.setHeader = function (name, value) {
+    // Force the correct origin for any CORS header better-auth sets.
+    if (name.toLowerCase() === "access-control-allow-origin") {
+      return _setHeader(name, CLIENT_ORIGIN);
+    }
+    return _setHeader(name, value);
+  };
+  authHandler(req, res);
+});
 
 app.use("/auth", authRoutes);
 

package/server/src/lib/auth.js

@@ -3,7 +3,7 @@ import { betterAuth } from "better-auth";
 import { prismaAdapter } from "better-auth/adapters/prisma";
 import { deviceAuthorization } from "better-auth/plugins";
 import prisma from "./db.js";
-import { FRONTEND_URL } from "../config/api.js";
+import { API_BASE, FRONTEND_URL } from "../config/api.js";
 
 const CLIENT_ORIGIN =
   process.env.CLIENT_ORIGIN ||
@@ -15,12 +15,11 @@ export const auth = betterAuth({
     provider: "postgresql",
   }),
 
-  baseURL: CLIENT_ORIGIN,
+  baseURL: API_BASE,
   basePath: "/api/auth",
 
   trustedOrigins: [CLIENT_ORIGIN],
 
-
   cors: {
     origin: CLIENT_ORIGIN,
     credentials: true,