@every-env/spiral-cli 1.0.1 → 1.0.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@every-env/spiral-cli",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "CLI for Spiral API - create content from your terminal",
   "author": "Kieran Klaassen",
   "license": "MIT",

package/src/api.ts

@@ -16,6 +16,12 @@ import {
 const BASE_URL =
   process.env["SPIRAL_API_URL"] || "https://api.writewithspiral.com";
 
+if (BASE_URL.startsWith("http://") && !BASE_URL.includes("localhost")) {
+  console.error(
+    "[warning] SPIRAL_API_URL uses HTTP — your API key will be sent in plaintext.",
+  );
+}
+
 interface FetchOptions extends RequestInit {
   /** Skip auth header (for public endpoints like /prime). */
   public?: boolean;

package/src/auth.ts

@@ -8,7 +8,14 @@ import { AuthenticationError } from "./types.js";
  */
 export function getAuthToken(): string {
   const envToken = process.env["SPIRAL_TOKEN"];
-  if (envToken) return envToken;
+  if (envToken) {
+    if (!envToken.startsWith("spiral_sk_")) {
+      console.error(
+        "[warning] SPIRAL_TOKEN does not start with spiral_sk_ — it may not be redacted from error messages.",
+      );
+    }
+    return envToken;
+  }
 
   const stored = getStoredAuth();
   if (stored?.token) return stored.token;

package/src/cli.ts

@@ -15,7 +15,7 @@ import {
   type GenerateResponse,
 } from "./types.js";
 
-const VERSION = "1.0.1";
+const VERSION = "1.0.2";
 
 const HELP = `
 ${theme.heading("spiral")} — write with Spiral from your terminal
@@ -328,7 +328,12 @@ main().catch((err) => {
   const msg = sanitizeError(err);
   console.error(theme.error(`Unexpected error: ${msg}`));
   if (process.argv.includes("--debug")) {
-    console.error(err);
+    // Sanitize the full error to avoid leaking tokens in stack traces
+    const debugOutput = err instanceof Error ? sanitizeError(err) : String(err);
+    console.error(debugOutput);
+    if (err instanceof Error && err.stack) {
+      console.error(sanitizeError(new Error(err.stack)));
+    }
   }
   process.exit(EXIT_CODES.GENERAL_ERROR);
 });

package/src/config.ts

@@ -1,3 +1,4 @@
+import { chmodSync } from "node:fs";
 import Conf from "conf";
 
 interface AuthCredentials {
@@ -34,6 +35,12 @@ export function storeAuth(token: string): void {
     tokenPrefix: token.slice(0, 14) + "...",
     createdAt: new Date().toISOString(),
   });
+  // Restrict config file to owner-only (contains PAT)
+  try {
+    chmodSync(config.path, 0o600);
+  } catch {
+    // Best-effort — may fail on some platforms
+  }
 }
 
 export function clearAuth(): void {