@fargowealth/fargo-ai-cli 1.4.0 → 1.4.1

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 1.4.1
+
+- Capture Connector-declared refresh-only localStorage values without exposing
+  them as website request headers or MCP arguments.
+- Add the shared Runtime `auth.refresh.aws-cognito` capability so Browser
+  Gateway can refresh expiring ID/access tokens and persist token rotation
+  before continuing an operation.
+- Keep rejected refresh credentials fail-closed as `needs_reauth`; transient
+  Cognito failures leave the encrypted Connection available for retry.
+- Show Website command help before validating required execution options.
+
 ## 1.4.0
 
 - Allow Website Connector operations to select an explicit text response mode

package/README.md

@@ -80,6 +80,14 @@ capability using SHA-256 digests; the Profile body then goes directly to
 protection before replacing the encrypted cloud state. `--no-prompt` is for a
 Profile that is already authenticated.
 
+Connectors can declare refresh-only storage selectors separately from request
+headers. For AWS Cognito, Browser Gateway exchanges the encrypted Refresh Token
+for new ID/access tokens before expiry, saves any rotated Refresh Token inside
+the same connection-scoped Durable Object, and only then continues the website
+operation. Refresh Tokens never enter MCP arguments, command output, or normal
+website requests. `sync` is required again only after Cognito rejects or revokes
+the Refresh Token.
+
 Connector operations remain brokered through App MCP `website-bridge`, so the
 same operations are available to Codex, WorkBuddy, other Agents, and Teammates.
 V1 releases are owner-private. A Teammate binding delegates the invoking user's

package/node_modules/@fargowealth/website-connector-runtime/README.md

@@ -6,3 +6,10 @@ by both Fargo CLI local debugging and the Fargo Browser Gateway.
 Connector definitions contain data only. They cannot ship executable code.
 Callers provide browser storage at execution time; the runtime never persists
 cookies or localStorage.
+
+Runtime `1.1.0` adds declarative AWS Cognito token refresh. `secretSources`
+select refresh-only browser values, while `headerSources` remains the complete
+set of values allowed in business requests. The runtime can exchange an
+expiring session through Cognito's `GetTokensFromRefreshToken` API and returns a
+new in-memory storage state; the hosting BrowserConnectionSession Durable Object
+is responsible for encrypting and persisting that state before use.

package/node_modules/@fargowealth/website-connector-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fargowealth/website-connector-runtime",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Shared declarative Website Connector runtime for Fargo AI",
   "type": "module",
   "exports": {

package/node_modules/@fargowealth/website-connector-runtime/src/index.d.mts

@@ -15,6 +15,17 @@ export type WebsiteConnectorAuth =
       kind: "browser_storage";
       sendCookies: boolean;
       headerSources: Array<{ keySuffix: string; name: string; origin: string; prefix?: string }>;
+      secretSources: Array<{ id: string; keySuffix: string; origin: string }>;
+      refresh?: {
+        kind: "aws_cognito";
+        accessTokenSource: { keySuffix: string; origin: string };
+        clientId: string;
+        idTokenSource: { keySuffix: string; origin: string };
+        leewaySeconds: number;
+        refreshTokenSource: string;
+        region: string;
+        userPoolId: string;
+      };
     };
 
 export type WebsiteConnectorOperation = {
@@ -72,7 +83,7 @@ export type WebsiteConnectorRuntimeDescriptor = {
 };
 
 export const WEBSITE_CONNECTOR_SCHEMA_VERSION: "fargo.website-connector/v1";
-export const WEBSITE_CONNECTOR_RUNTIME_VERSION: "1.0.0";
+export const WEBSITE_CONNECTOR_RUNTIME_VERSION: "1.1.0";
 export const WEBSITE_CONNECTOR_RUNTIME_CAPABILITIES: readonly string[];
 export class WebsiteConnectorDefinitionError extends Error {
   code: string;
@@ -108,6 +119,15 @@ export function executeWebsiteConnectorOperation(
     timeoutMs?: number;
   }
 ): Promise<unknown>;
+export function refreshWebsiteConnectorAuthentication(
+  definition: unknown,
+  storageState: WebsiteConnectorBrowserStorageState,
+  options?: {
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+    timeoutMs?: number;
+  }
+): Promise<{ refreshed: boolean; storageState: WebsiteConnectorBrowserStorageState }>;
 export function browserStorageAuthenticated(
   state: WebsiteConnectorBrowserStorageState,
   auth: WebsiteConnectorAuth,

package/node_modules/@fargowealth/website-connector-runtime/src/index.mjs

@@ -2,8 +2,13 @@ const CONNECTOR_ID = /^[a-z][a-z0-9-]{1,62}[a-z0-9]$/;
 const OPERATION_ID = /^[a-z][a-z0-9_]{1,62}[a-z0-9]$/;
 const TEMPLATE_ARGUMENT = /\{\{([a-zA-Z][a-zA-Z0-9_]*)\}\}/g;
 const RUNTIME_CAPABILITY = /^[a-z][a-z0-9.-]{1,80}$/;
+const SECRET_SOURCE_ID = /^[a-z][a-z0-9_]{1,62}[a-z0-9]$/;
+const AWS_REGION = /^[a-z]{2}(?:-gov)?-[a-z]+-\d$/;
+const COGNITO_CLIENT_ID = /^[A-Za-z0-9+]{1,128}$/;
+const COGNITO_USER_POOL_ID = /^[a-z]{2}(?:-gov)?-[a-z]+-\d_[A-Za-z0-9]+$/;
 const SEMVER = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
 const MAX_RESPONSE_BYTES = 1_048_576;
+const DEFAULT_REFRESH_LEEWAY_SECONDS = 300;
 const FORBIDDEN_HEADERS = new Set([
   "connection",
   "content-length",
@@ -15,9 +20,10 @@ const FORBIDDEN_HEADERS = new Set([
 ]);
 
 export const WEBSITE_CONNECTOR_SCHEMA_VERSION = "fargo.website-connector/v1";
-export const WEBSITE_CONNECTOR_RUNTIME_VERSION = "1.0.0";
+export const WEBSITE_CONNECTOR_RUNTIME_VERSION = "1.1.0";
 export const WEBSITE_CONNECTOR_RUNTIME_CAPABILITIES = Object.freeze([
   "auth.browser-storage",
+  "auth.refresh.aws-cognito",
   "request.http",
   "request.json-body",
   "request.write",
@@ -126,6 +132,9 @@ export function requiredWebsiteConnectorCapabilities(definition) {
   const parsed = parseWebsiteConnectorDefinition(definition);
   const required = new Set(["request.http"]);
   if (parsed.auth.kind === "browser_storage") required.add("auth.browser-storage");
+  if (parsed.auth.kind === "browser_storage" && parsed.auth.refresh?.kind === "aws_cognito") {
+    required.add("auth.refresh.aws-cognito");
+  }
   for (const operation of parsed.operations) {
     required.add(`response.${operation.request.responseMode}`);
     if (operation.request.body !== undefined) required.add("request.json-body");
@@ -220,11 +229,35 @@ export function browserStorageAuthenticated(state, auth, now = Date.now()) {
   if (auth.kind !== "browser_storage") return true;
   const seconds = now / 1000;
   const hasCookie = !auth.sendCookies || state.cookies.some((cookie) => cookie.expires === undefined || cookie.expires < 0 || cookie.expires > seconds);
-  const hasHeaders = auth.headerSources.every((source) => {
+  const hasHeaderValues = auth.headerSources.every((source) => storageValue(state, source.origin, source.keySuffix) !== undefined);
+  const headersUnexpired = auth.headerSources.every((source) => {
     const value = storageValue(state, source.origin, source.keySuffix);
     return value !== undefined && credentialUnexpired(value, seconds);
   });
-  return hasCookie && hasHeaders;
+  const hasRefreshSecrets = !auth.refresh || auth.secretSources.every((source) => (
+    storageValue(state, source.origin, source.keySuffix) !== undefined
+  ));
+  return hasCookie && hasHeaderValues && hasRefreshSecrets && (headersUnexpired || Boolean(auth.refresh));
+}
+
+export async function refreshWebsiteConnectorAuthentication(definition, storageState, options = {}) {
+  const parsed = parseWebsiteConnectorDefinition(definition);
+  if (parsed.auth.kind !== "browser_storage") {
+    return { refreshed: false, storageState };
+  }
+  const auth = parsed.auth;
+  const now = options.now?.() ?? Date.now();
+  const leewaySeconds = auth.refresh?.leewaySeconds ?? DEFAULT_REFRESH_LEEWAY_SECONDS;
+  const shouldRefresh = auth.refresh
+    ? !cognitoStoredTokenValid(storageState, auth.refresh.idTokenSource, auth.refresh, "id", now, leewaySeconds)
+      || !cognitoStoredTokenValid(storageState, auth.refresh.accessTokenSource, auth.refresh, "access", now, leewaySeconds)
+    : auth.headerSources.some((source) => {
+        const value = storageValue(storageState, source.origin, source.keySuffix);
+        return value === undefined || !credentialUnexpired(value, now / 1000, leewaySeconds);
+      });
+  if (!shouldRefresh) return { refreshed: false, storageState };
+  if (!auth.refresh) throw new WebsiteConnectorRuntimeError(409, "browser_connection_needs_reauth");
+  return refreshAwsCognitoAuthentication(auth, storageState, { ...options, now });
 }
 
 export function sanitizeWebsiteConnectorOutput(value, storageState) {
@@ -265,8 +298,75 @@ function parseAuthRecipe(value, allowedOrigins) {
         const prefix = optionalHeaderPrefix(binding.prefix, `/auth/headerSources/${index}/prefix`);
         return { keySuffix, name, origin, ...(prefix ? { prefix } : {}) };
       });
+  const secretSources = source.secretSources === undefined
+    ? []
+    : uniqueArray(source.secretSources, 0, 12, "/auth/secretSources").map((item, index) => {
+        const binding = record(item, "website_auth_secret_source_invalid", `/auth/secretSources/${index}`);
+        const id = requiredText(binding.id, 64, "website_auth_secret_source_invalid", `/auth/secretSources/${index}/id`);
+        if (!SECRET_SOURCE_ID.test(id)) fail("website_auth_secret_source_invalid", `/auth/secretSources/${index}/id`);
+        const origin = exactHttpsOrigin(binding.origin, "website_auth_secret_source_invalid", `/auth/secretSources/${index}/origin`);
+        if (!allowedOrigins.includes(origin)) fail("website_auth_origin_not_allowed", `/auth/secretSources/${index}/origin`);
+        const keySuffix = requiredText(binding.keySuffix, 240, "website_auth_secret_source_invalid", `/auth/secretSources/${index}/keySuffix`);
+        return { id, keySuffix, origin };
+      });
+  if (new Set(secretSources.map((item) => item.id)).size !== secretSources.length) {
+    fail("website_auth_secret_source_duplicate", "/auth/secretSources");
+  }
+  const refresh = parseRefreshRecipe(source.refresh, { headerSources, secretSources });
+  if (!refresh && secretSources.length > 0) fail("website_auth_secret_source_unused", "/auth/secretSources");
+  if (refresh && secretSources.some((item) => item.id !== refresh.refreshTokenSource)) {
+    fail("website_auth_secret_source_unused", "/auth/secretSources");
+  }
   if (!sendCookies && headerSources.length === 0) fail("website_auth_recipe_empty", "/auth");
-  return { kind: "browser_storage", sendCookies, headerSources };
+  return {
+    kind: "browser_storage",
+    sendCookies,
+    headerSources,
+    secretSources,
+    ...(refresh ? { refresh } : {})
+  };
+}
+
+function parseRefreshRecipe(value, sources) {
+  if (value === undefined || value === null) return undefined;
+  const source = record(value, "website_auth_refresh_invalid", "/auth/refresh");
+  equal(source.kind, "aws_cognito", "website_auth_refresh_invalid", "/auth/refresh/kind");
+  const clientId = requiredText(source.clientId, 128, "website_auth_refresh_invalid", "/auth/refresh/clientId");
+  if (!COGNITO_CLIENT_ID.test(clientId)) fail("website_auth_refresh_invalid", "/auth/refresh/clientId");
+  const region = requiredText(source.region, 40, "website_auth_refresh_invalid", "/auth/refresh/region");
+  if (!AWS_REGION.test(region)) fail("website_auth_refresh_invalid", "/auth/refresh/region");
+  const userPoolId = requiredText(source.userPoolId, 128, "website_auth_refresh_invalid", "/auth/refresh/userPoolId");
+  if (!COGNITO_USER_POOL_ID.test(userPoolId) || !userPoolId.startsWith(`${region}_`)) {
+    fail("website_auth_refresh_invalid", "/auth/refresh/userPoolId");
+  }
+  const refreshTokenSource = requiredText(source.refreshTokenSource, 64, "website_auth_refresh_invalid", "/auth/refresh/refreshTokenSource");
+  const secret = sources.secretSources.find((candidate) => candidate.id === refreshTokenSource);
+  if (!secret) fail("website_auth_refresh_source_unknown", "/auth/refresh/refreshTokenSource");
+  const idTokenSource = parseRefreshTokenTarget(source.idTokenSource, sources.headerSources, "/auth/refresh/idTokenSource");
+  const accessTokenSource = parseRefreshTokenTarget(source.accessTokenSource, sources.headerSources, "/auth/refresh/accessTokenSource");
+  const leewaySeconds = source.leewaySeconds === undefined
+    ? DEFAULT_REFRESH_LEEWAY_SECONDS
+    : boundedInteger(source.leewaySeconds, 30, 3_600, "/auth/refresh/leewaySeconds");
+  return {
+    kind: "aws_cognito",
+    clientId,
+    region,
+    userPoolId,
+    refreshTokenSource,
+    idTokenSource,
+    accessTokenSource,
+    leewaySeconds
+  };
+}
+
+function parseRefreshTokenTarget(value, headerSources, path) {
+  const source = record(value, "website_auth_refresh_invalid", path);
+  const origin = exactHttpsOrigin(source.origin, "website_auth_refresh_invalid", `${path}/origin`);
+  const keySuffix = requiredText(source.keySuffix, 240, "website_auth_refresh_invalid", `${path}/keySuffix`);
+  if (!headerSources.some((candidate) => candidate.origin === origin && candidate.keySuffix === keySuffix)) {
+    fail("website_auth_refresh_target_unknown", path);
+  }
+  return { keySuffix, origin };
 }
 
 function parseOperation(value, allowedOrigins, index) {
@@ -505,6 +605,112 @@ function compareSemver(left, right) {
   return 0;
 }
 
+async function refreshAwsCognitoAuthentication(auth, storageState, options) {
+  const refresh = auth.refresh;
+  const secretSource = auth.secretSources.find((source) => source.id === refresh.refreshTokenSource);
+  const refreshToken = secretSource
+    ? storageValue(storageState, secretSource.origin, secretSource.keySuffix)
+    : undefined;
+  if (!refreshToken) throw new WebsiteConnectorRuntimeError(409, "browser_connection_needs_reauth");
+  const endpoint = `https://cognito-idp.${refresh.region}.amazonaws.com/`;
+  let response;
+  try {
+    response = await (options.fetchImpl ?? fetch)(endpoint, {
+      body: JSON.stringify({ ClientId: refresh.clientId, RefreshToken: refreshToken }),
+      headers: {
+        "Content-Type": "application/x-amz-json-1.0",
+        "X-Amz-Target": "AWSCognitoIdentityProviderService.GetTokensFromRefreshToken"
+      },
+      method: "POST",
+      redirect: "manual",
+      signal: AbortSignal.timeout(options.timeoutMs ?? 15_000)
+    });
+  } catch {
+    throw new WebsiteConnectorRuntimeError(502, "website_auth_refresh_unavailable");
+  }
+  if (response.status >= 300 && response.status < 400) {
+    throw new WebsiteConnectorRuntimeError(502, "website_auth_refresh_redirect_forbidden");
+  }
+  let payload;
+  try {
+    const raw = await readLimitedBody(response);
+    payload = raw ? JSON.parse(raw) : {};
+  } catch (error) {
+    if (error instanceof WebsiteConnectorRuntimeError && error.code === "website_operation_response_too_large") {
+      throw new WebsiteConnectorRuntimeError(502, "website_auth_refresh_response_invalid");
+    }
+    throw new WebsiteConnectorRuntimeError(502, "website_auth_refresh_response_invalid");
+  }
+  if (!response.ok) {
+    const errorType = String(payload?.__type || payload?.code || "").split("#").at(-1);
+    if (["NotAuthorizedException", "UserNotFoundException", "PasswordResetRequiredException"].includes(errorType)) {
+      throw new WebsiteConnectorRuntimeError(409, "browser_connection_needs_reauth");
+    }
+    throw new WebsiteConnectorRuntimeError(502, "website_auth_refresh_unavailable");
+  }
+  const result = payload?.AuthenticationResult;
+  const idToken = typeof result?.IdToken === "string" ? result.IdToken : "";
+  const accessToken = typeof result?.AccessToken === "string" ? result.AccessToken : "";
+  assertCognitoToken(idToken, refresh, "id", options.now);
+  assertCognitoToken(accessToken, refresh, "access", options.now);
+  let nextState = replaceStorageValue(storageState, refresh.idTokenSource, idToken);
+  nextState = replaceStorageValue(nextState, refresh.accessTokenSource, accessToken);
+  if (typeof result?.RefreshToken === "string" && result.RefreshToken) {
+    nextState = replaceStorageValue(nextState, secretSource, result.RefreshToken);
+  }
+  return { refreshed: true, storageState: nextState };
+}
+
+function assertCognitoToken(value, refresh, tokenUse, now) {
+  if (!cognitoTokenValid(value, refresh, tokenUse, now, 30)) {
+    throw new WebsiteConnectorRuntimeError(502, "website_auth_refresh_response_invalid");
+  }
+}
+
+function cognitoStoredTokenValid(state, source, refresh, tokenUse, now, leewaySeconds) {
+  const value = storageValue(state, source.origin, source.keySuffix);
+  return cognitoTokenValid(value, refresh, tokenUse, now, leewaySeconds);
+}
+
+function cognitoTokenValid(value, refresh, tokenUse, now, leewaySeconds) {
+  const claims = jwtClaims(value);
+  const issuer = `https://cognito-idp.${refresh.region}.amazonaws.com/${refresh.userPoolId}`;
+  const clientMatches = tokenUse === "id"
+    ? claims?.aud === refresh.clientId
+    : claims?.client_id === refresh.clientId;
+  return Boolean(
+    claims
+    && claims.iss === issuer
+    && claims.token_use === tokenUse
+    && clientMatches
+    && typeof claims.exp === "number"
+    && claims.exp > now / 1000 + leewaySeconds
+  );
+}
+
+function replaceStorageValue(state, source, value) {
+  let matches = 0;
+  const origins = array(state?.origins).map((origin) => {
+    if (origin?.origin !== source.origin) return {
+      ...origin,
+      localStorage: array(origin?.localStorage).map((item) => ({ ...item }))
+    };
+    return {
+      ...origin,
+      localStorage: array(origin?.localStorage).map((item) => {
+        if (!String(item?.name || "").endsWith(source.keySuffix)) return { ...item };
+        matches += 1;
+        return { ...item, value };
+      })
+    };
+  });
+  if (matches !== 1) throw new WebsiteConnectorRuntimeError(409, "browser_connection_needs_reauth");
+  return {
+    cookies: array(state?.cookies).map((cookie) => ({ ...cookie })),
+    origins
+  };
+}
+
 function applyBrowserAuthentication(headers, auth, state, requestUrl) {
   if (auth.kind !== "browser_storage") {
     throw new WebsiteConnectorRuntimeError(503, "website_connector_auth_invalid");
@@ -531,16 +737,21 @@ function storageValue(state, origin, keySuffix) {
   return matches.length === 1 && matches[0]?.value ? String(matches[0].value) : undefined;
 }
 
-function credentialUnexpired(value, nowSeconds) {
+function credentialUnexpired(value, nowSeconds, leewaySeconds = 30) {
+  const payload = jwtClaims(value);
+  return !payload || typeof payload.exp !== "number" || payload.exp > nowSeconds + leewaySeconds;
+}
+
+function jwtClaims(value) {
   const parts = String(value).split(".");
-  if (parts.length !== 3) return true;
+  if (parts.length !== 3) return undefined;
   try {
     const base64 = parts[1].replaceAll("-", "+").replaceAll("_", "/");
     const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
     const payload = JSON.parse(atob(padded));
-    return typeof payload.exp !== "number" || payload.exp > nowSeconds + 30;
+    return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : undefined;
   } catch {
-    return true;
+    return undefined;
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fargowealth/fargo-ai-cli",
-  "version": "1.4.0",
+  "version": "1.4.1",
   "description": "Agent-neutral Fargo AI CLI, MCP client, and LEGO project tooling",
   "type": "module",
   "bin": {
@@ -17,7 +17,7 @@
     "node": ">=20.19.0"
   },
   "dependencies": {
-    "@fargowealth/website-connector-runtime": "^1.0.0",
+    "@fargowealth/website-connector-runtime": "^1.1.0",
     "fflate": "^0.8.2",
     "ignore": "^7.0.6"
   },

package/src/constants.mjs

@@ -1,4 +1,4 @@
-export const CLI_VERSION = "1.4.0";
+export const CLI_VERSION = "1.4.1";
 export const DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
 export const DEFAULT_AUTH_URL = "https://auth.fargowealth.app";
 export const DEFAULT_API_URL = "https://mcp.fargowealth.app";

package/src/website-browser-profile.mjs

@@ -52,7 +52,7 @@ export function buildWebsiteBrowserProfile(spec, state, capturedAt = new Date())
     ? array(state.cookies).filter((cookie) => cookieAllowed(cookie.domain, allowedHosts)).map(normalizeCookie)
     : [];
   const suffixesByOrigin = new Map();
-  for (const source of captureSpec.auth.headerSources) {
+  for (const source of [...captureSpec.auth.headerSources, ...captureSpec.auth.secretSources]) {
     const suffixes = suffixesByOrigin.get(source.origin) ?? new Set();
     suffixes.add(source.keySuffix);
     suffixesByOrigin.set(source.origin, suffixes);
@@ -145,11 +145,21 @@ export function parseCaptureSpec(value) {
     }
     return { keySuffix, origin };
   });
+  const secretSources = array(auth.secretSources).map((item) => {
+    const binding = record(item, "Website Profile secret selector is invalid");
+    const origin = exactHttpsOrigin(binding.origin);
+    const keySuffix = String(binding.keySuffix || "");
+    if (!allowedOrigins.includes(origin) || !keySuffix || keySuffix.length > 240) {
+      throw new Error("Website Profile secret selector is invalid");
+    }
+    return { keySuffix, origin };
+  });
   if (headerSources.length > 12) throw new Error("Website Profile storage selector is invalid");
+  if (secretSources.length > 12) throw new Error("Website Profile secret selector is invalid");
   if (auth.sendCookies !== true && headerSources.length === 0) throw new Error("Website Profile authentication recipe is empty");
   return {
     allowedOrigins,
-    auth: { headerSources, sendCookies: auth.sendCookies === true },
+    auth: { headerSources, secretSources, sendCookies: auth.sendCookies === true },
     connectorId,
     ...(localProfileKey ? { localProfileKey } : {}),
     loginUrl: loginUrl.toString(),
@@ -160,7 +170,9 @@ export function parseCaptureSpec(value) {
 async function originStorage(client, sessionId, spec) {
   await client.call("Page.enable", {}, sessionId);
   await client.call("Runtime.enable", {}, sessionId);
-  const origins = [...new Set(spec.auth.headerSources.map((source) => source.origin))];
+  const origins = [...new Set(
+    [...spec.auth.headerSources, ...spec.auth.secretSources].map((source) => source.origin)
+  )];
   const result = [];
   for (const origin of origins) {
     await client.call("Page.navigate", { url: `${origin}/` }, sessionId);
@@ -342,7 +354,7 @@ function normalizeCookie(cookie) {
 
 function cookieAllowed(domain, allowedHosts) {
   const host = String(domain || "").toLowerCase().replace(/^\./, "");
-  return allowedHosts.some((allowed) => host === allowed || host.endsWith(`.${allowed}`));
+  return allowedHosts.some((allowed) => allowed === host || allowed.endsWith(`.${host}`));
 }
 
 function exactHttpsOrigin(value) {

package/src/website-cli.mjs

@@ -16,7 +16,7 @@ const WEBSITE_BRIDGE_URL = "https://website-bridge.fargowealth.app";
 
 export async function runWebsiteCommand(args, stdout, store, options = {}) {
   const action = args[1];
-  if (action === "--help" || action === "-h" || action === "help") {
+  if (action === "help" || args.includes("--help") || args.includes("-h")) {
     stdout.write(WEBSITE_HELP);
     return;
   }
@@ -218,6 +218,7 @@ function localProfileSpec(definition) {
     allowedOrigins: definition.allowedOrigins,
     auth: {
       headerSources: definition.auth.headerSources.map(({ keySuffix, origin }) => ({ keySuffix, origin })),
+      secretSources: definition.auth.secretSources.map(({ keySuffix, origin }) => ({ keySuffix, origin })),
       sendCookies: definition.auth.sendCookies
     },
     connection: {},