@getdial/cli 0.35.0 → 0.36.0

package/dist/lib/api.js

@@ -1,7 +1,7 @@
 import { request, fetch as undiciFetch, FormData as UndiciFormData, setGlobalDispatcher, EnvHttpProxyAgent, } from "undici";
 import { logger } from "./log.js";
-import { VERSION } from "./version.js";
 import { refParamsHeader } from "./ref-params.js";
+import { userAgent } from "./user-agent.js";
 // Route this package's undici requests through HTTP(S)_PROXY when one is set.
 // The `undici` npm package keeps its OWN global dispatcher, which — unlike
 // Node's built-in fetch (wired by NODE_USE_ENV_PROXY) — ignores the proxy env
@@ -19,9 +19,6 @@ if (process.env.HTTPS_PROXY ||
 // check) — Node's global FormData would be coerced to a text/plain string.
 export { UndiciFormData as ApiFormData };
 const DEFAULT_BASE = "https://api.getdial.ai";
-// Identifies the CLI on every request, so server-side request logs attribute
-// provisioning (and everything else) to the client + version that made the call.
-const USER_AGENT = `@getdial/cli/${VERSION}`;
 export function baseUrl() {
     return process.env.DIAL_API_URL ?? DEFAULT_BASE;
 }
@@ -69,7 +66,7 @@ async function apiRequest(method, path, body, apiKey, extraHeaders) {
     const url = `${baseUrl()}${path}`;
     const headers = applyRefParamsHeader({
         "content-type": "application/json",
-        "user-agent": USER_AGENT,
+        "user-agent": userAgent(),
         ...(extraHeaders ?? {}),
     });
     if (apiKey)
@@ -99,7 +96,7 @@ async function sendMultipart(method, path, form, apiKey) {
     // No content-type here on purpose: undici's fetch sets the multipart boundary.
     // The user-agent must still be set (server request logs key off it — the
     // POST path once regressed by dropping it, see the git history).
-    const headers = applyRefParamsHeader({ "user-agent": USER_AGENT });
+    const headers = applyRefParamsHeader({ "user-agent": userAgent() });
     if (apiKey)
         headers.authorization = `Bearer ${apiKey}`;
     try {

package/dist/lib/user-agent.js

@@ -0,0 +1,46 @@
+import { VERSION } from "./version.js";
+// Identifies the CLI on every request, so server-side request logs attribute
+// provisioning (and everything else) to the client + version that made the call.
+const STOCK_USER_AGENT = `@getdial/cli/${VERSION}`;
+// A caller-supplied token longer than this is almost certainly a bug, and an
+// unbounded one would bloat every server-side request log line it appears in.
+const MAX_PREFIX_LENGTH = 128;
+/**
+ * Reduce a caller-supplied identifier to something safe to put in a header.
+ *
+ * This never throws and never rejects: the prefix is telemetry, so a malformed
+ * value degrades to no prefix at all rather than failing the request. That
+ * matters concretely — undici refuses a header value containing CR/LF, so
+ * passing one through unsanitized would turn a cosmetic misconfiguration into a
+ * hard failure of every Dial call the host makes.
+ *
+ * Returns "" when there is nothing usable left.
+ */
+export function sanitizeUserAgent(raw) {
+    if (!raw)
+        return "";
+    return (raw
+        // Anything outside printable ASCII — CR, LF, tabs, other control chars, and
+        // non-ASCII bytes — becomes a space, in one pass.
+        .replace(/[^\x20-\x7E]/g, " ")
+        .replace(/\s+/g, " ")
+        .trim()
+        .slice(0, MAX_PREFIX_LENGTH)
+        // Truncation can land mid-gap and leave a trailing space behind.
+        .trim());
+}
+/**
+ * The full User-Agent for an outgoing API request.
+ *
+ * `DIAL_USER_AGENT` lets an embedding host runtime (an agent platform, a
+ * product wrapping the CLI) identify itself: its token is *prepended*, and the
+ * CLI's own identifier is always still sent. Unset or unusable, the header goes
+ * out exactly as it always has.
+ *
+ * Read at call time, not at module load — like `baseUrl()` reading
+ * DIAL_API_URL, so the environment is still honored if it changes after import.
+ */
+export function userAgent() {
+    const prefix = sanitizeUserAgent(process.env.DIAL_USER_AGENT);
+    return prefix ? `${prefix} ${STOCK_USER_AGENT}` : STOCK_USER_AGENT;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getdial/cli",
-  "version": "0.35.0",
+  "version": "0.36.0",
   "description": "Dial CLI — install, sign up, and run the local listen service.",
   "license": "MIT",
   "repository": {