@mccaskie-labs/workbench-ai 0.2.0 → 0.2.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @mccaskie-labs/workbench-ai
 
+## 0.2.1
+
+### Patch Changes
+
+- `WORKBENCH_GATEWAY_URL` must be an https URL (or http to localhost while developing), since the project key goes in every request's headers. A placeholder or other non-URL fails at start-up with `invalid_config`. Email: a `--wb-email-*` value mapped to the project's own `:root` variable (`var(--accent)`, or `var(--x, fallback)`) is filled in, and anything still holding `var()` is left out so the default stays, because mail apps don't support custom properties. `--wb-email-*` values are now taken only from plain `:root` rules, so a theme rule can't override every email.
+
 ## 0.2.0
 
 ### Minor Changes

package/dist/ai.js

@@ -37,7 +37,7 @@ export function createAi(opts) {
     if (typeof opts.url !== "string" || opts.url === "") {
         throw new WorkbenchAiError("invalid_config", "WORKBENCH_GATEWAY_URL is missing");
     }
-    const url = opts.url.replace(/\/+$/, "");
+    const url = gatewayBase(opts.url, (m) => new WorkbenchAiError("invalid_config", m));
     const baseFetch = opts.fetch ?? ((input, init) => globalThis.fetch(input, init));
     const client = (f) => new Anthropic({
         apiKey: opts.key,
@@ -359,3 +359,20 @@ function budgetFrom(body, requestId) {
         month: typeof b.month === "string" ? b.month : "",
     };
 }
+/**
+ * The Gateway's address, checked: the project key goes in every request's
+ * headers, so only https, or http to this computer while developing.
+ */
+function gatewayBase(raw, fail) {
+    let u;
+    try {
+        u = new URL(raw);
+    }
+    catch {
+        throw fail("WORKBENCH_GATEWAY_URL isn't a URL");
+    }
+    const local = u.hostname === "localhost" || u.hostname === "127.0.0.1" || u.hostname === "[::1]";
+    if (u.protocol !== "https:" && !(u.protocol === "http:" && local))
+        throw fail("WORKBENCH_GATEWAY_URL must be an https URL");
+    return raw.replace(/\/+$/, "");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mccaskie-labs/workbench-ai",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Claude through the Workbench Gateway: text, structured output, streaming and budget status, with no Anthropic key in the app. Refusals and truncations throw; createFakeAi for tests.",
   "license": "UNLICENSED",
   "type": "module",