@pleri/olam-cli 0.1.84 → 0.1.86

package/dist/image-digests.json

@@ -1,9 +1,9 @@
 {
-  "auth": "sha256:ee6b1d1046933c76acc8d28cd83ac3871bc69057d2401014252872dc5ec42db7",
-  "devbox": "sha256:0b7a8ed93e55bec3cd12351689a6213daa87a9fc7531b9dfcfb0513ba62add61",
-  "host-cp": "sha256:ab8540c92b84b0fff082d9221b0792f0ccdfe7053143be261122b148501b0fc6",
+  "auth": "sha256:acd77f9b4b2764841207e6e749e0bd5044843458f789eb5548cb4363d02fb985",
+  "devbox": "sha256:6b60bdffc09db5b81410a74fe4262fbeb0b2f6770f5011d2b38dd34650ea2c55",
+  "host-cp": "sha256:51366e683e0032855425568fbfd35f816821d1dc48f92d0fb37c0d0eedfc1698",
   "mcp-auth": "sha256:e47169ad3fbc9cab216248fecbc56874343a5daab84b1f18d67529b7d415cf95",
   "$schema_version": 1,
-  "$published_version": "0.1.84",
+  "$published_version": "0.1.86",
   "$registry": "ghcr.io/pleri"
 }

package/host-cp/src/server.mjs

@@ -1029,9 +1029,23 @@ const server = http.createServer(async (req, res) => {
   if (url.pathname === '/api/auth/credentials' && req.method === 'GET') {
     try {
       const upstream = await authServiceFetch('GET', '/credentials/status');
+      if (!upstream.ok) {
+        // auth-service returned non-2xx. The most common cause is a missing or
+        // wrong OLAM_AUTH_SECRET (auth-service returns 401 when X-Olam-Secret is
+        // absent). Never forward auth-service's 401 to the SPA — the operator IS
+        // authenticated to host-cp at this point; this is an internal service
+        // misconfiguration, not an operator auth failure. 502 tells the SPA that
+        // the data is unavailable due to a server-side error.
+        return jsonReply(res, 502, {
+          error: 'auth_service_error',
+          upstream_status: upstream.status,
+          credentials: [],
+          hint: 'Check OLAM_AUTH_SECRET env var — host-cp may not be authorized to query the auth-service vault.',
+        });
+      }
       const raw = await upstream.json();
       const accounts = Array.isArray(raw.accounts) ? raw.accounts : [];
-      return jsonReply(res, upstream.status, { credentials: accounts.map(normalizeCredential) });
+      return jsonReply(res, 200, { credentials: accounts.map(normalizeCredential) });
     } catch (err) {
       return jsonReply(res, 502, { error: 'auth_service_unavailable', message: err.message });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pleri/olam-cli",
-  "version": "0.1.84",
+  "version": "0.1.86",
   "type": "module",
   "bin": {
     "olam": "./bin/olam.cjs"