@qerexa/cli 0.1.0 → 0.1.1

package/README.md

@@ -1,13 +1,20 @@
 # Qerexa CLI (preview)
 
-CLI for Qerexa execution gates and secret workflows.
-
-This is a preview, not a regulated execution adapter. `gate` exits 0 only for
-a direct, unexpired allow (HTTP 200, `decision: "allowed"`, `allowed: true`, a
-`decision_id`, and a future `expires_at`). Review approval exits nonzero because
-a separate action-bound execution authorization is required; do not treat
-review status alone as permission for a CI job to deploy or transfer value.
-`--no-wait` exits 2 when review is required.
+Put a Qerexa check in front of your CI jobs, and manage short-lived secrets
+from the terminal.
+
+`qerexa-cli gate` exits 0 only when Qerexa gives a clear, current yes: an
+`allowed` decision with its own ID and an expiry still in the future. Every
+other outcome exits non-zero, so the pipeline step that depends on it simply
+doesn't run. When a human review is needed, `--no-wait` exits with code 2 right
+away instead of polling.
+
+An approved review still exits non-zero. Approving a review isn't permission
+to deploy or move money, so feed that decision into your own action-bound
+execution step rather than treating it as a green light.
+
+This is a preview, not a certified execution control. Redirects are never
+followed, so your API key stays with the API host you configure.
 
 ## Install
 

package/index.mjs

@@ -86,7 +86,13 @@ async function resilientFetch(url, init, attempts = 3) {
   let lastError;
   for (let attempt = 0; attempt < attempts; attempt++) {
     try {
-      const response = await fetch(url, { ...init, signal: AbortSignal.timeout(10_000) });
+      // The API never redirects. Following one would send X-API-Key to another
+      // host (fetch drops only Authorization), and a 3xx is never an allow.
+      const response = await fetch(url, {
+        ...init,
+        redirect: "manual",
+        signal: AbortSignal.timeout(10_000),
+      });
       if (response.status !== 429 && response.status < 500) return response;
       if (attempt === attempts - 1) return response;
     } catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qerexa/cli",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Preview CLI for Qerexa execution gates and secret workflows.",
   "type": "module",
   "bin": {