@simonfestl/husky-cli 1.16.0 → 1.18.0

package/dist/commands/auth.js

@@ -1,10 +1,28 @@
 import { Command } from "commander";
-import { getConfig, setSessionConfig, clearSessionConfig, getSessionConfig } from "./config.js";
+import { getConfig, setSessionConfig, clearSessionConfig, getSessionConfig, fetchAndCacheRole } from "./config.js";
 import { getPermissions, clearPermissionsCache, getCacheStatus, hasPermission, canAccessKnowledgeBase } from "../lib/permissions-cache.js";
 const API_KEY_ROLES = [
     "admin", "supervisor", "worker", "reviewer", "support",
     "purchasing", "ops", "e2e_agent", "pr_agent"
 ];
+/**
+ * Sanitize error messages to prevent sensitive data leakage.
+ * Truncates long messages and removes potential secrets.
+ */
+function sanitizeErrorMessage(message, maxLength = 200) {
+    if (!message)
+        return "Unknown error";
+    // Remove potential secrets (patterns like API keys, tokens, etc.)
+    let sanitized = message
+        .replace(/[a-zA-Z0-9_-]{32,}/g, "[REDACTED]") // Long alphanumeric strings
+        .replace(/Bearer\s+[^\s]+/gi, "Bearer [REDACTED]") // Bearer tokens
+        .replace(/key[=:]\s*[^\s,}]+/gi, "key=[REDACTED]"); // key=value patterns
+    // Truncate if too long
+    if (sanitized.length > maxLength) {
+        sanitized = sanitized.substring(0, maxLength) + "...";
+    }
+    return sanitized;
+}
 async function apiRequest(path, options = {}) {
     const config = getConfig();
     if (!config.apiUrl || !config.apiKey) {
@@ -21,7 +39,8 @@ async function apiRequest(path, options = {}) {
     });
     if (!res.ok) {
         const error = await res.json().catch(() => ({ error: res.statusText }));
-        throw new Error(error.message || error.error || `HTTP ${res.status}`);
+        const rawMessage = error.message || error.error || `HTTP ${res.status}`;
+        throw new Error(sanitizeErrorMessage(rawMessage));
     }
     return res.json();
 }
@@ -293,6 +312,8 @@ authCommand
         }
         const session = await res.json();
         setSessionConfig(session);
+        // Fetch and cache permissions for the new session role
+        await fetchAndCacheRole();
         if (options.json) {
             console.log(JSON.stringify({
                 success: true,
@@ -418,6 +439,8 @@ authCommand
         }
         const session = await res.json();
         setSessionConfig(session);
+        // Refresh permissions for the session role
+        await fetchAndCacheRole();
         if (options.json) {
             console.log(JSON.stringify({
                 success: true,

package/dist/commands/config.d.ts

@@ -1,5 +1,6 @@
 import { Command } from "commander";
-type AgentRole = "supervisor" | "worker" | "reviewer" | "e2e_agent" | "pr_agent" | "support";
+declare const VALID_ROLES: readonly ["admin", "supervisor", "worker", "reviewer", "e2e_agent", "pr_agent", "support", "devops", "purchasing", "ops"];
+type AgentRole = typeof VALID_ROLES[number];
 interface Config {
     apiUrl?: string;
     apiKey?: string;
@@ -47,7 +48,8 @@ export declare function getConfig(): Config;
 export declare function saveConfig(config: Config): void;
 /**
  * Fetch role and permissions from /api/auth/whoami
- * Caches the result in config for 1 hour
+ * Uses session token (Bearer) if available, otherwise falls back to API key.
+ * Caches the result in config for 1 hour.
  */
 export declare function fetchAndCacheRole(): Promise<{
     role?: AgentRole;
@@ -58,7 +60,9 @@ export declare function fetchAndCacheRole(): Promise<{
  */
 export declare function hasPermission(permission: string): boolean;
 /**
- * Get current role from config (may be undefined if not fetched)
+ * Get current role from config.
+ * Prefers sessionRole (from auth login) over role (from API key) when session is active.
+ * Validates that the role is a known valid role before returning.
  */
 export declare function getRole(): AgentRole | undefined;
 /**
@@ -72,8 +76,30 @@ export declare function setSessionConfig(session: {
     expiresAt: string;
     agent: string;
     role: string;
+    permissions?: string[];
 }): void;
 export declare function clearSessionConfig(): void;
+/**
+ * Check if there's an active (non-expired) session
+ */
+export declare function isSessionActive(): boolean;
+/**
+ * Check if the API is properly configured for making requests.
+ * Returns true if we have either an active session or an API key.
+ */
+export declare function isApiConfigured(): boolean;
+/**
+ * Get authentication headers for API requests.
+ * Returns Bearer token if session is active, otherwise x-api-key.
+ * Use this for all API calls to ensure consistent auth.
+ */
+export declare function getAuthHeaders(): Record<string, string>;
+/**
+ * Ensure the session is valid, refreshing if needed.
+ * Call this before long-running operations (like watch modes).
+ * Returns true if session is valid (or was refreshed), false if no session/refresh failed.
+ */
+export declare function ensureValidSession(): Promise<boolean>;
 export declare function getSessionConfig(): {
     token?: string;
     expiresAt?: string;

package/dist/commands/config.js

@@ -1,10 +1,18 @@
 import { Command } from "commander";
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
+import { readFileSync, writeFileSync, existsSync, mkdirSync, chmodSync } from "fs";
 import { join } from "path";
 import { homedir } from "os";
 import { ErrorHelpers, errorWithHint, ExplainTopic } from "../lib/error-hints.js";
+// Valid agent roles - used for runtime validation
+const VALID_ROLES = ["admin", "supervisor", "worker", "reviewer", "e2e_agent", "pr_agent", "support", "devops", "purchasing", "ops"];
 const CONFIG_DIR = join(homedir(), ".husky");
 const CONFIG_FILE = join(CONFIG_DIR, "config.json");
+/**
+ * Validate if a string is a valid AgentRole
+ */
+function isValidRole(role) {
+    return VALID_ROLES.includes(role);
+}
 // API Key validation - must be at least 16 characters, alphanumeric + common key chars (base64, JWT, etc.)
 function validateApiKey(key) {
     if (key.length < 16) {
@@ -43,25 +51,67 @@ export function getConfig() {
 }
 export function saveConfig(config) {
     if (!existsSync(CONFIG_DIR)) {
-        mkdirSync(CONFIG_DIR, { recursive: true });
+        mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 }); // rwx------ for directory
+    }
+    writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), { mode: 0o600 }); // rw------- for file
+    // Ensure permissions are set even if file existed
+    try {
+        chmodSync(CONFIG_FILE, 0o600);
+    }
+    catch {
+        // Ignore chmod errors on Windows
     }
-    writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2));
 }
 /**
  * Fetch role and permissions from /api/auth/whoami
- * Caches the result in config for 1 hour
+ * Uses session token (Bearer) if available, otherwise falls back to API key.
+ * Caches the result in config for 1 hour.
  */
 export async function fetchAndCacheRole() {
     const config = getConfig();
-    // Check if we have cached role that's less than 1 hour old
+    // Check if there's an active session - if so, use session role directly
+    // Session roles are already validated by the server, no need to re-fetch
+    if (config.sessionToken && config.sessionRole && config.sessionExpiresAt) {
+        const expiresAt = new Date(config.sessionExpiresAt);
+        if (expiresAt > new Date()) {
+            // Session is active - fetch permissions for this session role if needed
+            // Check if we have fresh permissions for this session
+            const needsPermissionsFetch = !config.roleLastChecked || !config.permissions;
+            if (needsPermissionsFetch && config.apiUrl) {
+                try {
+                    const url = new URL("/api/auth/whoami", config.apiUrl);
+                    const res = await fetch(url.toString(), {
+                        headers: { Authorization: `Bearer ${config.sessionToken}` },
+                    });
+                    if (res.ok) {
+                        const data = await res.json();
+                        // Update permissions cache (keep sessionRole as source of truth for role)
+                        config.permissions = data.permissions;
+                        config.roleLastChecked = new Date().toISOString();
+                        saveConfig(config);
+                        return { role: config.sessionRole, permissions: data.permissions };
+                    }
+                }
+                catch {
+                    // Fall through to use cached permissions
+                }
+            }
+            // Return session role with cached permissions
+            return { role: config.sessionRole, permissions: config.permissions };
+        }
+    }
+    // No active session - use API key auth
+    // Check if we have cached role that's less than 5 minutes old
+    // Short TTL ensures revoked permissions are detected quickly
+    const PERMISSION_CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes
     if (config.role && config.roleLastChecked) {
         const lastChecked = new Date(config.roleLastChecked);
-        const oneHourAgo = new Date(Date.now() - 60 * 60 * 1000);
-        if (lastChecked > oneHourAgo) {
+        const cacheExpiry = new Date(Date.now() - PERMISSION_CACHE_TTL_MS);
+        if (lastChecked > cacheExpiry) {
             return { role: config.role, permissions: config.permissions };
         }
     }
-    // Fetch fresh role/permissions
+    // Fetch fresh role/permissions using API key
     if (!config.apiUrl || !config.apiKey) {
         return {};
     }
@@ -102,10 +152,30 @@ export function hasPermission(permission) {
     return false;
 }
 /**
- * Get current role from config (may be undefined if not fetched)
+ * Get current role from config.
+ * Prefers sessionRole (from auth login) over role (from API key) when session is active.
+ * Validates that the role is a known valid role before returning.
  */
 export function getRole() {
-    return getConfig().role;
+    const config = getConfig();
+    // Check if there's an active (non-expired) session
+    if (config.sessionToken && config.sessionRole && config.sessionExpiresAt) {
+        const expiresAt = new Date(config.sessionExpiresAt);
+        if (expiresAt > new Date()) {
+            // Session is active, validate and use session role
+            if (isValidRole(config.sessionRole)) {
+                return config.sessionRole;
+            }
+            // Invalid role in session - treat as no session
+            console.error(`Warning: Invalid session role '${config.sessionRole}' in config`);
+            return undefined;
+        }
+    }
+    // Fall back to API key role (also validate)
+    if (config.role && isValidRole(config.role)) {
+        return config.role;
+    }
+    return undefined;
 }
 /**
  * Clear the role cache to force a refresh on next fetchAndCacheRole call
@@ -133,6 +203,17 @@ export function setSessionConfig(session) {
     config.sessionExpiresAt = session.expiresAt;
     config.sessionAgent = session.agent;
     config.sessionRole = session.role;
+    // Clear old permissions and role cache to force re-fetch for new session role
+    delete config.roleLastChecked;
+    if (session.permissions) {
+        // If permissions provided, use them directly
+        config.permissions = session.permissions;
+        config.roleLastChecked = new Date().toISOString();
+    }
+    else {
+        // Clear permissions to force re-fetch
+        delete config.permissions;
+    }
     saveConfig(config);
 }
 export function clearSessionConfig() {
@@ -143,6 +224,91 @@ export function clearSessionConfig() {
     delete config.sessionRole;
     saveConfig(config);
 }
+/**
+ * Check if there's an active (non-expired) session
+ */
+export function isSessionActive() {
+    const config = getConfig();
+    if (!config.sessionToken || !config.sessionExpiresAt) {
+        return false;
+    }
+    const expiresAt = new Date(config.sessionExpiresAt);
+    return expiresAt > new Date();
+}
+/**
+ * Check if the API is properly configured for making requests.
+ * Returns true if we have either an active session or an API key.
+ */
+export function isApiConfigured() {
+    const config = getConfig();
+    return Boolean(config.apiUrl && (config.apiKey || isSessionActive()));
+}
+/**
+ * Get authentication headers for API requests.
+ * Returns Bearer token if session is active, otherwise x-api-key.
+ * Use this for all API calls to ensure consistent auth.
+ */
+export function getAuthHeaders() {
+    const config = getConfig();
+    // Check if there's an active (non-expired) session
+    if (config.sessionToken && config.sessionExpiresAt) {
+        const expiresAt = new Date(config.sessionExpiresAt);
+        if (expiresAt > new Date()) {
+            // Session is active - use Bearer token
+            return { Authorization: `Bearer ${config.sessionToken}` };
+        }
+    }
+    // Fall back to API key
+    if (config.apiKey) {
+        return { "x-api-key": config.apiKey };
+    }
+    return {};
+}
+/**
+ * Ensure the session is valid, refreshing if needed.
+ * Call this before long-running operations (like watch modes).
+ * Returns true if session is valid (or was refreshed), false if no session/refresh failed.
+ */
+export async function ensureValidSession() {
+    const config = getConfig();
+    if (!config.sessionToken || !config.sessionExpiresAt) {
+        return false; // No session, will use API key
+    }
+    const expiresAt = new Date(config.sessionExpiresAt);
+    const now = new Date();
+    const fiveMinutes = 5 * 60 * 1000;
+    // Refresh if expiring within 5 minutes
+    if (expiresAt.getTime() - now.getTime() < fiveMinutes) {
+        if (!config.apiUrl || !config.apiKey || !config.sessionAgent) {
+            return false; // Can't refresh without these
+        }
+        try {
+            const url = new URL("/api/auth/session", config.apiUrl);
+            const res = await fetch(url.toString(), {
+                method: "POST",
+                headers: {
+                    "x-api-key": config.apiKey,
+                    "Content-Type": "application/json",
+                },
+                body: JSON.stringify({ agent: config.sessionAgent }),
+            });
+            if (res.ok) {
+                const data = await res.json();
+                setSessionConfig({
+                    token: data.token,
+                    expiresAt: data.expiresAt,
+                    agent: data.agent,
+                    role: data.role,
+                });
+                return true;
+            }
+        }
+        catch {
+            // Refresh failed, continue with current token if not expired
+        }
+    }
+    return expiresAt > now;
+}
 export function getSessionConfig() {
     const config = getConfig();
     if (!config.sessionToken)

package/dist/commands/interactive/auth.js

@@ -4,7 +4,7 @@
  * Provides menu-based authentication and API key management.
  */
 import { select, input, confirm } from "@inquirer/prompts";
-import { getConfig, setConfig, setSessionConfig, clearSessionConfig } from "../config.js";
+import { getConfig, setConfig, setSessionConfig, clearSessionConfig, getAuthHeaders } from "../config.js";
 import { pressEnterToContinue } from "./utils.js";
 export async function authMenu() {
     console.log("\n  AUTH");
@@ -65,7 +65,7 @@ async function login() {
             method: "POST",
             headers: {
                 "Content-Type": "application/json",
-                ...(config.apiKey ? { "x-api-key": config.apiKey } : {}),
+                ...getAuthHeaders(),
             },
             body: JSON.stringify({ agent: agentName }),
         });

package/dist/commands/interactive/brain.js

@@ -4,6 +4,7 @@
  * Provides menu-based agent memory and learning management.
  */
 import { select, input, confirm } from "@inquirer/prompts";
+import { getAuthHeaders } from "../config.js";
 import { ensureConfig, pressEnterToContinue, truncate } from "./utils.js";
 export async function brainMenu() {
     const config = ensureConfig();
@@ -66,7 +67,7 @@ async function listMemories(config) {
             default: "20",
         });
         const res = await fetch(`${config.apiUrl}/api/brain/memories?limit=${limit}`, {
-            headers: config.apiKey ? { "x-api-key": config.apiKey } : {},
+            headers: getAuthHeaders(),
         });
         if (!res.ok) {
             console.error(`\n  Error: API returned ${res.status}\n`);
@@ -103,7 +104,7 @@ async function recallMemory(config) {
             validate: (v) => (v.length > 0 ? true : "Query is required"),
         });
         const res = await fetch(`${config.apiUrl}/api/brain/recall?query=${encodeURIComponent(query)}`, {
-            headers: config.apiKey ? { "x-api-key": config.apiKey } : {},
+            headers: getAuthHeaders(),
         });
         if (!res.ok) {
             console.error(`\n  Error: API returned ${res.status}\n`);
@@ -147,7 +148,7 @@ async function rememberContent(config) {
             method: "POST",
             headers: {
                 "Content-Type": "application/json",
-                ...(config.apiKey ? { "x-api-key": config.apiKey } : {}),
+                ...(getAuthHeaders()),
             },
             body: JSON.stringify({ content, tags }),
         });
@@ -183,7 +184,7 @@ async function publishMemory(config) {
             method: "POST",
             headers: {
                 "Content-Type": "application/json",
-                ...(config.apiKey ? { "x-api-key": config.apiKey } : {}),
+                ...(getAuthHeaders()),
             },
             body: JSON.stringify({ visibility }),
         });
@@ -204,7 +205,7 @@ async function publishMemory(config) {
 async function sharedMemories(config) {
     try {
         const res = await fetch(`${config.apiUrl}/api/brain/shared`, {
-            headers: config.apiKey ? { "x-api-key": config.apiKey } : {},
+            headers: getAuthHeaders(),
         });
         if (!res.ok) {
             console.error(`\n  Error: API returned ${res.status}\n`);
@@ -242,7 +243,7 @@ async function boostMemory(config) {
         });
         const res = await fetch(`${config.apiUrl}/api/brain/boost/${id}`, {
             method: "POST",
-            headers: config.apiKey ? { "x-api-key": config.apiKey } : {},
+            headers: getAuthHeaders(),
         });
         if (!res.ok) {
             const error = await res.text();
@@ -275,7 +276,7 @@ async function archiveMemory(config) {
         }
         const res = await fetch(`${config.apiUrl}/api/brain/archive/${id}`, {
             method: "POST",
-            headers: config.apiKey ? { "x-api-key": config.apiKey } : {},
+            headers: getAuthHeaders(),
         });
         if (!res.ok) {
             const error = await res.text();
@@ -308,7 +309,7 @@ async function deleteMemory(config) {
         }
         const res = await fetch(`${config.apiUrl}/api/brain/memories/${id}`, {
             method: "DELETE",
-            headers: config.apiKey ? { "x-api-key": config.apiKey } : {},
+            headers: getAuthHeaders(),
         });
         if (!res.ok) {
             const error = await res.text();
@@ -337,7 +338,7 @@ async function cleanupMemories(config) {
         }
         const res = await fetch(`${config.apiUrl}/api/brain/cleanup`, {
             method: "POST",
-            headers: config.apiKey ? { "x-api-key": config.apiKey } : {},
+            headers: getAuthHeaders(),
         });
         if (!res.ok) {
             const error = await res.text();

package/dist/commands/interactive/changelog.js

@@ -1,5 +1,6 @@
 import { select, input, confirm } from "@inquirer/prompts";
 import { execSync } from "child_process";
+import { getAuthHeaders } from "../config.js";
 import { ensureConfig, pressEnterToContinue, truncate, formatDate } from "./utils.js";
 const TYPE_LABELS = {
     feature: "New Features",
@@ -55,7 +56,7 @@ async function fetchChangelogs(config, projectId) {
         url.searchParams.set("projectId", projectId);
     }
     const res = await fetch(url.toString(), {
-        headers: config.apiKey ? { "x-api-key": config.apiKey } : {},
+        headers: getAuthHeaders(),
     });
     if (!res.ok)
         throw new Error(`API returned ${res.status}`);
@@ -63,7 +64,7 @@ async function fetchChangelogs(config, projectId) {
 }
 async function fetchProjects(config) {
     const res = await fetch(`${config.apiUrl}/api/projects`, {
-        headers: config.apiKey ? { "x-api-key": config.apiKey } : {},
+        headers: getAuthHeaders(),
     });
     if (!res.ok)
         throw new Error(`API returned ${res.status}`);
@@ -86,7 +87,7 @@ async function selectChangelog(config, message) {
         return null;
     // Fetch full changelog
     const res = await fetch(`${config.apiUrl}/api/changelogs/${changelogId}`, {
-        headers: config.apiKey ? { "x-api-key": config.apiKey } : {},
+        headers: getAuthHeaders(),
     });
     if (!res.ok)
         return null;
@@ -208,7 +209,7 @@ async function generateChangelog(config) {
             method: "POST",
             headers: {
                 "Content-Type": "application/json",
-                ...(config.apiKey ? { "x-api-key": config.apiKey } : {}),
+                ...(getAuthHeaders()),
             },
             body: JSON.stringify({
                 projectId,
@@ -279,7 +280,7 @@ async function publishChangelog(config) {
             method: "PATCH",
             headers: {
                 "Content-Type": "application/json",
-                ...(config.apiKey ? { "x-api-key": config.apiKey } : {}),
+                ...(getAuthHeaders()),
             },
             body: JSON.stringify({
                 status: "published",
@@ -315,7 +316,7 @@ async function deleteChangelog(config) {
         }
         const res = await fetch(`${config.apiUrl}/api/changelogs/${changelog.id}`, {
             method: "DELETE",
-            headers: config.apiKey ? { "x-api-key": config.apiKey } : {},
+            headers: getAuthHeaders(),
         });
         if (!res.ok) {
             console.error(`\n  Error: API returned ${res.status}\n`);

package/dist/commands/interactive/chat.js

@@ -5,6 +5,7 @@
  */
 import { select, input, confirm } from "@inquirer/prompts";
 import { ensureConfig, pressEnterToContinue, truncate, formatDate } from "./utils.js";
+import { getAuthHeaders, ensureValidSession } from "../config.js";
 export async function chatMenu() {
     const config = ensureConfig();
     console.log("\n  CHAT");
@@ -67,7 +68,7 @@ async function showInbox(config) {
         });
         const url = `${config.apiUrl}/api/supervisor/inbox${unreadOnly ? "?unread=true" : ""}`;
         const res = await fetch(url, {
-            headers: config.apiKey ? { "x-api-key": config.apiKey } : {},
+            headers: getAuthHeaders(),
         });
         if (!res.ok) {
             console.error(`\n  Error: API returned ${res.status}\n`);
@@ -102,7 +103,7 @@ async function showInbox(config) {
 async function showPending(config) {
     try {
         const res = await fetch(`${config.apiUrl}/api/supervisor/pending`, {
-            headers: config.apiKey ? { "x-api-key": config.apiKey } : {},
+            headers: getAuthHeaders(),
         });
         if (!res.ok) {
             console.error(`\n  Error: API returned ${res.status}\n`);
@@ -142,7 +143,7 @@ async function sendMessage(config) {
             method: "POST",
             headers: {
                 "Content-Type": "application/json",
-                ...(config.apiKey ? { "x-api-key": config.apiKey } : {}),
+                ...getAuthHeaders(),
             },
             body: JSON.stringify({ message }),
         });
@@ -174,7 +175,7 @@ async function replyToMessage(config) {
             method: "POST",
             headers: {
                 "Content-Type": "application/json",
-                ...(config.apiKey ? { "x-api-key": config.apiKey } : {}),
+                ...getAuthHeaders(),
             },
             body: JSON.stringify({ response }),
         });
@@ -196,12 +197,15 @@ async function watchMessages(config) {
     console.log("\n  WATCH MODE");
     console.log("  " + "-".repeat(50));
     console.log("  Watching for new messages...");
+    console.log("  (Session token will auto-refresh if needed)");
     console.log("");
     let lastCheck = new Date().toISOString();
     const checkMessages = async () => {
         try {
+            // Ensure session is valid before each poll (auto-refreshes if needed)
+            await ensureValidSession();
             const res = await fetch(`${config.apiUrl}/api/supervisor/inbox?since=${encodeURIComponent(lastCheck)}`, {
-                headers: config.apiKey ? { "x-api-key": config.apiKey } : {},
+                headers: getAuthHeaders(),
             });
             if (res.ok) {
                 const messages = await res.json();
@@ -211,6 +215,9 @@ async function watchMessages(config) {
                     console.log("");
                 }
             }
+            else if (res.status === 401) {
+                console.log(`  [${new Date().toLocaleTimeString()}] Auth error - will retry with refreshed token`);
+            }
             lastCheck = new Date().toISOString();
         }
         catch {
@@ -229,7 +236,7 @@ async function watchMessages(config) {
 async function showConversations(config) {
     try {
         const res = await fetch(`${config.apiUrl}/api/agent-conversations`, {
-            headers: config.apiKey ? { "x-api-key": config.apiKey } : {},
+            headers: getAuthHeaders(),
         });
         if (!res.ok) {
             console.error(`\n  Error: API returned ${res.status}\n`);
@@ -260,7 +267,7 @@ async function showConversations(config) {
 async function showSpaces(config) {
     try {
         const res = await fetch(`${config.apiUrl}/api/chat/spaces`, {
-            headers: config.apiKey ? { "x-api-key": config.apiKey } : {},
+            headers: getAuthHeaders(),
         });
         if (!res.ok) {
             console.error(`\n  Error: API returned ${res.status}\n`);
@@ -303,7 +310,7 @@ async function askQuestion(config) {
             method: "POST",
             headers: {
                 "Content-Type": "application/json",
-                ...(config.apiKey ? { "x-api-key": config.apiKey } : {}),
+                ...getAuthHeaders(),
             },
             body: JSON.stringify({ question, wait: waitForAnswer }),
         });
@@ -342,7 +349,7 @@ async function requestReview(config) {
             method: "POST",
             headers: {
                 "Content-Type": "application/json",
-                ...(config.apiKey ? { "x-api-key": config.apiKey } : {}),
+                ...getAuthHeaders(),
             },
             body: JSON.stringify({ question }),
         });

package/dist/commands/interactive/departments.js

@@ -1,4 +1,5 @@
 import { select, input, confirm } from "@inquirer/prompts";
+import { getAuthHeaders } from "../config.js";
 import { ensureConfig, pressEnterToContinue, truncate } from "./utils.js";
 export async function departmentsMenu() {
     const config = ensureConfig();
@@ -36,7 +37,7 @@ export async function departmentsMenu() {
 }
 async function fetchDepartments(config) {
     const res = await fetch(`${config.apiUrl}/api/departments`, {
-        headers: config.apiKey ? { "x-api-key": config.apiKey } : {},
+        headers: getAuthHeaders(),
     });
     if (!res.ok)
         throw new Error(`API returned ${res.status}`);
@@ -87,7 +88,7 @@ async function viewDepartment(config) {
         if (!dept)
             return;
         const res = await fetch(`${config.apiUrl}/api/departments/${dept.id}`, {
-            headers: config.apiKey ? { "x-api-key": config.apiKey } : {},
+            headers: getAuthHeaders(),
         });
         if (!res.ok) {
             console.error(`\n  Error: API returned ${res.status}\n`);
@@ -128,7 +129,7 @@ async function createDepartment(config) {
             method: "POST",
             headers: {
                 "Content-Type": "application/json",
-                ...(config.apiKey ? { "x-api-key": config.apiKey } : {}),
+                ...(getAuthHeaders()),
             },
             body: JSON.stringify({
                 name,
@@ -192,7 +193,7 @@ async function updateDepartment(config) {
             method: "PATCH",
             headers: {
                 "Content-Type": "application/json",
-                ...(config.apiKey ? { "x-api-key": config.apiKey } : {}),
+                ...(getAuthHeaders()),
             },
             body: JSON.stringify(updateData),
         });
@@ -225,7 +226,7 @@ async function deleteDepartment(config) {
         }
         const res = await fetch(`${config.apiUrl}/api/departments/${dept.id}`, {
             method: "DELETE",
-            headers: config.apiKey ? { "x-api-key": config.apiKey } : {},
+            headers: getAuthHeaders(),
         });
         if (!res.ok) {
             console.error(`\n  Error: API returned ${res.status}\n`);