@vellumai/cli 0.10.1 → 0.10.2-dev.202606241651.2d2b40d

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/cli",
-  "version": "0.10.1",
+  "version": "0.10.2-dev.202606241651.2d2b40d",
   "description": "CLI tools for vellum-assistant",
   "type": "module",
   "exports": {

package/src/commands/client.ts

@@ -895,14 +895,27 @@ async function runWebInterface(
       headers.delete("Origin");
       headers.delete("Referer");
 
-      // Authenticate with the loopback session token the SPA registered. The
-      // platform expects it both as the Django session cookie and as
-      // X-Session-Token (for DRF views that accept header-based auth). Only
+      // The DRF API authenticates by header (X-Session-Token); the allauth /
+      // accounts session endpoints need the Django session cookie.
+      const isApiRequest = pathname.startsWith("/v1/");
+
+      // Authenticate with the loopback session token the SPA registered. Only
       // same-origin SPA traffic gets the credential — never a cross-site caller.
       const sessionToken = isSameOriginRequest(req)
         ? currentPlatformToken()
         : null;
-      if (sessionToken) {
+      if (isApiRequest) {
+        // Header-only auth for the DRF API. Sending a `sessionid` cookie would
+        // engage Django's SessionAuthentication, which enforces CSRF — and the
+        // proxy strips Origin/Referer above, so the CSRF Referer check would
+        // reject every unsafe (POST/PUT/PATCH) request. Drop any browser cookie
+        // (localhost jar) so it can't re-engage that path.
+        headers.delete("Cookie");
+        if (sessionToken) {
+          headers.set("X-Session-Token", sessionToken);
+        }
+      } else if (sessionToken) {
+        // allauth / accounts: the platform expects the Django session cookie.
         headers.set(
           "Cookie",
           `sessionid=${sessionToken}; __Secure-sessionid=${sessionToken}`,

package/src/lib/confirm-action.ts

@@ -18,6 +18,9 @@ export function canPromptForConfirmation(): boolean {
  * Show `prompt` and resolve true on Enter, false on Esc/q/Ctrl-C. Restores the
  * prior stdin raw/paused state on exit. Caller must gate on
  * {@link canPromptForConfirmation} first.
+ *
+ * `unref()`s stdin on cleanup so the resumed handle doesn't keep the process
+ * alive after the prompt resolves.
  */
 export async function confirmAction(prompt: string): Promise<boolean> {
   const stdin = process.stdin;
@@ -36,6 +39,7 @@ export async function confirmAction(prompt: string): Promise<boolean> {
       if (wasPaused) {
         stdin.pause();
       }
+      stdin.unref?.();
       stdout.write("\n");
     };