human-machine-swapper 1.4.0 → 1.4.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "human-machine-swapper",
-  "version": "1.4.0",
+  "version": "1.4.1",
   "description": "A web component that adds a Human / Machine pill to any website. Machine shows the site's llms.txt, the plain-text reading written for language models, rendered in place. One file, about 6 KB gzipped, no dependencies and no build step.",
   "keywords": [
     "llms.txt",
@@ -50,7 +50,8 @@
   "sideEffects": true,
   "scripts": {
     "test": "node --test test/*.test.mjs",
-    "test:wp": "php wordpress/test/generator-test.php"
+    "test:wp": "php wordpress/test/generator-test.php",
+    "test:wp:integration": "node wordpress/test/integration.mjs"
   },
   "engines": {
     "node": ">=18"

package/src/human-machine-swapper.js

@@ -71,7 +71,10 @@
 
     for (const path of PROBE_PATHS) {
       try {
-        const response = await fetch(path, { method: "HEAD", credentials: "omit" });
+        // same-origin, not omit: behind a login (a Vercel preview, an intranet) a cookieless
+        // request is bounced to the login page, the probe fails, and the pill never appears.
+        // Cookies still never go to another origin.
+        const response = await fetch(path, { method: "HEAD", credentials: "same-origin" });
         if (response.ok) {
           try {
             window.sessionStorage.setItem(cacheKey, path);
@@ -472,7 +475,9 @@
 
       if (!this._text) {
         try {
-          const response = await fetch(href, { credentials: "omit" });
+          // same-origin: see the probe above. With "omit", a protected deployment bounced this
+          // to its login page, the fetch failed, and the reader fell back to the raw file.
+          const response = await fetch(href, { credentials: "same-origin" });
           if (!response.ok) throw new Error(String(response.status));
           this._text = await response.text();
         } catch (error) {