premanmcp 1.1.9 → 1.1.11

package/bin/shared.js

@@ -322,12 +322,20 @@ export function pairedFrontendUrl(args) {
   const backend = backendUrl(args);
   const login = activeLogin(args);
   const paired = String(login?.backend_url || "").replace(/\/+$/, "");
+  // A deployment we know the dashboard for decides it, ahead of anything
+  // stored. The stored value can be wrong about this and was: a login that
+  // changed backend inherited the previous dashboard, leaving a record naming
+  // production's API and a localhost dashboard. Trusting the record on the
+  // strength of the backends matching then made that permanent, because the
+  // mismatch it was meant to catch had already been written down. Someone
+  // genuinely running their own dashboard against this API still has
+  // `--frontend` and `PREMAN_FRONTEND`, which are checked above.
+  if (backend === DEFAULT_BACKEND) return DEFAULT_FRONTEND;
   // Only while this invocation is talking to the deployment the key was minted
   // against -- which is exactly the condition `frontendUrl`'s docstring names.
   if (login?.frontend_url && paired && paired === backend) {
     return String(login.frontend_url).replace(/\/+$/, "");
   }
-  if (backend === DEFAULT_BACKEND) return DEFAULT_FRONTEND;
   return "";
 }
 
@@ -733,7 +741,15 @@ export async function authenticateTerminal(args) {
     const creds = {
       api_key: explicitKey,
       backend_url: backendUrl(args),
-      frontend_url: frontendUrl(args),
+      // `pairedFrontendUrl`, not `frontendUrl`: the latter falls back to the
+      // PREVIOUS login's frontend, so signing into a different deployment
+      // inherited the old dashboard and stored a record naming one backend and
+      // a different backend's frontend. Measured: a login against production kept
+      // `http://localhost:8080`, and every run link printed afterwards named a
+      // dashboard the run had never been near. This resolver returns the
+      // dashboard for THIS backend or nothing, and an empty value still reads
+      // back as the default wherever prose needs one.
+      frontend_url: pairedFrontendUrl(args),
       user_email: args.value("--email", ""),
       device_name: os.hostname(),
       created_at: new Date().toISOString(),
@@ -809,7 +825,15 @@ export async function authenticateTerminal(args) {
     access_token: accessToken,
     user: sessionUser,
     backend_url: backendUrl(args),
-    frontend_url: frontendUrl(args),
+    // `pairedFrontendUrl`, not `frontendUrl`: the latter falls back to the
+    // PREVIOUS login's frontend, so signing into a different deployment
+    // inherited the old dashboard and stored a record naming one backend and
+    // a different backend's frontend. Measured: a login against production kept
+    // `http://localhost:8080`, and every run link printed afterwards named a
+    // dashboard the run had never been near. This resolver returns the
+    // dashboard for THIS backend or nothing, and an empty value still reads
+    // back as the default wherever prose needs one.
+    frontend_url: pairedFrontendUrl(args),
     user_email: email,
     device_name: os.hostname(),
     created_at: new Date().toISOString(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "premanmcp",
-  "version": "1.1.9",
+  "version": "1.1.11",
   "description": "PreMan CLI and stdio proxy for PreMan's hosted MCP server",
   "type": "module",
   "bin": {