promptdock 0.1.0 → 1.0.1-rc.8

package/README.md

@@ -68,7 +68,10 @@ npx promptdock@latest install garry/seo-content-audit --target claude -y
 ```
 
 - `PROMPTDOCK_TOKEN` — bearer token (overrides any stored login).
-- `PROMPTDOCK_API_BASE` — API origin override (default `https://promptdock.ai`).
+- `PROMPTDOCK_API_BASE` — API origin override (default `https://www.promptdock.ai`).
+  Must be the origin the API is **served** on. Pointing it at a host that redirects
+  will not work: a cross-origin redirect drops the request body and strips the
+  `Authorization` header, so the CLI refuses to follow one and tells you the target.
 - Without `--target`/`--dir` **and** `-y`, a non-interactive install exits `1`
   with the exact flags to add. Without a token it exits `2`.
 - `NO_COLOR` is honored.

package/dist/api.js

@@ -1,4 +1,13 @@
 import { CliError, EXIT, networkError } from "./errors.js";
+/** Origin of a Location header, for the "set PROMPTDOCK_API_BASE to …" hint. */
+function originOf(location) {
+    try {
+        return new URL(location).origin;
+    }
+    catch {
+        return null; // relative Location — can't name an origin, fall back to the default
+    }
+}
 export class Api {
     ctx;
     baseUrl;
@@ -28,12 +37,27 @@ export class Api {
             res = await this.ctx.fetch(`${this.baseUrl}${path}`, {
                 method,
                 headers: this.headers(body !== undefined),
+                // NEVER "follow" here. A cross-origin redirect silently downgrades POST to
+                // GET, drops the body, AND strips Authorization — so following one turns a
+                // misconfigured origin into a 405 or a bogus 401 with no hint of the cause.
+                // NEVER "error" either: that rejects with a TypeError, which the catch below
+                // would report as a connectivity failure — the opposite of the truth.
+                redirect: "manual",
                 ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
             });
         }
         catch {
             throw networkError(this.baseUrl, this.ctx.env);
         }
+        // Only the API client refuses redirects. Signed-URL downloads (installer.ts) use
+        // ctx.fetch directly and must keep following them — storage hands out redirects.
+        if (res.status >= 300 && res.status < 400) {
+            const to = res.headers.get("location") ?? "(no location header)";
+            throw new CliError(`${this.baseUrl} redirected to ${to} — the API must be called on its canonical origin, because a redirect drops the request body and the login token.`, EXIT.NETWORK, {
+                hint: `set PROMPTDOCK_API_BASE to the redirect target, e.g. PROMPTDOCK_API_BASE=${originOf(to) ?? "https://www.promptdock.ai"}`,
+                footer: "api",
+            });
+        }
         let parsed = null;
         try {
             parsed = await res.json();

package/dist/config.d.ts

@@ -1,4 +1,4 @@
-export declare const DEFAULT_API_BASE = "https://promptdock.ai";
+export declare const DEFAULT_API_BASE = "https://www.promptdock.ai";
 export type CliConfig = {
     token?: string;
     api_base?: string;

package/dist/config.js

@@ -5,7 +5,23 @@
 import { chmodSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { CliError, EXIT } from "./errors.js";
-export const DEFAULT_API_BASE = "https://promptdock.ai";
+// ⚠️ MUST be the host the API is actually SERVED on, not the brand apex.
+// `promptdock.ai` 301-redirects to `www.promptdock.ai`, and Node's fetch follows
+// that redirect ACROSS AN ORIGIN — which per the fetch spec (a) downgrades POST to
+// GET and drops the body, and (b) STRIPS the `Authorization` header. Both, at any
+// status code: a 308 preserves the method and still scrubs the bearer. So pointing
+// this at the apex breaks every call — login POSTs answered with 405, and every
+// authenticated GET arriving anonymous and answered 401. Keep this in lockstep with
+// SITE_URL in lib/site-url.ts; `base-url.test.ts` fails the build if they diverge.
+export const DEFAULT_API_BASE = "https://www.promptdock.ai";
+/**
+ * Origins a PREVIOUS release persisted into ~/.promptdock/config.json and which are
+ * known-broken. A successful login writes `api_base`, and a stored value outranks
+ * DEFAULT_API_BASE — so without this, everyone who ever logged in with <=1.0.0 would
+ * keep hitting the apex forever, even after upgrading. Self-healing beats asking
+ * every user to log out.
+ */
+const LEGACY_API_BASES = new Set(["https://promptdock.ai", "http://promptdock.ai"]);
 export function configDir(home) {
     return join(home, ".promptdock");
 }
@@ -56,9 +72,19 @@ export function saveConfig(home, config, platform) {
 export function resolveToken(env, config) {
     return env.PROMPTDOCK_TOKEN || (typeof config.token === "string" ? config.token : null) || null;
 }
+const trimBase = (s) => s.replace(/\/+$/, "");
+// ⚠️ Login persists `api_base` ALONGSIDE the token, deliberately — do not "fix" this
+// to skip persistence when the origin came from PROMPTDOCK_API_BASE. A token is
+// minted by one specific database (prod and staging are separate Supabase projects),
+// so the token and the origin are a PAIR. Storing the token without its origin means
+// the next run sends a staging token to the default origin and 401s. The apex-pinning
+// problem that motivated the idea is handled by LEGACY_API_BASES below instead.
 export function resolveApiBase(env, config) {
-    const base = env.PROMPTDOCK_API_BASE ||
-        (typeof config.api_base === "string" ? config.api_base : null) ||
-        DEFAULT_API_BASE;
-    return base.replace(/\/+$/, "");
+    if (env.PROMPTDOCK_API_BASE)
+        return trimBase(env.PROMPTDOCK_API_BASE);
+    const stored = typeof config.api_base === "string" ? trimBase(config.api_base) : null;
+    // Drop a base a broken release pinned here; anything else the user set is honoured.
+    if (stored && !LEGACY_API_BASES.has(stored))
+        return stored;
+    return trimBase(DEFAULT_API_BASE);
 }

package/dist/context.d.ts

@@ -1,3 +1,14 @@
+/**
+ * argv joined for the `X-Promptdock-Cli-Args` header, with bearer tokens removed.
+ *
+ * That header rides EVERY request so the server can echo a copy-pasteable remedy in
+ * a 426. But the documented CI path is `promptdock login --token pdk_…`, so joining
+ * argv raw put the user's live secret in a custom header on every call — logged by
+ * every proxy in between, and (before the redirect fix) sent to whatever host the
+ * apex happened to redirect to. Redact the value, not the flag: the server's remedy
+ * still needs to show that `--token` was passed.
+ */
+export declare function redactArgs(argv: string[]): string;
 /** I/O seam — commands never touch process.* directly (unit tests inject fakes). */
 export type CliIo = {
     /** stdout line */

package/dist/context.js

@@ -2,6 +2,30 @@ import { spawn } from "node:child_process";
 import { homedir } from "node:os";
 import { createInterface } from "node:readline/promises";
 import { readFileSync } from "node:fs";
+/**
+ * argv joined for the `X-Promptdock-Cli-Args` header, with bearer tokens removed.
+ *
+ * That header rides EVERY request so the server can echo a copy-pasteable remedy in
+ * a 426. But the documented CI path is `promptdock login --token pdk_…`, so joining
+ * argv raw put the user's live secret in a custom header on every call — logged by
+ * every proxy in between, and (before the redirect fix) sent to whatever host the
+ * apex happened to redirect to. Redact the value, not the flag: the server's remedy
+ * still needs to show that `--token` was passed.
+ */
+export function redactArgs(argv) {
+    return argv
+        .map((a, i) => {
+        if (/^pdk_/.test(a))
+            return "pdk_***";
+        // `--token <value>` / `--token=<value>`
+        if (/^--token=/.test(a))
+            return "--token=***";
+        if (argv[i - 1] === "--token")
+            return "***";
+        return a;
+    })
+        .join(" ");
+}
 /** Read the package's own version (dist/ and src/ both sit one level under the root). */
 export function readOwnVersion() {
     try {
@@ -53,7 +77,7 @@ export function realContext(argv) {
         platform: process.platform,
         fetch: globalThis.fetch,
         version: readOwnVersion(),
-        argsLine: argv.join(" "),
+        argsLine: redactArgs(argv),
         now: () => Date.now(),
         sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
         openUrl: (url) => openUrlBestEffort(url, process.platform),

package/dist/help.js

@@ -39,7 +39,7 @@ ${targets}
 
   Environment
     PROMPTDOCK_TOKEN          bearer token for CI/non-interactive use (Settings → CLI sessions → Generate token)
-    PROMPTDOCK_API_BASE       API origin override (default https://promptdock.ai)
+    PROMPTDOCK_API_BASE       API origin override (default https://www.promptdock.ai)
     NO_COLOR                  disable colored output
 
   Exit codes

package/package.json

@@ -1,15 +1,36 @@
 {
   "name": "promptdock",
-  "version": "0.1.0",
+  "version": "1.0.1-rc.8",
   "description": "Install AI agent skills from PromptDock — npx promptdock@latest install <handle>/<slug>",
-  "keywords": ["promptdock", "skills", "ai", "agents", "claude", "cli"],
+  "keywords": [
+    "promptdock",
+    "skills",
+    "ai",
+    "agents",
+    "claude",
+    "cli"
+  ],
   "homepage": "https://promptdock.ai",
-  "bugs": { "url": "https://promptdock.ai/docs/cli/errors" },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/klicklabs/promptdock.ai.git",
+    "directory": "packages/cli"
+  },
+  "bugs": {
+    "url": "https://promptdock.ai/docs/cli/errors"
+  },
   "license": "UNLICENSED",
   "type": "module",
-  "bin": { "promptdock": "dist/index.js" },
-  "files": ["dist", "README.md"],
-  "engines": { "node": ">=18" },
+  "bin": {
+    "promptdock": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "test": "vitest run",