speculos-toolkit 1.1.2 → 1.2.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "speculos-toolkit",
-  "version": "1.1.2",
+  "version": "1.2.1",
   "description": "The Speculos toolkit for coding agents \u2014 deploy any frontend/backend to a live URL and build against your linked data connectors (BigQuery, Postgres, Snowflake, Salesforce, \u2026). Built for Claude Code, Codex, Cursor, and friends.",
   "bin": {
     "speculos-toolkit": "bin/speculos-toolkit.js"

package/src/client.js

@@ -1,8 +1,10 @@
-// HTTP client to the Speculos orchestrator (management API). Holds no platform
-// secrets. The orchestrator runs self-hosted behind the Cloudflare forwarding
-// deploy-orch-38hd4.speculos.ai; it drives Daytona backends and pushes frontends
-// to the EC2 host that serves them at user-deployed.speculos.ai.
-const DEFAULT_API = process.env.SPECULOS_API || "https://deploy-orch-38hd4.speculos.ai";
+// HTTP client to the Speculos platform gateway (management API). Holds no
+// platform secrets. The gateway proxies these calls to the deploy orchestrator
+// on the same box and files every deploy in the console's shared history, so a
+// CLI deploy and a console publish sit in one list under one identity. The
+// orchestrator's own hostname (deploy-orch-38hd4.speculos.ai) still answers and
+// can be selected with --api; deployed apps keep calling the broker there.
+const DEFAULT_API = process.env.SPECULOS_API || "https://unified-api.speculos.ai/toolkit";
 
 function base(opts) { return (opts.api || DEFAULT_API).replace(/\/$/, ""); }
 
@@ -14,8 +16,8 @@ async function post(url, body, token) {
   if (!res.ok) { const e = new Error(data.error || `HTTP ${res.status}`); e.code = data.code; e.status = res.status; throw e; }
   return data;
 }
-async function get(url, token) {
-  const headers = {};
+async function get(url, token, extra) {
+  const headers = Object.assign({}, extra || {});
   if (token) headers["Authorization"] = "Bearer " + token;
   const res = await fetch(url, { headers });
   const data = await res.json().catch(() => ({}));
@@ -36,14 +38,18 @@ async function whoami(token, opts = {}) { return get(base(opts) + "/api/account/
 async function linkMachine(token, payload, opts = {}) { return post(base(opts) + "/api/account/link", payload, token); }
 async function logout(token, opts = {}) { return post(base(opts) + "/api/account/logout", {}, token); }
 // poll a backend job (owner-authenticated)
+// The machine credentials travel as headers, not a query string: a query
+// string is written to every access log between here and the orchestrator.
 async function backendStatus(jobId, creds = {}, opts = {}) {
-  const qs = new URLSearchParams({ userId: creds.userId || "", userKey: creds.userKey || "" });
-  return get(base(opts) + "/api/backend/" + encodeURIComponent(jobId) + "?" + qs.toString());
+  return get(base(opts) + "/api/backend/" + encodeURIComponent(jobId), null,
+    { "x-speculos-user-id": creds.userId || "", "x-speculos-user-key": creds.userKey || "" });
 }
-// upload built/static frontend
-async function putFrontend(payload, opts = {}) { return post(base(opts) + "/api/frontend", payload); }
+// upload built/static frontend. The account token rides along so the gateway
+// can file the deploy under the person, not the machine; the orchestrator
+// itself authorizes on the machine credentials in the body as before.
+async function putFrontend(payload, opts = {}) { return post(base(opts) + "/api/frontend", payload, opts.token); }
 // remove a deployment
-async function teardown(payload, opts = {}) { return post(base(opts) + "/api/teardown", payload); }
+async function teardown(payload, opts = {}) { return post(base(opts) + "/api/teardown", payload, opts.token); }
 // ---- connectors (data sources linked in the dashboard) ----
 async function connectorsList(token, opts = {}) {
   return get(base(opts) + "/api/connectors" + (opts.noTools ? "?tools=0" : ""), token);

package/src/index.js

@@ -129,7 +129,7 @@ OPTIONS
   --args <json>      connectors exec: tool arguments as inline JSON
   --args-file <f>    connectors exec: tool arguments from a JSON file (preferred
                      in agents — inline JSON with $ ( ) etc. may need approval)
-  --api <url>        orchestrator base url (default https://deploy-orch-38hd4.speculos.ai)
+  --api <url>        platform API base (default https://unified-api.speculos.ai/toolkit)
   --timeout <sec>    max seconds to wait for the backend (default 600)
   --json             machine-readable only (auto-on when non-TTY/CI)
 
@@ -335,6 +335,7 @@ async function cmdTeardown(root, opts) {
   if (!slug) { emit({ ok: false, error: "--slug required (or run from the project dir with a .speculos.json)" }); return 2; }
   if (!identity || !identity.userId) { emit({ ok: false, error: "no identity found (~/.speculos/identity.json) — nothing to tear down from this machine" }); return 1; }
   try {
+    if (identity.accountToken) opts.token = identity.accountToken;
     const r = await client.teardown({ userId: identity.userId, userKey: identity.userKey, slug }, opts);
     if (saved && saved.slug === slug) creds.remove(root);
     emit({ ok: true, ...r });