speculos-toolkit 1.2.0 → 1.2.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "speculos-toolkit",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "The Speculos toolkit for coding agents \u2014 deploy any frontend/backend to a live URL and build against your linked data connectors (BigQuery, Postgres, Snowflake, Salesforce, \u2026). Built for Claude Code, Codex, Cursor, and friends.",
   "bin": {
     "speculos-toolkit": "bin/speculos-toolkit.js"

package/src/client.js

@@ -16,8 +16,8 @@ async function post(url, body, token) {
   if (!res.ok) { const e = new Error(data.error || `HTTP ${res.status}`); e.code = data.code; e.status = res.status; throw e; }
   return data;
 }
-async function get(url, token) {
-  const headers = {};
+async function get(url, token, extra) {
+  const headers = Object.assign({}, extra || {});
   if (token) headers["Authorization"] = "Bearer " + token;
   const res = await fetch(url, { headers });
   const data = await res.json().catch(() => ({}));
@@ -38,14 +38,18 @@ async function whoami(token, opts = {}) { return get(base(opts) + "/api/account/
 async function linkMachine(token, payload, opts = {}) { return post(base(opts) + "/api/account/link", payload, token); }
 async function logout(token, opts = {}) { return post(base(opts) + "/api/account/logout", {}, token); }
 // poll a backend job (owner-authenticated)
+// The machine credentials travel as headers, not a query string: a query
+// string is written to every access log between here and the orchestrator.
 async function backendStatus(jobId, creds = {}, opts = {}) {
-  const qs = new URLSearchParams({ userId: creds.userId || "", userKey: creds.userKey || "" });
-  return get(base(opts) + "/api/backend/" + encodeURIComponent(jobId) + "?" + qs.toString());
+  return get(base(opts) + "/api/backend/" + encodeURIComponent(jobId), null,
+    { "x-speculos-user-id": creds.userId || "", "x-speculos-user-key": creds.userKey || "" });
 }
-// upload built/static frontend
-async function putFrontend(payload, opts = {}) { return post(base(opts) + "/api/frontend", payload); }
+// upload built/static frontend. The account token rides along so the gateway
+// can file the deploy under the person, not the machine; the orchestrator
+// itself authorizes on the machine credentials in the body as before.
+async function putFrontend(payload, opts = {}) { return post(base(opts) + "/api/frontend", payload, opts.token); }
 // remove a deployment
-async function teardown(payload, opts = {}) { return post(base(opts) + "/api/teardown", payload); }
+async function teardown(payload, opts = {}) { return post(base(opts) + "/api/teardown", payload, opts.token); }
 // ---- connectors (data sources linked in the dashboard) ----
 async function connectorsList(token, opts = {}) {
   return get(base(opts) + "/api/connectors" + (opts.noTools ? "?tools=0" : ""), token);

package/src/index.js

@@ -335,6 +335,7 @@ async function cmdTeardown(root, opts) {
   if (!slug) { emit({ ok: false, error: "--slug required (or run from the project dir with a .speculos.json)" }); return 2; }
   if (!identity || !identity.userId) { emit({ ok: false, error: "no identity found (~/.speculos/identity.json) — nothing to tear down from this machine" }); return 1; }
   try {
+    if (identity.accountToken) opts.token = identity.accountToken;
     const r = await client.teardown({ userId: identity.userId, userKey: identity.userKey, slug }, opts);
     if (saved && saved.slug === slug) creds.remove(root);
     emit({ ok: true, ...r });