speculos-toolkit 1.2.0 → 1.2.2

package/README.md

@@ -73,12 +73,22 @@ speculos-toolkit [deploy]              detect, pack, deploy ./
 speculos-toolkit detect                show what would deploy (no upload)
 speculos-toolkit status <jobId>        poll a deployment
 speculos-toolkit teardown --slug <s>   remove a deployment
+speculos-toolkit login [--token …]     link this machine (browser approval at
+                                       https://unified.speculos.ai/link)
+speculos-toolkit logout                unlink it (revokes this device's token)
+speculos-toolkit connectors [list|exec]  your linked data sources, and one tool call
+speculos-toolkit install-skill         install the Claude Code skill
 
 --frontend <dir>   --backend <dir>   --slug <name>
---runtime node|python   --start "<cmd>"   --build   --output <dir>
+--runtime node|python|bun   --start "<cmd>"   --build   --static   --output <dir>
+--private | --org | --public
 --env KEY=VAL   --env-file <file>   --api <url>   --timeout <sec>   --json
 ```
 
+`--api` defaults to `https://unified-api.speculos.ai/toolkit` (the platform gateway,
+which proxies to the deploy orchestrator and records the deploy in the console's
+history); `SPECULOS_API` overrides it.
+
 Docs: https://unified.speculos.ai · Source: https://github.com/speculosai/unified_platform
 
 MIT

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "speculos-toolkit",
-  "version": "1.2.0",
+  "version": "1.2.2",
   "description": "The Speculos toolkit for coding agents \u2014 deploy any frontend/backend to a live URL and build against your linked data connectors (BigQuery, Postgres, Snowflake, Salesforce, \u2026). Built for Claude Code, Codex, Cursor, and friends.",
   "bin": {
     "speculos-toolkit": "bin/speculos-toolkit.js"

package/skill/SKILL.md

@@ -222,6 +222,11 @@ export async function connector(alias, tool, args) {
 }
 ```
 
+(The `x-speculos-gate` line is belt-and-braces: the deployed page also loads an
+injected `speculos-env.js` that patches `fetch`/`XMLHttpRequest` to add that header
+on every call to the backend or broker origin, so an app written WITHOUT this helper
+still works when it is private. Keeping it costs nothing and makes the flow explicit.)
+
 Rules (and state to the user):
 - **Read-only only.** The broker rejects any non-read tool on this path (`WRITE_BLOCKED`).
   Use `LIST_`/`GET_`/`SEARCH_`/`QUERY` tools; `POSTGRES_QUERY` runs in a read-only transaction.

package/src/client.js

@@ -16,8 +16,8 @@ async function post(url, body, token) {
   if (!res.ok) { const e = new Error(data.error || `HTTP ${res.status}`); e.code = data.code; e.status = res.status; throw e; }
   return data;
 }
-async function get(url, token) {
-  const headers = {};
+async function get(url, token, extra) {
+  const headers = Object.assign({}, extra || {});
   if (token) headers["Authorization"] = "Bearer " + token;
   const res = await fetch(url, { headers });
   const data = await res.json().catch(() => ({}));
@@ -38,14 +38,18 @@ async function whoami(token, opts = {}) { return get(base(opts) + "/api/account/
 async function linkMachine(token, payload, opts = {}) { return post(base(opts) + "/api/account/link", payload, token); }
 async function logout(token, opts = {}) { return post(base(opts) + "/api/account/logout", {}, token); }
 // poll a backend job (owner-authenticated)
+// The machine credentials travel as headers, not a query string: a query
+// string is written to every access log between here and the orchestrator.
 async function backendStatus(jobId, creds = {}, opts = {}) {
-  const qs = new URLSearchParams({ userId: creds.userId || "", userKey: creds.userKey || "" });
-  return get(base(opts) + "/api/backend/" + encodeURIComponent(jobId) + "?" + qs.toString());
+  return get(base(opts) + "/api/backend/" + encodeURIComponent(jobId), null,
+    { "x-speculos-user-id": creds.userId || "", "x-speculos-user-key": creds.userKey || "" });
 }
-// upload built/static frontend
-async function putFrontend(payload, opts = {}) { return post(base(opts) + "/api/frontend", payload); }
+// upload built/static frontend. The account token rides along so the gateway
+// can file the deploy under the person, not the machine; the orchestrator
+// itself authorizes on the machine credentials in the body as before.
+async function putFrontend(payload, opts = {}) { return post(base(opts) + "/api/frontend", payload, opts.token); }
 // remove a deployment
-async function teardown(payload, opts = {}) { return post(base(opts) + "/api/teardown", payload); }
+async function teardown(payload, opts = {}) { return post(base(opts) + "/api/teardown", payload, opts.token); }
 // ---- connectors (data sources linked in the dashboard) ----
 async function connectorsList(token, opts = {}) {
   return get(base(opts) + "/api/connectors" + (opts.noTools ? "?tools=0" : ""), token);

package/src/index.js

@@ -107,7 +107,8 @@ Without an account a detected backend is skipped (frontend still ships free).
 
 OPTIONS
   --frontend <dir>   frontend dir (auto-detected: frontend/web/client/… or ./ if index.html)
-  --backend <dir>    backend dir  (auto-detected: backend/api/server/…) — needs --override
+  --backend <dir>    backend dir  (auto-detected: backend/api/server/…) — needs a linked
+                     account (one backend app is included) or --override
   --slug <slug>      deployment slug (default: <folder>-<hash>)
   --runtime <r>      backend runtime: node | python | bun (auto-detected)
   --start <cmd>      backend start command (auto-detected; must bind 0.0.0.0:$PORT)
@@ -130,7 +131,7 @@ OPTIONS
   --args-file <f>    connectors exec: tool arguments from a JSON file (preferred
                      in agents — inline JSON with $ ( ) etc. may need approval)
   --api <url>        platform API base (default https://unified-api.speculos.ai/toolkit)
-  --timeout <sec>    max seconds to wait for the backend (default 600)
+  --timeout <sec>    max seconds to wait for the backend (default 960)
   --json             machine-readable only (auto-on when non-TTY/CI)
 
 Identity: the first deploy mints a machine-global { userId, userKey } saved to
@@ -335,6 +336,7 @@ async function cmdTeardown(root, opts) {
   if (!slug) { emit({ ok: false, error: "--slug required (or run from the project dir with a .speculos.json)" }); return 2; }
   if (!identity || !identity.userId) { emit({ ok: false, error: "no identity found (~/.speculos/identity.json) — nothing to tear down from this machine" }); return 1; }
   try {
+    if (identity.accountToken) opts.token = identity.accountToken;
     const r = await client.teardown({ userId: identity.userId, userKey: identity.userKey, slug }, opts);
     if (saved && saved.slug === slug) creds.remove(root);
     emit({ ok: true, ...r });
@@ -470,9 +472,10 @@ async function cmdConnectors(opts) {
     if (!opts.json) {
       if (!conns.length) log(opts, "no data sources linked — link one at https://unified.speculos.ai/?tab=deploys");
       for (const c of conns) {
-        // Say which product a source came from: the deploy plane and the
-        // Cloud console hold separate connections, often to the same SaaS,
-        // and running a tool against the wrong one is silent and wrong.
+        // Mark the org-wide sources: a person in an org sees those plus their
+        // own, and which one a tool runs against matters. (Console and toolkit
+        // now share ONE Composio workspace, so there is no "which product"
+        // left to disambiguate — a source linked in the console is this source.)
         const scope = c.orgWide ? " · org" : "";
         log(opts, `  ${c.alias}  (${c.name}${c.accountIdentifier ? " · " + c.accountIdentifier : ""}${scope}) — ${(c.tools || []).length} tools`);
       }