speculos-toolkit 1.2.1 → 1.2.2

package/README.md

@@ -73,12 +73,22 @@ speculos-toolkit [deploy]              detect, pack, deploy ./
 speculos-toolkit detect                show what would deploy (no upload)
 speculos-toolkit status <jobId>        poll a deployment
 speculos-toolkit teardown --slug <s>   remove a deployment
+speculos-toolkit login [--token …]     link this machine (browser approval at
+                                       https://unified.speculos.ai/link)
+speculos-toolkit logout                unlink it (revokes this device's token)
+speculos-toolkit connectors [list|exec]  your linked data sources, and one tool call
+speculos-toolkit install-skill         install the Claude Code skill
 
 --frontend <dir>   --backend <dir>   --slug <name>
---runtime node|python   --start "<cmd>"   --build   --output <dir>
+--runtime node|python|bun   --start "<cmd>"   --build   --static   --output <dir>
+--private | --org | --public
 --env KEY=VAL   --env-file <file>   --api <url>   --timeout <sec>   --json
 ```
 
+`--api` defaults to `https://unified-api.speculos.ai/toolkit` (the platform gateway,
+which proxies to the deploy orchestrator and records the deploy in the console's
+history); `SPECULOS_API` overrides it.
+
 Docs: https://unified.speculos.ai · Source: https://github.com/speculosai/unified_platform
 
 MIT

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "speculos-toolkit",
-  "version": "1.2.1",
+  "version": "1.2.2",
   "description": "The Speculos toolkit for coding agents \u2014 deploy any frontend/backend to a live URL and build against your linked data connectors (BigQuery, Postgres, Snowflake, Salesforce, \u2026). Built for Claude Code, Codex, Cursor, and friends.",
   "bin": {
     "speculos-toolkit": "bin/speculos-toolkit.js"

package/skill/SKILL.md

@@ -222,6 +222,11 @@ export async function connector(alias, tool, args) {
 }
 ```
 
+(The `x-speculos-gate` line is belt-and-braces: the deployed page also loads an
+injected `speculos-env.js` that patches `fetch`/`XMLHttpRequest` to add that header
+on every call to the backend or broker origin, so an app written WITHOUT this helper
+still works when it is private. Keeping it costs nothing and makes the flow explicit.)
+
 Rules (and state to the user):
 - **Read-only only.** The broker rejects any non-read tool on this path (`WRITE_BLOCKED`).
   Use `LIST_`/`GET_`/`SEARCH_`/`QUERY` tools; `POSTGRES_QUERY` runs in a read-only transaction.

package/src/index.js

@@ -107,7 +107,8 @@ Without an account a detected backend is skipped (frontend still ships free).
 
 OPTIONS
   --frontend <dir>   frontend dir (auto-detected: frontend/web/client/… or ./ if index.html)
-  --backend <dir>    backend dir  (auto-detected: backend/api/server/…) — needs --override
+  --backend <dir>    backend dir  (auto-detected: backend/api/server/…) — needs a linked
+                     account (one backend app is included) or --override
   --slug <slug>      deployment slug (default: <folder>-<hash>)
   --runtime <r>      backend runtime: node | python | bun (auto-detected)
   --start <cmd>      backend start command (auto-detected; must bind 0.0.0.0:$PORT)
@@ -130,7 +131,7 @@ OPTIONS
   --args-file <f>    connectors exec: tool arguments from a JSON file (preferred
                      in agents — inline JSON with $ ( ) etc. may need approval)
   --api <url>        platform API base (default https://unified-api.speculos.ai/toolkit)
-  --timeout <sec>    max seconds to wait for the backend (default 600)
+  --timeout <sec>    max seconds to wait for the backend (default 960)
   --json             machine-readable only (auto-on when non-TTY/CI)
 
 Identity: the first deploy mints a machine-global { userId, userKey } saved to
@@ -471,9 +472,10 @@ async function cmdConnectors(opts) {
     if (!opts.json) {
       if (!conns.length) log(opts, "no data sources linked — link one at https://unified.speculos.ai/?tab=deploys");
       for (const c of conns) {
-        // Say which product a source came from: the deploy plane and the
-        // Cloud console hold separate connections, often to the same SaaS,
-        // and running a tool against the wrong one is silent and wrong.
+        // Mark the org-wide sources: a person in an org sees those plus their
+        // own, and which one a tool runs against matters. (Console and toolkit
+        // now share ONE Composio workspace, so there is no "which product"
+        // left to disambiguate — a source linked in the console is this source.)
         const scope = c.orgWide ? " · org" : "";
         log(opts, `  ${c.alias}  (${c.name}${c.accountIdentifier ? " · " + c.accountIdentifier : ""}${scope}) — ${(c.tools || []).length} tools`);
       }