subto 8.0.3 → 8.0.5

package/dist/package/index.js

@@ -101,7 +101,10 @@ async function postScan(url, apiKey) {
   }
   const fetchFn = global.fetch || (function(){ try{ const u = require('undici'); if (u && typeof u.fetch === 'function') { global.fetch = u.fetch; return global.fetch; } } catch(e){} return null; })();
   if (typeof fetchFn !== 'function') throw new Error('Global fetch() is not available in this Node runtime. Install Node 18+ or run `npm install undici`.');
-  const res = await fetchFn(endpoint, { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${apiKey}`, 'User-Agent': `${CLIENT_META.name}/${CLIENT_META.version}` }, body: JSON.stringify(body) });
+
+  // Send both Authorization and x-api-key headers to maximize compatibility across deployments
+  const headers = { 'Content-Type': 'application/json', 'Authorization': `Bearer ${apiKey}`, 'x-api-key': String(apiKey), 'User-Agent': `${CLIENT_META.name}/${CLIENT_META.version}` };
+  const res = await fetchFn(endpoint, { method: 'POST', headers, body: JSON.stringify(body) });
   const text = await res.text();
   let data = null; try { data = text ? JSON.parse(text) : null; } catch (e) { data = text; }
   return { status: res.status, headers: res.headers, body: data };
@@ -212,8 +215,9 @@ async function run(argv) {
 
         let recheckedAfterTerminal = false;
         while (true) {
-          const statusUrl = new URL(`/api/v1/scan/${scanId}`, base).toString();
-          const r = await fetchFn(statusUrl, { headers: { 'Authorization': `Bearer ${cfg.apiKey}`, 'Accept': 'application/json' } });
+            const statusUrl = new URL(`/api/v1/scan/${scanId}`, base).toString();
+            // Include both Authorization and x-api-key headers so the server accepts either format
+            const r = await fetchWithKey(statusUrl, { headers: { 'Accept': 'application/json' } }, cfg.apiKey, DEBUG);
 
           if (r.status === 429) {
             let retrySeconds = null;

package/index.js

@@ -11,7 +11,7 @@ const chalk = (_chalk && _chalk.default) ? _chalk.default : _chalk;
 const CONFIG_DIR = path.join(os.homedir(), '.subto');
 const CONFIG_PATH = path.join(CONFIG_DIR, 'config.json');
 const DEFAULT_API_BASE = 'https://subto.one/api/v1';
-const CLIENT_META = { name: 'subto-cli', version: '8.0.3' };
+const CLIENT_META = { name: 'subto-cli', version: '8.0.5' };
 const cp = require('child_process');
 
 // Normalize SUBTO API base so callers can set either
@@ -138,9 +138,9 @@ async function storeOpenRouterKeyInteractive(keyArg, modelArg) {
     // Best-effort validation
     let validated = false;
     const fetchFn = global.fetch;
-    if (typeof fetchFn === 'function') {
-      try {
-        const res = await fetchFn('https://openrouter.ai/api/v1/models', { headers: { 'Authorization': `Bearer ${key}` } });
+      if (typeof fetchFn === 'function') { 
+        try { 
+          const res = await fetchWithKey('https://openrouter.ai/api/v1/models', { headers: { } }, key); 
         if (res && res.ok) {
           const jd = await res.json().catch(()=>null);
           const modelsList = jd && (jd.models || jd.data || jd) ;
@@ -199,30 +199,83 @@ async function promptHidden(prompt) {
 function validateUrl(input) {
   try { const u = new URL(input); if (u.protocol !== 'http:' && u.protocol !== 'https:') return false; return true; } catch (err) { return false; }
 }
+async function _maskHeaders(obj){
+  const out = {};
+  try{
+    for (const k of Object.keys(obj||{})){
+      let v = obj[k];
+      if (v === undefined || v === null) v = '';
+      let sv = String(v);
+      if (/authorization/i.test(k) || /api-?key/i.test(k)){
+        if (sv.length > 12) sv = sv.slice(0,6) + '...' + sv.slice(-4); else sv = '***';
+      }
+      out[k] = sv;
+    }
+  }catch(e){}
+  return out;
+}
 
-async function postScan(url, apiKey) {
+async function postScan(url, apiKey, debug=false) {
   // Use normalized API base
   const endpoint = new URL('scan', SUBTO_API_BASE_SLASH).toString();
   const body = { url, source: 'cli', client: CLIENT_META };
-  const fetchFn = global.fetch;
-  if (typeof fetchFn !== 'function') throw new Error('Global fetch() is not available in this Node runtime. Use Node 18+');
+    const fetchFn = global.fetch; 
+      if (typeof fetchFn !== 'function') throw new Error('Global fetch() is not available in this Node runtime. Use Node 18+'); 
   // Validate header-safety to avoid undici/node fetch ByteString conversion errors
   if (!isByteStringSafe(String(apiKey || ''))) {
     throw new Error('API key contains unsupported characters (non-Latin-1). Re-run `subto login` and paste a plain ASCII API key.');
   }
-  const res = await fetchFn(endpoint, { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${apiKey}`, 'User-Agent': `${CLIENT_META.name}/${CLIENT_META.version}` }, body: JSON.stringify(body) });
+
+  // Send both Authorization and x-api-key headers to maximize compatibility across deployments
+  const headers = { 'Content-Type': 'application/json', 'Authorization': `Bearer ${apiKey}`, 'x-api-key': String(apiKey), 'User-Agent': `${CLIENT_META.name}/${CLIENT_META.version}` };
+  if (debug) {
+    try { console.error(chalk.dim('Request headers:'), JSON.stringify(await _maskHeaders(headers))); } catch(e){}
+  }
+  const res = await fetchFn(endpoint, { method: 'POST', headers, body: JSON.stringify(body) });
   const text = await res.text();
   let data = null; try { data = text ? JSON.parse(text) : null; } catch (e) { data = text; }
+  if (debug) {
+    try {
+      const hdrs = {};
+      if (res && res.headers && typeof res.headers.forEach === 'function') res.headers.forEach((v,k)=>{ hdrs[k]=v; });
+      console.error(chalk.dim('Response status:'), res.status);
+      console.error(chalk.dim('Response headers:'), JSON.stringify(await _maskHeaders(hdrs)));
+      console.error(chalk.dim('Response body:'), String(text).slice(0,4096));
+    } catch(e){}
+  }
   return { status: res.status, headers: res.headers, body: data };
 }
 
+// Helper to fetch with both Authorization and x-api-key headers and optional debug logging
+async function fetchWithKey(url, opts, apiKey, debug=false){
+    const fetchFn = global.fetch; 
+      if (typeof fetchFn !== 'function') throw new Error('Global fetch() is not available in this Node runtime. Use Node 18+'); 
+  const baseHeaders = (opts && opts.headers) ? Object.assign({}, opts.headers) : {};
+  const headers = Object.assign({}, baseHeaders, { 'Authorization': `Bearer ${apiKey}`, 'x-api-key': String(apiKey) });
+  if (debug) {
+    try { console.error(chalk.dim('Request headers:'), JSON.stringify(await _maskHeaders(headers))); } catch(e){}
+  }
+  const r = await fetchFn(url, Object.assign({}, opts || {}, { headers }));
+  if (debug) {
+    try {
+      const txt = await r.text();
+      const hdrs = {}; if (r && r.headers && typeof r.headers.forEach === 'function') r.headers.forEach((v,k)=>hdrs[k]=v);
+      console.error(chalk.dim('Response status:'), r.status);
+      console.error(chalk.dim('Response headers:'), JSON.stringify(await _maskHeaders(hdrs)));
+      console.error(chalk.dim('Response body:'), String(txt).slice(0,4096));
+      // put body back so callers expecting .json() will not fail
+      r._cached_text = txt;
+    } catch(e){}
+  }
+  return r;
+}
+
 function extractScanIdFromHtml(html) {
   if (!html || typeof html !== 'string') return null;
   // common patterns: /scan/ID or scanId="..." or data-scan-id="..."
   const m1 = html.match(/\/scan\/(?:id\/)?([a-zA-Z0-9_-]{8,})/i);
   if (m1 && m1[1]) return m1[1];
   const m2 = html.match(/scanId["'\s:=]+([a-zA-Z0-9_-]{8,})/i);
-  if (m2 && m2[1]) return m2[1];
   const m3 = html.match(/data-scan-id["'\s=:\>]+([a-zA-Z0-9_-]{8,})/i);
   if (m3 && m3[1]) return m3[1];
   return null;
@@ -375,9 +428,7 @@ async function callOpenAI(prompt){
   } catch (e) { /* ignore config read errors */ }
   const fetchFn = global.fetch;
   if(typeof fetchFn !== 'function') throw new Error('Global fetch() is not available in this Node runtime. Use Node 18+');
-
-  // If OpenAI key present, call OpenAI API; otherwise, if OpenRouter key present, call OpenRouter endpoint.
-  if (openaiKey) {
+  
     const model = process.env.AI_MODEL || process.env.OPENAI_MODEL || 'gpt-4o-mini';
     const body = {
       model,
@@ -519,8 +570,9 @@ async function startChatREPL(scanData){
 
 async function run(argv) {
   const program = new Command();
-  program.name('subto').description('Subto CLI — wrapper around Subto.One API').version(CLIENT_META.version || '8.0.3');
+  program.name('subto').description('Subto CLI — wrapper around Subto.One API').version(CLIENT_META.version || '8.0.5');
   program.option('-v, --verbose', 'Show verbose HTTP logs');
+  program.option('--debug', 'Show debug HTTP headers and responses');
   program.option('--chat', 'Start local AI assistant (no command required)');
   program.option('--no-auto-skip', 'Disable automatic skipping of external APIs when scans appear stuck');
   program.option('--skip-prompt-ms <n>', 'Milliseconds before prompting to skip external APIs (default 15000)');
@@ -555,7 +607,8 @@ async function run(argv) {
       if (!validateUrl(url)) { console.error(chalk.red('Invalid URL. Provide a full URL including http:// or https://')); process.exit(1); }
       const cfg = await readConfig(); if (!cfg || !cfg.apiKey) { console.error(chalk.red('Missing API key. Run:'), chalk.cyan('subto login')); process.exit(1); }
       try {
-        const resp = await postScan(url, cfg.apiKey);
+        const DEBUG = (program && typeof program.opts === 'function') ? Boolean(program.opts().debug) : false;
+        const resp = await postScan(url, cfg.apiKey, DEBUG);
         if (resp.status === 429) {
           let retrySeconds = null;
           if (resp.body && typeof resp.body === 'object' && resp.body.retry_after) retrySeconds = resp.body.retry_after;
@@ -585,7 +638,7 @@ async function run(argv) {
           if (attemptId && typeof fetchFn === 'function') {
             try {
               const statusUrl = new URL(`scan/${attemptId}`, SUBTO_API_BASE_SLASH).toString();
-              const r2 = await fetchFn(statusUrl, { headers: { 'Authorization': `Bearer ${cfg.apiKey}`, 'Accept': 'application/json' } });
+              const r2 = await fetchWithKey(statusUrl, { headers: { 'Accept': 'application/json' } }, cfg.apiKey, DEBUG);
               if (r2 && r2.ok) {
                 try { resp.body = await r2.json(); } catch (e) { /* leave as-is */ }
               } else {
@@ -837,7 +890,7 @@ async function run(argv) {
           startSpinner();
           while (true) {
               const statusUrl = new URL(`scan/${scanId}`, SUBTO_API_BASE_SLASH).toString();
-            const r = await fetchFn(statusUrl, { headers: { 'Authorization': `Bearer ${cfg.apiKey}`, 'Accept': 'application/json' } });
+            const r = await fetchWithKey(statusUrl, { headers: { 'Accept': 'application/json' } }, cfg.apiKey, DEBUG);
 
             if (r.status === 429) {
               let retrySeconds = null;
@@ -885,7 +938,7 @@ async function run(argv) {
                         console.log(chalk.yellow('\nNo progress detected on external APIs — requesting server to skip external API calls (auto).'));
                         const skipUrl = new URL(`scan/${scanId}/skip-apis`, SUBTO_API_BASE_SLASH).toString();
                         markSkipRequested(lastServerPercent);
-                        await fetchFn(skipUrl, { method: 'POST', headers: { 'Authorization': `Bearer ${cfg.apiKey}`, 'Content-Type': 'application/json' }, body: '{}' });
+                        await fetchWithKey(skipUrl, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: '{}' }, cfg.apiKey, DEBUG);
                         console.log(chalk.yellow('Requested server to skip external API calls for this scan.'));
                       } else {
                         console.log(chalk.yellow('\nNo progress detected on external APIs. Automatic skip is disabled.'));
@@ -935,7 +988,7 @@ async function run(argv) {
                             console.log(chalk.yellow('\nSkip requested by user.')); 
                             const skipUrl = new URL(`scan/${scanId}/skip-apis`, SUBTO_API_BASE_SLASH).toString();
                             markSkipRequested(serverPct);
-                            await fetchFn(skipUrl, { method: 'POST', headers: { 'Authorization': `Bearer ${cfg.apiKey}`, 'Content-Type': 'application/json' }, body: '{}' });
+                            await fetchWithKey(skipUrl, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: '{}' }, cfg.apiKey, DEBUG);
                             console.log(chalk.yellow('Requested server to skip external API calls for this scan.'));
                           } catch (e) {
                             console.error(chalk.red('Failed to request skip:'), e && e.message ? e.message : e);
@@ -975,7 +1028,7 @@ async function run(argv) {
                                 console.log(chalk.yellow('\nAuto-skip timeout reached — requesting server to skip external API calls.'));
                                 const skipUrl = new URL(`scan/${scanId}/skip-apis`, SUBTO_API_BASE_SLASH).toString();
                                 markSkipRequested(lastServerPercent);
-                                await fetchFn(skipUrl, { method: 'POST', headers: { 'Authorization': `Bearer ${cfg.apiKey}`, 'Content-Type': 'application/json' }, body: '{}' });
+                                await fetchWithKey(skipUrl, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: '{}' }, cfg.apiKey, DEBUG);
                                 console.log(chalk.yellow('Requested server to skip external API calls for this scan.'));
                               } else {
                                 console.log(chalk.yellow('\nAuto-skip timeout reached but automatic skip is disabled. Continuing to wait.'));
@@ -1017,7 +1070,7 @@ async function run(argv) {
                       console.log(chalk.yellow('\nScan stuck at 50% for too long — auto-requesting skip of external APIs.'));
                       const skipUrl = new URL(`scan/${scanId}/skip-apis`, SUBTO_API_BASE_SLASH).toString();
                       markSkipRequested(lastServerPercent);
-                      await fetchFn(skipUrl, { method: 'POST', headers: { 'Authorization': `Bearer ${cfg.apiKey}`, 'Content-Type': 'application/json' }, body: '{}' });
+                      await fetchWithKey(skipUrl, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: '{}' }, cfg.apiKey, DEBUG);
                       console.log(chalk.yellow('Requested server to skip external API calls for this scan.'));
                     } else {
                       console.log(chalk.yellow('\nScan stuck at 50% for too long but automatic skip is disabled.'));
@@ -1042,7 +1095,7 @@ async function run(argv) {
                 // give the server a moment to populate results
                 await sleep(2000);
                 // continue to refresh once more
-                try { const r2 = await fetchFn(statusUrl, { headers: { 'Authorization': `Bearer ${cfg.apiKey}`, 'Accept': 'application/json' } }); data = await r2.json(); } catch (e) {}
+                try { const r2 = await fetchWithKey(statusUrl, { headers: { 'Accept': 'application/json' } }, cfg.apiKey, DEBUG); data = await r2.json(); } catch (e) {}
                 // final render
                 renderLine(data);
               }
@@ -1097,7 +1150,7 @@ async function run(argv) {
         const endpoint = new URL('/api/v1/upload', base).toString();
         const fetchFn = global.fetch; if (typeof fetchFn !== 'function') throw new Error('Global fetch() is not available in this Node runtime. Use Node 18+');
         const body = { files: samples, meta: { collected: collected.length, totalBytes } };
-        const r = await fetchFn(endpoint, { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${cfg.apiKey}` }, body: JSON.stringify(body) });
+        const r = await fetchWithKey(endpoint, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) }, cfg.apiKey, DEBUG);
         if (!r.ok) {
           const txt = await r.text().catch(()=>null);
           console.error(chalk.red('Upload failed:'), r.status, txt || r.statusText);
@@ -1115,7 +1168,7 @@ async function run(argv) {
           const statusUrl = new URL(`scan/${j.scanId}`, SUBTO_API_BASE_SLASH).toString();
           const sleep = ms => new Promise(r=>setTimeout(r,ms));
           while (true) {
-            const s = await fetchFn(statusUrl, { headers: { 'Authorization': `Bearer ${cfg.apiKey}`, 'Accept': 'application/json' } });
+            const s = await fetchWithKey(statusUrl, { headers: { 'Accept': 'application/json' } }, cfg.apiKey, DEBUG);
             if (!s.ok) { console.error(chalk.red('Failed to fetch scan status:', s.status)); break; }
             const data = await s.json(); if (data.status && ['completed','done','finished','success'].includes(String(data.status).toLowerCase())) { console.log(chalk.green('Scan complete.')); await printFullReport(data); break; }
             console.log(chalk.dim('Scan status:'), data.status || 'queued', '— polling again in 4s'); await sleep(4000);
@@ -1147,7 +1200,7 @@ async function run(argv) {
           const fetchFn = global.fetch;
           if (typeof fetchFn !== 'function') throw new Error('Global fetch() is not available in this Node runtime. Use Node 18+');
           const statusUrl = new URL(`scan/${scanId}`, SUBTO_API_BASE_SLASH).toString();
-          const r = await fetchFn(statusUrl, { headers: { 'Authorization': `Bearer ${cfg.apiKey}`, 'Accept': 'application/json' } });
+          const r = await fetchWithKey(statusUrl, { headers: { 'Accept': 'application/json' } }, cfg.apiKey, DEBUG);
           if (!r.ok) { throw new Error(`Failed to fetch scan ${scanId}: ${r.status}`); }
           scanData = await r.json();
         }
@@ -1364,7 +1417,7 @@ async function run(argv) {
         const base = SUBTO_HOST_BASE; const fetchFn = global.fetch;
         if (typeof fetchFn !== 'function') throw new Error('Global fetch() is not available in this Node runtime. Use Node 18+');
           const statusUrl = new URL(`scan/${answer}`, SUBTO_API_BASE_SLASH).toString();
-        const r = await fetchFn(statusUrl, { headers: { 'Authorization': `Bearer ${cfg.apiKey}`, 'Accept': 'application/json' } });
+          const r = await fetchWithKey(statusUrl, { headers: { 'Accept': 'application/json' } }, cfg.apiKey, DEBUG);
         if (!r.ok) throw new Error(`Failed to fetch scan ${answer}: ${r.status}`);
         scanData = await r.json();
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "subto",
-  "version": "8.0.3",
+  "version": "8.0.5",
   "description": "Subto CLI — thin wrapper around the Subto.One API",
   "bin": {
     "subto": "bin/subto.js"