subto 8.0.6 → 9.0.1

package/dist/package/index.js

@@ -11,7 +11,7 @@ const chalk = (_chalk && _chalk.default) ? _chalk.default : _chalk;
 const CONFIG_DIR = path.join(os.homedir(), '.subto');
 const CONFIG_PATH = path.join(CONFIG_DIR, 'config.json');
 const DEFAULT_API_BASE = 'https://subto.one';
-const CLIENT_META = { name: 'subto-cli', version: '8.0.3' };
+const CLIENT_META = { name: 'subto-cli', version: '9.0.1' };
 
 function configFilePath() { return CONFIG_PATH; }
 
@@ -122,9 +122,52 @@ function printScanSummary(obj) {
   if (keys.length) console.log(chalk.dim('  Additional keys: ' + keys.join(', ')));
 }
 
+async function fetchWithKey(url, opts, apiKey) {
+  const fetchFn = global.fetch || (function(){ try{ const u = require('undici'); if (u && typeof u.fetch === 'function') { global.fetch = u.fetch; return global.fetch; } } catch(e){} return null; })();
+  if (typeof fetchFn !== 'function') throw new Error('Global fetch() is not available in this Node runtime. Install Node 18+ or run `npm install undici`.');
+  const baseHeaders = (opts && opts.headers) ? Object.assign({}, opts.headers) : {};
+  const headers = Object.assign({}, baseHeaders, { 'Authorization': `Bearer ${apiKey}`, 'x-api-key': String(apiKey) });
+  return fetchFn(url, Object.assign({}, opts || {}, { headers }));
+}
+
+async function fetchJsonWithKey(url, opts, apiKey) {
+  const res = await fetchWithKey(url, opts, apiKey);
+  const text = await res.text();
+  let data = null;
+  try { data = text ? JSON.parse(text) : null; } catch (e) { data = text; }
+  return { status: res.status, headers: res.headers, body: data };
+}
+
+function formatCount(value) {
+  const numeric = Number(value);
+  if (!Number.isFinite(numeric)) return '0';
+  return numeric.toLocaleString('en-US');
+}
+
+function formatMemberSince(value) {
+  if (!value) return 'Unknown';
+  const parsed = new Date(value);
+  if (Number.isNaN(parsed.getTime())) return String(value);
+  return parsed.toLocaleDateString('en-US', { month: 'short', year: 'numeric' });
+}
+
+function printAccountSummary(payload) {
+  const account = payload && payload.account ? payload.account : {};
+  const stats = account && account.stats ? account.stats : {};
+  const title = account.name || payload.accountId || payload.userId || 'Account';
+
+  console.log(chalk.bold('Account summary:'));
+  console.log(chalk.green('  Name:') + ' ' + title);
+  if (account.email) console.log(chalk.green('  Email:') + ' ' + account.email);
+  if (payload.accountId) console.log(chalk.green('  Account ID:') + ' ' + payload.accountId);
+  console.log(chalk.green('  API calls:') + ' ' + formatCount(stats.apiCalls));
+  console.log(chalk.green('  Scans:') + ' ' + formatCount(stats.scans));
+  console.log(chalk.green('  Member since:') + ' ' + formatMemberSince(account.createdAt));
+}
+
 async function run(argv) {
   const program = new Command();
-  program.name('subto').description('Subto CLI — wrapper around Subto.One API').version(CLIENT_META.version || '7.0.0');
+  program.name('subto').description('Subto CLI — wrapper around Subto.One API').version(CLIENT_META.version || '9.0.1');
 
   program.command('login').description('Store your API key in ~/.subto/config.json').action(async () => {
     try {
@@ -143,6 +186,45 @@ async function run(argv) {
     } catch (err) { if (err && err.message === 'Aborted') { console.log('\n' + chalk.yellow('Login aborted.')); process.exit(1); } throw err; }
   });
 
+  program
+    .command('account')
+    .description('Show the current account name, API calls, and scans')
+    .option('--json', 'Output raw JSON')
+    .action(async (opts) => {
+      const cfg = await readConfig();
+      if (!cfg || !cfg.apiKey) {
+        console.error(chalk.red('Missing API key. Run:'), chalk.cyan('subto login'));
+        process.exit(1);
+      }
+
+      try {
+        const endpoint = new URL('/api/v1/account/me', process.env.SUBTO_API_BASE_URL || DEFAULT_API_BASE).toString();
+        const resp = await fetchJsonWithKey(endpoint, { headers: { 'Accept': 'application/json' } }, cfg.apiKey);
+
+        if (resp.status === 401 || resp.status === 403) {
+          console.error(chalk.red('Authentication failed. Check your API key with `subto login`.'));
+          process.exit(1);
+        }
+        if (resp.status < 200 || resp.status >= 300) {
+          let msg = `Request failed with status ${resp.status}`;
+          if (resp.body && typeof resp.body === 'object' && resp.body.error) msg += ': ' + resp.body.error;
+          console.error(chalk.red(msg));
+          process.exit(1);
+        }
+
+        if (opts.json) {
+          console.log(JSON.stringify(resp.body, null, 2));
+          return;
+        }
+
+        printAccountSummary(resp.body);
+      } catch (err) {
+        const msg = err && err.message ? err.message : String(err);
+        console.error(chalk.red('Network error:'), msg);
+        process.exit(1);
+      }
+    });
+
   program
     .command('scan <url>')
     .description('Request a scan for <url> via the Subto API')

package/index.js

@@ -11,7 +11,7 @@ const chalk = (_chalk && _chalk.default) ? _chalk.default : _chalk;
 const CONFIG_DIR = path.join(os.homedir(), '.subto');
 const CONFIG_PATH = path.join(CONFIG_DIR, 'config.json');
 const DEFAULT_API_BASE = 'https://subto.one/api/v1';
-const CLIENT_META = { name: 'subto-cli', version: '8.0.6' };
+const CLIENT_META = { name: 'subto-cli', version: '9.0.1' };
 const cp = require('child_process');
 
 // Normalize SUBTO API base so callers can set either
@@ -217,7 +217,10 @@ async function _maskHeaders(obj){
 
 async function postScan(url, apiKey, debug=false) {
   // Use normalized API base
-  const endpoint = new URL('scan', SUBTO_API_BASE_SLASH).toString();
+  const endpointObj = new URL('scan', SUBTO_API_BASE_SLASH);
+  // API key is sent via headers only — never in query strings to prevent
+  // leakage via server logs, proxy logs, and Referer headers.
+  const endpoint = endpointObj.toString();
   const body = { url, source: 'cli', client: CLIENT_META };
     const fetchFn = global.fetch; 
       if (typeof fetchFn !== 'function') throw new Error('Global fetch() is not available in this Node runtime. Use Node 18+'); 
@@ -293,6 +296,41 @@ function printScanSummary(obj) {
   if (keys.length) console.log(chalk.dim('  Additional keys: ' + keys.join(', ')));
 }
 
+async function fetchJsonWithKey(url, opts, apiKey, debug=false) {
+  const res = await fetchWithKey(url, opts, apiKey, debug);
+  const text = typeof res._cached_text === 'string' ? res._cached_text : await res.text();
+  let data = null;
+  try { data = text ? JSON.parse(text) : null; } catch (e) { data = text; }
+  return { status: res.status, headers: res.headers, body: data };
+}
+
+function formatCount(value) {
+  const numeric = Number(value);
+  if (!Number.isFinite(numeric)) return '0';
+  return numeric.toLocaleString('en-US');
+}
+
+function formatMemberSince(value) {
+  if (!value) return 'Unknown';
+  const parsed = new Date(value);
+  if (Number.isNaN(parsed.getTime())) return String(value);
+  return parsed.toLocaleDateString('en-US', { month: 'short', year: 'numeric' });
+}
+
+function printAccountSummary(payload) {
+  const account = payload && payload.account ? payload.account : {};
+  const stats = account && account.stats ? account.stats : {};
+  const title = account.name || payload.accountId || payload.userId || 'Account';
+
+  console.log(chalk.bold('Account summary:'));
+  console.log(chalk.green('  Name:') + ' ' + title);
+  if (account.email) console.log(chalk.green('  Email:') + ' ' + account.email);
+  if (payload.accountId) console.log(chalk.green('  Account ID:') + ' ' + payload.accountId);
+  console.log(chalk.green('  API calls:') + ' ' + formatCount(stats.apiCalls));
+  console.log(chalk.green('  Scans:') + ' ' + formatCount(stats.scans));
+  console.log(chalk.green('  Member since:') + ' ' + formatMemberSince(account.createdAt));
+}
+
 async function printFullReport(data) {
   const scan = (data && data.results) ? data.results : data;
   if (!scan || typeof scan !== 'object') { console.log(JSON.stringify(data, null, 2)); return; }
@@ -398,12 +436,12 @@ async function printFullReport(data) {
 function copyToClipboard(text){
   try{
     if (process.platform === 'darwin'){
-      const p = cp.spawnSync('pbcopy');
-      p.stdin && p.stdin.end(String(text));
+      cp.spawnSync('pbcopy', { input: String(text) });
       return true;
     }
     if (process.platform === 'win32'){
-      const p = cp.spawnSync('clip'); p.stdin && p.stdin.end(String(text)); return true;
+      cp.spawnSync('clip', { input: String(text) });
+      return true;
     }
   }catch(e){}
   return false;
@@ -429,6 +467,8 @@ async function callOpenAI(prompt){
   const fetchFn = global.fetch;
   if(typeof fetchFn !== 'function') throw new Error('Global fetch() is not available in this Node runtime. Use Node 18+');
   
+  // Try OpenAI first if key is available
+  if (openaiKey) {
     const model = process.env.AI_MODEL || process.env.OPENAI_MODEL || 'gpt-4o-mini';
     const body = {
       model,
@@ -444,9 +484,11 @@ async function callOpenAI(prompt){
       // Avoid including response bodies in errors to prevent accidental leakage of sensitive data
       throw new Error(`OpenAI API error ${res.status}: ${res.statusText || 'request failed'}`);
     }
-    const j = await res.json();
+    let j;
+    try { j = await res.json(); } catch (_) { throw new Error('OpenAI returned non-JSON response'); }
     const msg = j && j.choices && j.choices[0] && (j.choices[0].message && j.choices[0].message.content || j.choices[0].text);
     return String(msg || '').trim();
+  }
 
   if (openrouterKey) {
     // Use OpenRouter chat completions endpoint
@@ -465,7 +507,8 @@ async function callOpenAI(prompt){
       // Avoid including response bodies in errors to prevent accidental leakage of sensitive data
       throw new Error(`OpenRouter API error ${res.status}: ${res.statusText || 'request failed'}`);
     }
-    const j = await res.json();
+    let j;
+    try { j = await res.json(); } catch (_) { throw new Error('OpenRouter returned non-JSON response'); }
     // OpenRouter responses mimic OpenAI shape (choices[0].message.content)
     const msg = j && j.choices && j.choices[0] && (j.choices[0].message && j.choices[0].message.content || j.choices[0].text);
     return String(msg || '').trim();
@@ -569,7 +612,7 @@ async function startChatREPL(scanData){
 
 async function run(argv) {
   const program = new Command();
-  program.name('subto').description('Subto CLI — wrapper around Subto.One API').version(CLIENT_META.version || '8.0.6');
+  program.name('subto').description('Subto CLI — wrapper around Subto.One API').version(CLIENT_META.version || '9.0.1');
   program.option('-v, --verbose', 'Show verbose HTTP logs');
   program.option('--debug', 'Show debug HTTP headers and responses');
   program.option('--chat', 'Start local AI assistant (no command required)');
@@ -595,6 +638,46 @@ async function run(argv) {
     } catch (err) { if (err && err.message === 'Aborted') { console.log('\n' + chalk.yellow('Login aborted.')); process.exit(1); } throw err; }
   });
 
+  program
+    .command('account')
+    .description('Show the current account name, API calls, and scans')
+    .option('--json', 'Output raw JSON')
+    .action(async (opts) => {
+      const cfg = await readConfig();
+      if (!cfg || !cfg.apiKey) {
+        console.error(chalk.red('Missing API key. Run:'), chalk.cyan('subto login'));
+        process.exit(1);
+      }
+
+      try {
+        const DEBUG = (program && typeof program.opts === 'function') ? Boolean(program.opts().debug) : false;
+        const endpoint = new URL('account/me', SUBTO_API_BASE_SLASH).toString();
+        const resp = await fetchJsonWithKey(endpoint, { headers: { 'Accept': 'application/json' } }, cfg.apiKey, DEBUG);
+
+        if (resp.status === 401 || resp.status === 403) {
+          console.error(chalk.red('Authentication failed. Check your API key with `subto login`.'));
+          process.exit(1);
+        }
+        if (resp.status < 200 || resp.status >= 300) {
+          let msg = `Request failed with status ${resp.status}`;
+          if (resp.body && typeof resp.body === 'object' && resp.body.error) msg += ': ' + resp.body.error;
+          console.error(chalk.red(msg));
+          process.exit(1);
+        }
+
+        if (opts.json) {
+          console.log(JSON.stringify(resp.body, null, 2));
+          return;
+        }
+
+        printAccountSummary(resp.body);
+      } catch (err) {
+        const msg = err && err.message ? err.message : String(err);
+        console.error(chalk.red('Network error:'), msg);
+        process.exit(1);
+      }
+    });
+
   program
     .command('scan <url>')
     .description('Request a scan for <url> via the Subto API')
@@ -887,7 +970,14 @@ async function run(argv) {
           let recheckedAfterTerminal = false;
           let data = null;
           startSpinner();
+          const MAX_POLL_ITERATIONS = 900; // ~30 min at 2s interval
+          let pollIteration = 0;
           while (true) {
+              if (++pollIteration > MAX_POLL_ITERATIONS) {
+                stopSpinner();
+                console.error(chalk.red('Polling timed out after ' + MAX_POLL_ITERATIONS + ' iterations. The scan may still be running on the server.'));
+                process.exit(1);
+              }
               const statusUrl = new URL(`scan/${scanId}`, SUBTO_API_BASE_SLASH).toString();
             const r = await fetchWithKey(statusUrl, { headers: { 'Accept': 'application/json' } }, cfg.apiKey, DEBUG);
 
@@ -1149,7 +1239,7 @@ async function run(argv) {
         const endpoint = new URL('/api/v1/upload', base).toString();
         const fetchFn = global.fetch; if (typeof fetchFn !== 'function') throw new Error('Global fetch() is not available in this Node runtime. Use Node 18+');
         const body = { files: samples, meta: { collected: collected.length, totalBytes } };
-        const r = await fetchWithKey(endpoint, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) }, cfg.apiKey, DEBUG);
+        const r = await fetchWithKey(endpoint, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) }, cfg.apiKey, Boolean(program.opts && program.opts().debug));
         if (!r.ok) {
           const txt = await r.text().catch(()=>null);
           console.error(chalk.red('Upload failed:'), r.status, txt || r.statusText);
@@ -1161,13 +1251,14 @@ async function run(argv) {
           } catch (e) { /* ignore */ }
           process.exit(1);
         }
-        const j = await r.json(); console.log(chalk.green('Upload queued:'), j.uploadId, 'scanId:', j.scanId, 'expiresAt:', new Date(j.expiresAt).toString());
+        let j; try { j = await r.json(); } catch (_) { console.error(chalk.red('Server returned non-JSON response')); process.exit(1); }
+        console.log(chalk.green('Upload queued:'), j.uploadId, 'scanId:', j.scanId, 'expiresAt:', j.expiresAt ? new Date(j.expiresAt).toString() : 'N/A');
         if (opts.wait) {
           // Poll the scan resource until completed (reuse existing polling behavior)
           const statusUrl = new URL(`scan/${j.scanId}`, SUBTO_API_BASE_SLASH).toString();
           const sleep = ms => new Promise(r=>setTimeout(r,ms));
           while (true) {
-            const s = await fetchWithKey(statusUrl, { headers: { 'Accept': 'application/json' } }, cfg.apiKey, DEBUG);
+            const s = await fetchWithKey(statusUrl, { headers: { 'Accept': 'application/json' } }, cfg.apiKey, Boolean(program.opts && program.opts().debug));
             if (!s.ok) { console.error(chalk.red('Failed to fetch scan status:', s.status)); break; }
             const data = await s.json(); if (data.status && ['completed','done','finished','success'].includes(String(data.status).toLowerCase())) { console.log(chalk.green('Scan complete.')); await printFullReport(data); break; }
             console.log(chalk.dim('Scan status:'), data.status || 'queued', '— polling again in 4s'); await sleep(4000);
@@ -1201,7 +1292,7 @@ async function run(argv) {
           const statusUrl = new URL(`scan/${scanId}`, SUBTO_API_BASE_SLASH).toString();
           const r = await fetchWithKey(statusUrl, { headers: { 'Accept': 'application/json' } }, cfg.apiKey, DEBUG);
           if (!r.ok) { throw new Error(`Failed to fetch scan ${scanId}: ${r.status}`); }
-          scanData = await r.json();
+          try { scanData = await r.json(); } catch (_) { throw new Error('Server returned non-JSON response for scan ' + scanId); }
         }
 
         if (!scanData) { console.error(chalk.red('No scan data available.')); return; }
@@ -1378,7 +1469,7 @@ async function run(argv) {
         const endpoint = new URL(`video/${scanId}/debug`, serverBase).toString();
         const res = await fetchFn(endpoint, { headers: { 'Accept': 'application/json' } });
         if (!res.ok) throw new Error(`Server returned ${res.status}`);
-        const json = await res.json();
+        let json; try { json = await res.json(); } catch (_) { throw new Error('Server returned non-JSON response'); }
         console.log(chalk.bold('\nVideo diagnostic for:'), scanId);
         if (json && json.scan) {
           console.log('  URL:', json.scan.url || '(unknown)');
@@ -1416,9 +1507,9 @@ async function run(argv) {
         const base = SUBTO_HOST_BASE; const fetchFn = global.fetch;
         if (typeof fetchFn !== 'function') throw new Error('Global fetch() is not available in this Node runtime. Use Node 18+');
           const statusUrl = new URL(`scan/${answer}`, SUBTO_API_BASE_SLASH).toString();
-          const r = await fetchWithKey(statusUrl, { headers: { 'Accept': 'application/json' } }, cfg.apiKey, DEBUG);
+          const r = await fetchWithKey(statusUrl, { headers: { 'Accept': 'application/json' } }, cfg.apiKey, false);
         if (!r.ok) throw new Error(`Failed to fetch scan ${answer}: ${r.status}`);
-        scanData = await r.json();
+        try { scanData = await r.json(); } catch (_) { throw new Error('Server returned non-JSON response'); }
       }
       await startChatREPL(scanData);
       return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "subto",
-  "version": "8.0.6",
+  "version": "9.0.1",
   "description": "Subto CLI — thin wrapper around the Subto.One API",
   "bin": {
     "subto": "bin/subto.js"