vexi-cli 0.9.0 → 0.9.1

package/dist/providers/detect.js

@@ -38,11 +38,19 @@ export const PROVIDER_PATTERNS = [
     // they always fall back to the interactive provider-selection list.
 ];
 /**
- * Sanitize a pasted API key: trim whitespace/newlines and strip
- * surrounding quotes (users often paste keys with extra characters).
+ * Sanitize a pasted API key: strip characters that can't be sent in an HTTP
+ * header, trim whitespace/newlines, and strip surrounding quotes.
+ *
+ * API keys are always printable ASCII, but pasting one — especially on an
+ * RTL/multilingual system — can silently pull in invisible bidi marks
+ * (U+200E/U+200F), a non-breaking space, smart quotes, or a stray newline.
+ * `fetch()` then rejects the Authorization header with a cryptic
+ * "character … has a value greater than 255" error on *every* request. We
+ * drop anything outside printable ASCII up front so that never happens.
  */
 export function sanitizeKey(raw) {
-    let key = raw.trim();
+    // Keep only space + printable ASCII (0x20–0x7E); trim() handles edge spaces.
+    let key = raw.replace(/[^\x20-\x7E]/g, '').trim();
     // Strip matching surrounding quotes ("key", 'key', `key`)
     while (key.length >= 2 && `"'\``.includes(key[0]) && key[0] === key[key.length - 1]) {
         key = key.slice(1, -1).trim();

package/dist/providers/detect.test.js

@@ -0,0 +1,29 @@
+import { describe, it, expect } from 'vitest';
+import { sanitizeKey, detectProvider } from './detect.js';
+describe('sanitizeKey', () => {
+    it('trims surrounding whitespace and quotes', () => {
+        expect(sanitizeKey('  gsk_abc123  ')).toBe('gsk_abc123');
+        expect(sanitizeKey('"gsk_abc123"')).toBe('gsk_abc123');
+        expect(sanitizeKey("'gsk_abc123'")).toBe('gsk_abc123');
+    });
+    it('strips invisible bidi marks pasted on RTL systems', () => {
+        // U+200F RIGHT-TO-LEFT MARK embedded around the key — the exact class of
+        // char that makes fetch() throw "value greater than 255" on the header.
+        expect(sanitizeKey('‏gsk_abc123‏')).toBe('gsk_abc123');
+        expect(sanitizeKey('gsk_‎abc123')).toBe('gsk_abc123');
+    });
+    it('strips non-breaking spaces, newlines, and smart quotes', () => {
+        expect(sanitizeKey('gsk_abc 123')).toBe('gsk_abc123');
+        expect(sanitizeKey('gsk_abc123\n')).toBe('gsk_abc123');
+        expect(sanitizeKey('“gsk_abc123”')).toBe('gsk_abc123');
+    });
+    it('produces a header-safe (all printable ASCII) result', () => {
+        const cleaned = sanitizeKey('‏gsk_ab c123');
+        expect([...cleaned].every((ch) => ch.charCodeAt(0) >= 0x21 && ch.charCodeAt(0) <= 0x7e)).toBe(true);
+    });
+    it('leaves a clean key untouched and still auto-detects the provider', () => {
+        const key = sanitizeKey('gsk_1234567890');
+        expect(key).toBe('gsk_1234567890');
+        expect(detectProvider(key)).toBe('groq');
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vexi-cli",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "Open-source AI coding agent for your terminal. Bring your own key, zero config, multilingual.",
   "type": "module",
   "bin": {