Skip to content

fix: make headless api-key auth work end-to-end (CLI + server org resolution) #3493

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
saddlepaddle wants to merge 4 commits into
base: main
Choose a base branch
from
Open

fix: make headless api-key auth work end-to-end (CLI + server org resolution) #3493

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f303c11
fix(cli): make headless api-key auth work on linux
saddlepaddle Apr 15, 2026
a507841
fix(api): resolve api-key active org from metadata, enforce membership
saddlepaddle Apr 15, 2026
a27eaf9
fix(auth): lock api-key metadata + narrow JWT organizationIds to boun…
saddlepaddle Apr 15, 2026
89e159b
fix(cli): strip node-gyp intermediate artifacts from linux-x64 tarball
saddlepaddle Apr 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 20 additions & 3 deletions packages/cli/scripts/build-dist.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -232,8 +232,10 @@ function copyNativePackages(libDir: string, target: Target): void {
*
* 1. `better-sqlite3`: download the Node-ABI prebuild from GitHub and
* overwrite `build/Release/better_sqlite3.node`.
* 2. `node-pty`: delete `build/Release/` so the `bindings` loader falls
* through to the N-API prebuild in `prebuilds/<target>/pty.node`.
* 2. `node-pty`: on darwin, fall back to the in-package N-API prebuild
* by removing `build/`. On linux-x64 there is no upstream prebuild,
* so rebuild from source via node-gyp; node-pty uses node-addon-api
* so the resulting binding is ABI-stable across Node versions.
*/
async function fixNativeBinariesForNode(
libDir: string,
Expand Down Expand Up @@ -262,7 +264,22 @@ async function fixNativeBinariesForNode(
join(bsqDest, "better_sqlite3.node"),
);

const nodePtyBuild = join(destModules, "node-pty", "build");
const nodePtyDir = join(destModules, "node-pty");
const nodePtyBuild = join(nodePtyDir, "build");

if (target === "linux-x64") {
if (existsSync(nodePtyBuild)) {
rmSync(nodePtyBuild, { recursive: true, force: true });
}
console.log("[build-dist] compiling node-pty from source for linux-x64");
await exec("npx", ["--yes", "node-gyp", "rebuild"], nodePtyDir);
Copy link
Copy Markdown

@greptile-apps greptile-apps bot Apr 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 node-gyp rebuild requires Python 3 and a C++ toolchain

node-gyp rebuild will fail with a cryptic error if python3 or gcc/g++ are not available on the build machine. This path is new to the script and could surprise first-time linux contributors. Consider adding a preflight check or a clearer failure message:

console.log("[build-dist] compiling node-pty from source for linux-x64 (requires python3 + gcc)");

Or check explicitly before calling exec:

await exec("python3", ["--version"]).catch(() => {
    throw new Error("node-gyp requires python3 — install it and re-run");
});
Prompt To Fix With AI 
This is a comment left during a code review.
Path: packages/cli/scripts/build-dist.ts
Line: 274-275

Comment:
**`node-gyp rebuild` requires Python 3 and a C++ toolchain**

`node-gyp rebuild` will fail with a cryptic error if `python3` or `gcc`/`g++` are not available on the build machine. This path is new to the script and could surprise first-time linux contributors. Consider adding a preflight check or a clearer failure message:

```ts
console.log("[build-dist] compiling node-pty from source for linux-x64 (requires python3 + gcc)");
```

Or check explicitly before calling `exec`:
```ts
await exec("python3", ["--version"]).catch(() => {
    throw new Error("node-gyp requires python3 — install it and re-run");
});
```

How can I resolve this? If you propose a fix, please make it concise.

const builtBinding = join(nodePtyBuild, "Release", "pty.node");
if (!existsSync(builtBinding)) {
throw new Error(`node-pty build did not produce ${builtBinding}`);
}
return;
}
Comment on lines +278 to +291
Copy link
Copy Markdown

@greptile-apps greptile-apps bot Apr 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Build artifacts bloat the linux tarball

After node-gyp rebuild succeeds, only build/Release/pty.node is needed at runtime. The entire build/ directory — which includes obj.target/ (compiled .o files), Makefile, config.gypi, and other intermediate artifacts — stays in the staging tree and is packed into the tarball. Depending on the machine, this can easily add 5–20 MB.

The darwin path avoids this cleanly by removing build/ entirely (darwin falls back to the in-package prebuilds). The linux path should do the same with a targeted cleanup after the verification:

const builtBinding = join(nodePtyBuild, "Release", "pty.node");
if (!existsSync(builtBinding)) {
    throw new Error(`node-pty build did not produce ${builtBinding}`);
}
// Strip intermediate artifacts — only the .node file is needed at runtime
const objTarget = join(nodePtyBuild, "Release", "obj.target");
if (existsSync(objTarget)) rmSync(objTarget, { recursive: true, force: true });
// Also remove non-Release subdirectories that node-gyp generates
for (const entry of readdirSync(nodePtyBuild)) {
    if (entry !== "Release") {
        rmSync(join(nodePtyBuild, entry), { recursive: true, force: true });
    }
}
return;
Prompt To Fix With AI 
This is a comment left during a code review.
Path: packages/cli/scripts/build-dist.ts
Line: 276-281

Comment:
**Build artifacts bloat the linux tarball**

After `node-gyp rebuild` succeeds, only `build/Release/pty.node` is needed at runtime. The entire `build/` directory — which includes `obj.target/` (compiled `.o` files), `Makefile`, `config.gypi`, and other intermediate artifacts — stays in the staging tree and is packed into the tarball. Depending on the machine, this can easily add 5–20 MB.

The darwin path avoids this cleanly by removing `build/` entirely (darwin falls back to the in-package prebuilds). The linux path should do the same with a targeted cleanup after the verification:

```ts
const builtBinding = join(nodePtyBuild, "Release", "pty.node");
if (!existsSync(builtBinding)) {
    throw new Error(`node-pty build did not produce ${builtBinding}`);
}
// Strip intermediate artifacts — only the .node file is needed at runtime
const objTarget = join(nodePtyBuild, "Release", "obj.target");
if (existsSync(objTarget)) rmSync(objTarget, { recursive: true, force: true });
// Also remove non-Release subdirectories that node-gyp generates
for (const entry of readdirSync(nodePtyBuild)) {
    if (entry !== "Release") {
        rmSync(join(nodePtyBuild, entry), { recursive: true, force: true });
    }
}
return;
```

How can I resolve this? If you propose a fix, please make it concise.


if (existsSync(nodePtyBuild)) {
console.log(
"[build-dist] removing node-pty build/ so bindings falls back to prebuilds/",
Expand Down
4 changes: 3 additions & 1 deletion packages/cli/src/lib/api-client.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,9 @@ export function createApiClient(
url: `${getApiUrl(config)}/api/trpc`,
transformer: SuperJSON,
headers() {
return { Authorization: `Bearer ${opts.bearer}` };
return opts.bearer.startsWith("sk_live_")
? { "x-api-key": opts.bearer }
: { Authorization: `Bearer ${opts.bearer}` };
},
}),
],
Expand Down
4 changes: 3 additions & 1 deletion packages/host-service/src/providers/auth/JwtAuthProvider/JwtAuthProvider.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,9 @@ export class JwtApiAuthProvider implements ApiAuthProvider {
}

const response = await fetch(`${this.apiUrl}/api/auth/token`, {
headers: { Authorization: `Bearer ${this.sessionToken}` },
headers: this.sessionToken.startsWith("sk_live_")
? { "x-api-key": this.sessionToken }
: { Authorization: `Bearer ${this.sessionToken}` },
});
if (!response.ok) {
throw new Error(`Failed to mint JWT: ${response.status}`);
Expand Down
Loading