fix(mcp): preserve POST across gateway redirect + unwrap MCP envelope (#19) (#20)

* fix(mcp): preserve POST across gateway redirect + unwrap MCP envelope

QA #18 surfaced a P0: the default host https://askpraxis.ai 301-redirects
to www, and Go's default http.Client downgrades the invoke POST->GET and
drops the body on a 301, so every MCP invoke hits a body-less GET that
404s and is misreported as "unknown mcp/fn" — a fresh install can't call
any MCP function.

- callMCP: custom CheckRedirect preserves method, body, and Authorization
  across redirects (fixes invokes against any redirecting host, including
  already-stored stale URLs).
- credentials.DefaultURL: default to the canonical https://www.askpraxis.ai
  so fresh logins don't redirect at all.
- mcp pretty output: new prettyMCPOutput unwraps single-text
  {content:[{type:text,text}]} envelopes for human output (E3); --json
  output is unchanged.

Tests (TDD, watched each fail first): TestCallMCP_PreservesPOSTAcrossRedirect,
TestDefaultURL_IsCanonicalHost, TestPrettyMCPOutput_*. go test -race + vet +
gofmt clean.

Refs #19.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(login): persist the canonical post-redirect host (#19)

fetchAuthMe already follows the apex → www 301; capture the URL it
landed on and store that, so neither fresh logins nor stale stored
profiles force every later MCP invoke through the redirect. Reuse
logins self-heal an apex URL already in the store.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(mcp): forward Authorization only to same-domain redirect targets (#19)

The CheckRedirect that preserves POST + body across the gateway's 301
cloned all headers unconditionally, so a redirect to a foreign host
would carry the bearer token with it. Mirror net/http's own
sensitive-header rule: forward Authorization only when the target is
the original host or a subdomain of it (apex → www stays covered).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs(readme): raptor surface is read-write, RBAC enforced server-side (#19)

Corrects the read-only framing from the #18 QA brief per the decision
recorded in #19-B.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: nachiket0310 <nachiket.warhade@facets.cloud>
Co-authored-by: Anuj Hydrabadi <129152617+anujhydrabadi@users.noreply.github.com>

Author: 4 people

README.md

@@ -18,9 +18,10 @@ Once installed and logged in, your local AI host can:
 - **Query cloud infra** — run read-only `aws`, `gcloud`, and `az`
   commands against your org's integrations through the `cloud_cli`
   MCP. Mutating verbs blocked at the validator.
-- **Drive Facets via Raptor** — every read-only `raptor` verb
-  (projects, releases, environments, schemas, logs) through the
-  `raptor_cli` MCP, under your org's Facets PAT.
+- **Drive Facets via Raptor** — the full `raptor` verb surface, read
+  and write (projects, releases, environments, schemas, logs), through
+  the `raptor_cli` MCP, under your org's Facets PAT. RBAC and audit
+  are enforced server-side.
 - **Read & search the infrastructure catalog** — list registered
   repos, search GitHub, register newly discovered repos via the
   `catalog_ops` MCP.

cmd/login.go

@@ -181,6 +181,11 @@ func tryReuseStoredToken(out io.Writer, asJSON bool, profileName, baseURL string
 		}
 		return false, nil // graceful fallback to the browser
 	}
+	// Persist the canonical (post-redirect) host so a stale stored URL
+	// self-heals on the next login (issue #19-A).
+	if user.canonicalBaseURL != "" {
+		baseURL = user.canonicalBaseURL
+	}
 	return true, persistAndSetup(out, asJSON, profileName, baseURL, prof.Token, user.Email)
 }
 
@@ -353,6 +358,12 @@ func saveAndVerifyToken(out io.Writer, asJSON bool, profileName, baseURL, token
 			exitcode.Auth)
 		os.Exit(exitcode.Auth)
 	}
+	// Store the canonical (post-redirect) host, not what the user typed:
+	// a stored apex URL would force every later MCP invoke through the
+	// apex → www 301 (issue #19-A).
+	if user.canonicalBaseURL != "" {
+		baseURL = user.canonicalBaseURL
+	}
 	return persistAndSetup(out, asJSON, profileName, baseURL, token, user.Email)
 }
 
@@ -402,6 +413,14 @@ type authMeResponse struct {
 	UserID   string `json:"user_id"`
 	Email    string `json:"email"`
 	Username string `json:"username"`
+
+	// canonicalBaseURL is the deployment base URL the /auth/me call
+	// actually landed on after following redirects (e.g. the apex
+	// askpraxis.ai 301s to www). Login persists this instead of the URL
+	// the user typed, so later MCP invokes never pay that redirect.
+	// Empty when a test stub doesn't set it — callers fall back to the
+	// URL they already have.
+	canonicalBaseURL string
 }
 
 // fetchAuthMe is the seam: tests swap it to avoid hitting a real server.
@@ -424,6 +443,17 @@ var fetchAuthMe = func(baseURL, token string) (*authMeResponse, error) {
 	if err := json.NewDecoder(resp.Body).Decode(&me); err != nil {
 		return nil, err
 	}
+	// resp.Request is the FINAL request after the client followed any
+	// redirects; strip the known endpoint path to recover the canonical
+	// deployment base (preserving any path prefix the deployment lives
+	// under). Fall back to what the caller passed if the shape is ever
+	// unexpected.
+	me.canonicalBaseURL = baseURL
+	if final := resp.Request.URL.String(); strings.HasSuffix(final, "/ai-api/auth/me") {
+		if base := strings.TrimRight(strings.TrimSuffix(final, "/ai-api/auth/me"), "/"); base != "" {
+			me.canonicalBaseURL = base
+		}
+	}
 	return &me, nil
 }
 

cmd/login_canonical_test.go

@@ -0,0 +1,113 @@
+package cmd
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/Facets-cloud/praxis-cli/internal/credentials"
+)
+
+// ─── issue #19-A: canonicalize the host at login ─────────────────────────
+//
+// The apex https://askpraxis.ai 301-redirects to www. fetchAuthMe's GET
+// follows the redirect, so login *works* against the apex — but if the
+// CLI then stores the apex URL, every later MCP invoke pays (and used to
+// fail on) that redirect. Login must store the scheme://host the
+// /auth/me call actually landed on.
+
+// canonicalPair spins up a "final" server serving /ai-api/auth/me and a
+// "stale" server that 301-redirects everything to it, mimicking the
+// apex → www hop.
+func canonicalPair(t *testing.T) (stale, final *httptest.Server) {
+	t.Helper()
+	final = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/ai-api/auth/me" {
+			http.NotFound(w, r)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"user_id":"u1","email":"qa@facets.cloud"}`))
+	}))
+	t.Cleanup(final.Close)
+	stale = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Redirect(w, r, final.URL+r.URL.Path, http.StatusMovedPermanently)
+	}))
+	t.Cleanup(stale.Close)
+	return stale, final
+}
+
+func TestFetchAuthMe_ReportsCanonicalHostAfterRedirect(t *testing.T) {
+	stale, final := canonicalPair(t)
+
+	me, err := fetchAuthMe(stale.URL, "sk_test_T")
+	if err != nil {
+		t.Fatalf("fetchAuthMe: %v", err)
+	}
+	if me.Email != "qa@facets.cloud" {
+		t.Errorf("email = %q, want qa@facets.cloud", me.Email)
+	}
+	if me.canonicalBaseURL != final.URL {
+		t.Errorf("canonicalBaseURL = %q, want %q (the post-redirect host)", me.canonicalBaseURL, final.URL)
+	}
+}
+
+func TestFetchAuthMe_NoRedirectKeepsBaseURL(t *testing.T) {
+	_, final := canonicalPair(t)
+
+	me, err := fetchAuthMe(final.URL, "sk_test_T")
+	if err != nil {
+		t.Fatalf("fetchAuthMe: %v", err)
+	}
+	if me.canonicalBaseURL != final.URL {
+		t.Errorf("canonicalBaseURL = %q, want %q (unchanged when no redirect)", me.canonicalBaseURL, final.URL)
+	}
+}
+
+// End to end through the --token login path: the profile must be stored
+// with the canonical (post-redirect) URL, not the stale one the user
+// passed.
+func TestSaveAndVerifyToken_StoresCanonicalURL(t *testing.T) {
+	isolateHome(t)
+	stubPostAuth(t)
+	stale, final := canonicalPair(t)
+
+	if err := saveAndVerifyToken(io.Discard, true, "default", stale.URL, "sk_test_T"); err != nil {
+		t.Fatalf("saveAndVerifyToken: %v", err)
+	}
+
+	store, err := credentials.Load()
+	if err != nil {
+		t.Fatalf("load credentials: %v", err)
+	}
+	got := store["default"].URL
+	if got != final.URL {
+		t.Errorf("stored URL = %q, want canonical %q", got, final.URL)
+	}
+}
+
+// Token reuse against a stored stale URL must self-heal the stored URL
+// to the canonical host on the next login.
+func TestTryReuseStoredToken_SelfHealsStaleURL(t *testing.T) {
+	isolateHome(t)
+	stubPostAuth(t)
+	stale, final := canonicalPair(t)
+	seedProfile(t, "default", stale.URL, "sk_test_T")
+
+	reused, err := tryReuseStoredToken(io.Discard, true, "default", stale.URL)
+	if err != nil {
+		t.Fatalf("tryReuseStoredToken: %v", err)
+	}
+	if !reused {
+		t.Fatal("expected the stored token to be reused")
+	}
+
+	store, err := credentials.Load()
+	if err != nil {
+		t.Fatalf("load credentials: %v", err)
+	}
+	if got := store["default"].URL; got != final.URL {
+		t.Errorf("stored URL after reuse = %q, want self-healed canonical %q", got, final.URL)
+	}
+}

cmd/mcp.go

@@ -136,8 +136,7 @@ Examples:
 		if asJSON {
 			_, _ = out.Write(append(bytes.TrimRight(resp, "\n"), '\n'))
 		} else {
-			pretty := prettyJSON(resp)
-			fmt.Fprintln(out, pretty)
+			fmt.Fprintln(out, prettyMCPOutput(resp))
 		}
 
 		if exitWithToolError {
@@ -314,7 +313,39 @@ var callMCP = func(baseURL, token, mcp, fn string, body []byte, timeout time.Dur
 	if baseURL == "" {
 		return nil, 0, errors.New("profile has no URL set")
 	}
-	client := &http.Client{Timeout: timeout}
+	client := &http.Client{
+		Timeout: timeout,
+		// Go's default redirect policy downgrades POST→GET and drops the
+		// body on 301/302/303. A gateway that 301-redirects (e.g. the
+		// askpraxis.ai apex → www) would therefore turn every invoke into
+		// a body-less GET that 404s — misreported downstream as "unknown
+		// mcp/fn". Preserve the method, body, and Authorization header so
+		// the invoke survives the redirect intact.
+		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+			if len(via) >= 10 {
+				return errors.New("stopped after 10 redirects")
+			}
+			orig := via[0]
+			req.Method = orig.Method
+			req.Header = orig.Header.Clone()
+			// Never leak the bearer token to a foreign domain: mirror
+			// Go's own sensitive-header rule and forward Authorization
+			// only when the redirect target is the original host or a
+			// subdomain of it (apex → www stays covered).
+			if !isDomainOrSubdomain(req.URL.Hostname(), orig.URL.Hostname()) {
+				req.Header.Del("Authorization")
+			}
+			if orig.GetBody != nil {
+				b, err := orig.GetBody()
+				if err != nil {
+					return err
+				}
+				req.Body = b
+				req.ContentLength = orig.ContentLength
+			}
+			return nil
+		},
+	}
 	url := strings.TrimRight(baseURL, "/") + "/ai-api/v1/mcp/" + mcp + "/" + fn
 	req, err := http.NewRequest("POST", url, bytes.NewReader(body))
 	if err != nil {
@@ -334,6 +365,18 @@ var callMCP = func(baseURL, token, mcp, fn string, body []byte, timeout time.Dur
 	return raw, resp.StatusCode, nil
 }
 
+// isDomainOrSubdomain reports whether child is the same host as parent
+// or a label-aligned subdomain of it (www.askpraxis.ai ⊂ askpraxis.ai,
+// but evilaskpraxis.ai ⊄ askpraxis.ai). This is the same rule net/http
+// uses to decide whether sensitive headers may follow a redirect.
+func isDomainOrSubdomain(child, parent string) bool {
+	child, parent = strings.ToLower(child), strings.ToLower(parent)
+	if child == parent {
+		return true
+	}
+	return strings.HasSuffix(child, "."+parent)
+}
+
 // extractDetail tries to pull `detail` out of a FastAPI-style error body
 // for friendlier error printing; falls back to fallback on any failure.
 func extractDetail(raw []byte, fallback string) string {
@@ -373,3 +416,33 @@ func prettyJSON(raw []byte) string {
 	}
 	return string(out)
 }
+
+// prettyMCPOutput renders an MCP response for human (non-JSON) output.
+// The gateway wraps tool output as
+//
+//	{"content":[{"type":"text","text":"<payload>"}]}
+//
+// where the payload is itself usually escaped JSON. When the envelope
+// carries exactly one text item, unwrap it: pretty-print the inner JSON
+// if it parses, otherwise surface the text verbatim. Anything that
+// isn't this single-text shape (plain responses, multi-item content,
+// non-text items) falls through to ordinary pretty-printing so we never
+// hide structure by guessing. JSON output (`--json`) is unaffected — it
+// still passes the canonical envelope through untouched.
+func prettyMCPOutput(raw []byte) string {
+	var env struct {
+		Content []struct {
+			Type string `json:"type"`
+			Text string `json:"text"`
+		} `json:"content"`
+	}
+	if err := json.Unmarshal(raw, &env); err == nil &&
+		len(env.Content) == 1 && env.Content[0].Type == "text" && env.Content[0].Text != "" {
+		inner := env.Content[0].Text
+		if json.Valid([]byte(inner)) {
+			return prettyJSON([]byte(inner))
+		}
+		return inner
+	}
+	return prettyJSON(raw)
+}