fix(auth): send a JSON body on the bind-run POST so the API edge lets it through (#83)

The API edge answers a body-less POST without a JSON content type with a
bare 403 before the worker runs (nominal#1575), and `request` only sets
Content-Type when a body is present. `auth bind-run` therefore failed on
every real call — invisible to the fetch-mocked unit tests and swallowed by
the installer's `|| true`. Send `{}`, and pin the wire shape in a test.

Co-authored-by: Justin Helmer <justin@coreplane.ai>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: 3 people

src/commands/auth/bind-run.ts

@@ -40,9 +40,13 @@ export async function bindOnboardingRun(
     process.stderr.write(`Not signed in; onboarding run ${runId} left unbound.\n`);
     return { bound: false, runId };
   }
+  // The route takes no input, but the API edge answers a body-less POST without
+  // a JSON content type with a bare 403 before the worker sees it (nominal#1575).
+  // `request` sets Content-Type only when a body is present, so send `{}`.
   const result = await requestJson<{ bound: boolean }>(config, {
     method: 'POST',
     url: `/v1/auth/onboarding_runs/${runId}/bind`,
+    body: {},
     ...(apiKey ? { headers: { 'x-api-key': apiKey }, noAuth: true } : {}),
   });
   const bound = result.bound === true;

test/auth-bind-run.test.ts

@@ -52,7 +52,7 @@ describe('auth bind-run', () => {
   const originalStderrWrite = process.stderr.write.bind(process.stderr);
   let stdout = '';
   let stderr = '';
-  let bindCalls: { url: string; auth: string | undefined }[] = [];
+  let bindCalls: { url: string; auth: string | undefined; contentType: string | null; body: string }[] = [];
   let bindStatus = 200;
 
   before(() => {
@@ -84,7 +84,12 @@ describe('auth bind-run', () => {
       }
       if (url.includes('/v1/auth/onboarding_runs/')) {
         const headers = new Headers(init?.headers);
-        bindCalls.push({ url, auth: headers.get('authorization') ?? headers.get('x-api-key') ?? undefined });
+        bindCalls.push({
+          url,
+          auth: headers.get('authorization') ?? headers.get('x-api-key') ?? undefined,
+          contentType: headers.get('content-type'),
+          body: String(init?.body ?? ''),
+        });
         if (bindStatus === 401) {
           return Response.json(
             { success: false, error: { message: 'Unauthorized', detail: 'Session expired' }, result: null },
@@ -120,6 +125,17 @@ describe('auth bind-run', () => {
     assert.deepEqual(JSON.parse(stdout), { bound: true, runId: ENV_RUN });
   });
 
+  // The API edge rejects a body-less POST without a JSON content type with a
+  // bare 403 before the worker runs (nominal#1575), which a fetch mock cannot
+  // reproduce — so pin the wire shape the edge needs.
+  it('sends a JSON content type and an empty object body so the API edge lets it through', async () => {
+    writeCredentialsFile();
+    process.env.POLYLANE_ONBOARDING_RUN = ENV_RUN;
+    await run();
+    assert.equal(bindCalls[0]!.contentType, 'application/json');
+    assert.equal(bindCalls[0]!.body, '{}');
+  });
+
   it('binds the file run id when the env var is unset', async () => {
     writeCredentialsFile();
     writeFileSync(RUN_FILE, `${FILE_RUN}\n`);