From 53206242888f720ecf0e6fd4cca27d8f05acb995 Mon Sep 17 00:00:00 2001
From: Omar Alaaeldein <omar.alaaeldein@ejust.edu.eg>
Date: Fri, 3 Jul 2026 19:03:09 -0400
Subject: [PATCH] fix: use canonical www.codebuff.com URL for fallbacks

When fallback URLs point to codebuff.com, the server redirects to
www.codebuff.com with a 301 redirect. During this redirect, Node's
fetch client strips the Authorization header (for security reasons),
causing validation/session requests to fail with a 401 Unauthorized.

This changes hardcoded fallbacks to the canonical www.codebuff.com
to avoid redirect-induced credential stripping.
---
 cli/src/utils/error-handling.ts       | 2 +-
 cli/src/utils/freebuff-session-api.ts | 2 +-
 sdk/src/validate-agents.ts            | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/cli/src/utils/error-handling.ts b/cli/src/utils/error-handling.ts
index 05c603c5eb..74daed4dc2 100644
--- a/cli/src/utils/error-handling.ts
+++ b/cli/src/utils/error-handling.ts
@@ -13,7 +13,7 @@ import type {
 
 import { IS_FREEBUFF } from './constants'
 
-const defaultAppUrl = env.NEXT_PUBLIC_CODEBUFF_APP_URL || 'https://codebuff.com'
+const defaultAppUrl = env.NEXT_PUBLIC_CODEBUFF_APP_URL || 'https://www.codebuff.com'
 
 // Normalize unknown errors to a user-facing string.
 const extractErrorMessage = (error: unknown, fallback: string): string => {
diff --git a/cli/src/utils/freebuff-session-api.ts b/cli/src/utils/freebuff-session-api.ts
index e78a8cb065..3c3e1f9637 100644
--- a/cli/src/utils/freebuff-session-api.ts
+++ b/cli/src/utils/freebuff-session-api.ts
@@ -95,7 +95,7 @@ export function sessionFetchSignal(
 
 function sessionEndpoint(): string {
   const base = (
-    env.NEXT_PUBLIC_CODEBUFF_APP_URL || 'https://codebuff.com'
+    env.NEXT_PUBLIC_CODEBUFF_APP_URL || 'https://www.codebuff.com'
   ).replace(/\/$/, '')
   return `${base}/api/v1/freebuff/session`
 }
diff --git a/sdk/src/validate-agents.ts b/sdk/src/validate-agents.ts
index db21af7224..41dd3eda04 100644
--- a/sdk/src/validate-agents.ts
+++ b/sdk/src/validate-agents.ts
@@ -26,7 +26,7 @@ export interface ValidateAgentsOptions {
   /**
    * The base URL of the Codebuff website API.
    * Optional - defaults to NEXT_PUBLIC_CODEBUFF_APP_URL or environment-based URL.
-   * Example: 'https://codebuff.com'
+   * Example: 'https://www.codebuff.com'
    */
   websiteUrl?: string
 }
@@ -49,7 +49,7 @@ export interface ValidateAgentsOptions {
  * // Remote validation
  * const result = await validateAgents(definitions, {
  *   remote: true,
- *   websiteUrl: 'https://codebuff.com'
+ *   websiteUrl: 'https://www.codebuff.com'
  * })
  * ```
  */