fix: use www.clawhub.ai as default registry to prevent auth header stripping on redirect

[IISweetHeartII]

Summary

clawhub.ai returns a 307 redirect to www.clawhub.ai. Per standard HTTP security rules, the Authorization header is stripped on cross-origin redirects. This causes all authenticated CLI commands (publish, whoami, sync, delete, etc.) to fail with "Unauthorized" unless the user manually passes --registry https://www.clawhub.ai.

Root Cause

• DEFAULT_SITE and DEFAULT_REGISTRY in packages/clawdhub/src/cli/registry.ts point to https://clawhub.ai (without www)
• .well-known/clawhub.json discovery file also returns non-www URLs
• CLI sends authenticated requests to https://clawhub.ai
• Server responds with 307 redirect to https://www.clawhub.ai
• Browser/fetch follows redirect but strips Authorization header (cross-origin security)
• Request arrives at www.clawhub.ai without auth → "Unauthorized"

Fix

• Update DEFAULT_SITE and DEFAULT_REGISTRY to https://www.clawhub.ai
• Update public/.well-known/clawhub.json to use www.clawhub.ai for all endpoints
• Update all CLI test mocks and e2e test fallbacks to match

Testing

• All 305 unit tests pass (46 test files)
• The fix is a minimal, targeted URL change — no logic modifications

Related Issues

Fixes #100
Also fixes #41, #72, #99

All of these report the same symptom: CLI returns "Unauthorized" after successful login, which is caused by the auth header being stripped during the non-www → www redirect.

Greptile Overview

Greptile Summary

This PR updates the CLI’s default site/registry URLs and the .well-known/clawhub.json discovery document to use https://www.clawhub.ai instead of https://clawhub.ai, avoiding a cross-origin 307 redirect that strips Authorization headers and breaks authenticated commands. Test fixtures and e2e defaults were updated accordingly.

One inconsistency remains: the Convex Discord webhook helper still defaults SITE_URL to the non-www domain, so webhook-generated links may continue pointing at the redirecting host instead of the new canonical URL.

Confidence Score: 4/5

• This PR is safe to merge with low risk; it’s mostly a targeted URL change with one missed default outside the CLI.
• The production change is limited to switching default site/registry constants and the discovery document, and tests were updated to match. The primary concern is an inconsistent default URL in convex/lib/webhooks.ts that still points to the redirecting non-www domain, which could lead to inconsistent links.
• convex/lib/webhooks.ts (and its tests) for URL consistency

_{(2/5) Greptile learns from your feedback when you react with thumbs up/down!}

Context used:

• Context from dashboard - AGENTS.md (source)

[vercel]

@IISweetHeartII is attempting to deploy a commit to the Amantus Machina Team on Vercel.

A member of the Team first needs to authorize it.

[greptile-apps]

_{1 file reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

Additional Comments (1)

convex/lib/webhooks.ts
[P1] Default SITE_URL still points at non-www domain

This PR changes the CLI/site defaults to https://www.clawhub.ai to avoid the clawhub.ai -> www redirect, but convex/lib/webhooks.ts still defaults SITE_URL to https://clawhub.ai. Any Discord webhook payloads that rely on the default will keep generating links to the redirecting host, which is inconsistent with the new canonical URL.

Also appears in: convex/lib/webhooks.test.ts:23,39,53,68,70,84.

Prompt To Fix With AI

This is a comment left during a code review.
Path: convex/lib/webhooks.ts
Line: 19:21

Comment:
[P1] Default SITE_URL still points at non-www domain

This PR changes the CLI/site defaults to `https://www.clawhub.ai` to avoid the `clawhub.ai -> www` redirect, but `convex/lib/webhooks.ts` still defaults `SITE_URL` to `https://clawhub.ai`. Any Discord webhook payloads that rely on the default will keep generating links to the redirecting host, which is inconsistent with the new canonical URL.

Also appears in: `convex/lib/webhooks.test.ts:23,39,53,68,70,84`.

How can I resolve this? If you propose a fix, please make it concise.

[vercel]

Additional Suggestion:

README documentation references old default site URL 'https://clawhub.ai' instead of the new default 'https://www.clawhub.ai'

[vercel]

The LEGACY_REGISTRY_HOSTS set does not include 'clawhub.ai', causing users with the old cached URL to continue using it instead of upgrading to the new default.