feat(cli): default to the single-port cp and cas hostnames

app/cli/README.md

@@ -61,8 +61,8 @@ make api
 
 By default CLI uses the following values for the Control Plane and Artifacts CAS API endpoints:
 
-- Artifacts CAS: api.cas.chainloop.dev:443
-- Control Plane API: api.cp.chainloop.dev:443
+- Artifacts CAS: cas.chainloop.dev:443
+- Control Plane API: cp.chainloop.dev:443
 
 If you want to change them to your custom endpoints, you can do that at build time. We will use `ldflags` and the following variables: `defaultCASAPI` and `defaultCPAPI`. We assume in this example that we have our instance of Chainloop running at the following locations: `api.cas.acme.com:443` and `api.cp.acme.com:443`.
 

app/cli/cmd/root.go

@@ -43,8 +43,8 @@ var (
 	flagOutputFormat string
 	ActionOpts       *action.ActionsOpts
 	logger           zerolog.Logger
-	defaultCPAPI     = "api.cp.chainloop.dev:443"
-	defaultCASAPI    = "api.cas.chainloop.dev:443"
+	defaultCPAPI     = "cp.chainloop.dev:443"
+	defaultCASAPI    = "cas.chainloop.dev:443"
 	apiToken         string
 	flagYes          bool
 	// authTokenIsUser records whether the credentials in use are a user session

app/cli/cmd/telemetry_flush_test.go

@@ -48,7 +48,7 @@ func TestRunTelemetryFlush(t *testing.T) {
 		"command": "attestation push",
 		"duration_ms": 4321,
 		"success": true,
-		"cp_url": "api.cp.chainloop.dev:443",
+		"cp_url": "cp.chainloop.dev:443",
 		"organization_name": "my-org",
 		"token_type": "AUTH_TYPE_API_TOKEN",
 		"user_id": "6f2e4a1b-0000-4a4a-9a1e-8a6b4c2d1e0f",
@@ -65,7 +65,7 @@ func TestRunTelemetryFlush(t *testing.T) {
 	assert.Equal(t, "attestation push", client.tags["command"])
 	assert.Equal(t, testOrgName, client.tags["organization_name"])
 	assert.Equal(t, "AUTH_TYPE_API_TOKEN", client.tags["token_type"])
-	assert.Equal(t, "api.cp.chainloop.dev:443", client.tags["cp_installation_url"])
+	assert.Equal(t, "cp.chainloop.dev:443", client.tags["cp_installation_url"])
 	assert.Equal(t, "cli", client.tags["chainloop_source"])
 
 	// The whole point of the change: the duration must reach PostHog as a number, not a
@@ -87,7 +87,7 @@ func TestRunTelemetryFlushFailedCommand(t *testing.T) {
 		"duration_ms": 12,
 		"success": false,
 		"error_kind": "Unavailable",
-		"cp_url": "api.cp.chainloop.dev:443"
+		"cp_url": "cp.chainloop.dev:443"
 	}`
 
 	client := &captureClient{}

app/cli/cmd/telemetry_report_test.go

@@ -36,7 +36,7 @@ const (
 	testCmdList         = "list"
 	testCmdWorkflowList = testCmdWorkflow + " " + testCmdList
 	testOrgName         = "my-org"
-	testCPURL           = "api.cp.chainloop.dev:443"
+	testCPURL           = "cp.chainloop.dev:443"
 )
 
 // newTestRootCommand builds a root with the same name the real one uses, so the helpers

app/controlplane/api/gen/openapi/openapi-extra.yaml

@@ -67,15 +67,15 @@ paths:
               schema:
                 type: string
                 format: uri
-                example: "https://api.cp.chainloop.dev/artifacts/sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855?token=..."
+                example: "https://cp.chainloop.dev/artifacts/sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855?token=..."
             Refresh:
               description: |
                 Browser redirect with delay and URL.
                 Present when client IS a browser ("text/html" in Accept header).
                 Format: "delay_seconds;url=redirect_url"
               schema:
                 type: string
-                example: "1;url=https://api.cp.chainloop.dev/artifacts/sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855?token=..."
+                example: "1;url=https://cp.chainloop.dev/artifacts/sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855?token=..."
           content:
             text/plain:
               schema:

app/controlplane/api/gen/openapi/openapi.yaml

@@ -172,7 +172,7 @@ paths:
                 type: string
                 format: uri
                 example: >-
-                  https://api.cp.chainloop.dev/artifacts/sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855?token=...
+                  https://cp.chainloop.dev/artifacts/sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855?token=...
             Refresh:
               description: |
                 Browser redirect with delay and URL.
@@ -181,7 +181,7 @@ paths:
               schema:
                 type: string
                 example: >-
-                  1;url=https://api.cp.chainloop.dev/artifacts/sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855?token=...
+                  1;url=https://cp.chainloop.dev/artifacts/sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855?token=...
           content:
             text/plain:
               schema:

devel/sandbox-kit/claude/spec.yaml

@@ -160,8 +160,8 @@ environment:
     # The Chainloop hosts MUST bypass the egress proxy: `chainloop trace` speaks
     # gRPC, and the proxy's intercepted path cannot negotiate h2, so anything that
     # routes these hosts through it silently breaks attestation. See the README.
-    NO_PROXY: "localhost,127.0.0.1,::1,gateway.docker.internal,api.cp.chainloop.dev,api.cas.chainloop.dev,api.app.chainloop.dev"
-    no_proxy: "localhost,127.0.0.1,::1,gateway.docker.internal,api.cp.chainloop.dev,api.cas.chainloop.dev,api.app.chainloop.dev"
+    NO_PROXY: "localhost,127.0.0.1,::1,gateway.docker.internal,cp.chainloop.dev,cas.chainloop.dev,api.cp.chainloop.dev,api.cas.chainloop.dev,api.app.chainloop.dev"
+    no_proxy: "localhost,127.0.0.1,::1,gateway.docker.internal,cp.chainloop.dev,cas.chainloop.dev,api.cp.chainloop.dev,api.cas.chainloop.dev,api.app.chainloop.dev"
 
 credentials:
   # No `anthropic` entry: it is inherited from the parent. Do NOT redeclare it -
@@ -170,16 +170,18 @@ credentials:
   # Proxy-managed injection of the Chainloop token is not usable here: it needs
   # the proxy to terminate TLS, which breaks the kit's gRPC traffic (see the
   # README). Re-test with:
-  #   curl -sv --http2 --proxy "$HTTPS_PROXY" https://api.cp.chainloop.dev/
+  #   curl -sv --http2 --proxy "$HTTPS_PROXY" https://cp.chainloop.dev/
   # and reconsider once the issuer is "Docker Sandboxes Proxy CA" AND h2 is
   # still negotiated.
 
 permissions:
   # Egress is deny-by-default; the Anthropic/Claude hosts come from the parent.
   network:
     allow:
-      - "api.cp.chainloop.dev:443"           # control plane
-      - "api.cas.chainloop.dev:443"          # CAS, when the org backend is external
+      - "cp.chainloop.dev:443"               # control plane
+      - "cas.chainloop.dev:443"              # CAS, when the org backend is external
+      - "api.cp.chainloop.dev:443"           # legacy control plane endpoint, for older configs
+      - "api.cas.chainloop.dev:443"          # legacy CAS endpoint, for older configs
       - "api.app.chainloop.dev:443"          # platform backend
       - "t.chainloop.dev:443"                # CLI telemetry
       - "crb.chainloop.dev:443"              # CLI telemetry, older binaries

extras/dagger/README.md

@@ -348,13 +348,13 @@ This module also provides access to the underlying Chainloop CLI by exposing som
 By default, this dagger module points to Chainloop's upstream instance, but if you want to point to your own instance, you can do it by running the with-instance command just right after `dagger call`
 
 ```sh
-dagger call with-instance --controlplane-api api.cp.chainloop.dev:443 --cas-api api.cas.chainloop.dev:443 [SUBCOMMAND]
+dagger call with-instance --controlplane-api cp.chainloop.dev:443 --cas-api cas.chainloop.dev:443 [SUBCOMMAND]
 ```
 
 example initializing an attestation
 
 ```sh
-dagger call with-instance --controlplane-api api.cp.chainloop.dev:443 --cas-api api.cas.chainloop.dev:443 \
+dagger call with-instance --controlplane-api cp.chainloop.dev:443 --cas-api cas.chainloop.dev:443 \
 init --token env:CHAINLOOP_TOKEN --workflow-name test-from-dagger-2 attestation-id
 ```
 

sbxenv.yaml

@@ -123,7 +123,7 @@ workspace:
 #             from the built-in claude agent. Declaring it again would scope a
 #             second copy to this environment.
 #   bindings: never bind a Chainloop host to a credential. Any credential
-#             targeting api.cp.chainloop.dev flips it from the proxy's tunnel to
+#             targeting cp.chainloop.dev flips it from the proxy's tunnel to
 #             its intercepted path, which serves HTTP/1.1 only — and grpc-go
 #             >=1.67 then aborts with "missing selected ALPN property", so
 #             nothing is attested. The kit's NO_PROXY keeps those hosts direct.