[razor-x]

Problem

SDK audit finding L2, plus the positional constructor the other SDKs have:

• README "Advanced Usage" shows Seam.from_api_key("...", faraday_options: {}, faraday_retry_options: {}), but Seam.from_api_key, Seam.from_personal_access_token, and the Seam::Http counterparts forwarded only endpoint, wait_for_action_attempt, and timeout, so the documented call raised ArgumentError: unknown keywords.
• The README's polling example used Seam.new("your-api-key"). The other SDKs accept the token as the first positional argument (python Seam("key", endpoint=...), JS new SeamHttp("key"), PHP new Seam("key")), but every Ruby constructor was keyword-only and raised ArgumentError on it.
• The README said a timed-out request raises Faraday::TimeoutError, while the spec named "raises Faraday::TimeoutError" asserted Faraday::ConnectionFailed.

Fix

Two commits:

1. Forward both options through every factory. Document the timeout behavior as it actually is (verified against faraday-net_http's source): a connection that cannot be opened in time raises Faraday::ConnectionFailed (Net::OpenTimeout is in its NET_HTTP_EXCEPTIONS), a response that does not arrive in time raises Faraday::TimeoutError.
2. Accept the api key as the first positional argument to Seam.new, Seam::Http.new, and Seam::Http::SingleWorkspace.new, and the personal access token as the first positional argument to Seam::Http::WithoutWorkspace.new, following python's shape: first positional is the token, everything else stays keyword-only (client: included). Giving the token both ways raises SeamInvalidOptionsError. The README keeps Seam.new("your-api-key") and shows the positional form in the authentication sections.

Tests

spec/seam_client/factory_options_spec.rb covers all four factories: faraday_options reaches the client's headers and request options, and faraday_retry_options: {max: 0} is honored (one request on a 503, counted with WebMock). timeout_spec.rb renames the mislabeled example and adds a read-timeout spec against a local socket that accepts but never responds, asserting Faraday::TimeoutError. api_key_spec.rb and client_without_workspace_spec.rb cover the positional token on every constructor, the both-ways rejection, the positional token alongside client:, a nil first argument, and token-format rejection through the positional path.

Revert-check against main: 8 ArgumentError failures from the factory specs; Seam.new("key") raised wrong number of arguments (given 1, expected 0).

🤖 Generated with Claude Code

https://claude.ai/code/session_01SQW83gyXeUG61RDrHEky97