@4pm/cli 1.4.4 → 1.4.6

package/dist/index.js

@@ -28420,6 +28420,31 @@ function collectFingerprint() {
   return { fingerprint, hostname: host };
 }
 
+// src/utils/secure-url.ts
+function isLocalHost(hostname2) {
+  return hostname2 === "localhost" || hostname2 === "127.0.0.1" || hostname2 === "::1" || hostname2.endsWith(".localhost");
+}
+function isInsecureRemoteUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return false;
+  }
+  if (parsed.protocol === "https:" || parsed.protocol === "wss:") return false;
+  return !isLocalHost(parsed.hostname);
+}
+function insecureTransportAllowed() {
+  const flag = (process.env.FOURPM_ALLOW_INSECURE_TRANSPORT ?? "").trim().toLowerCase();
+  return flag === "1" || flag === "true" || flag === "yes";
+}
+var INSECURE_URL_BLOCKED = "\u2717 Refusing to connect over plaintext (http/ws) to a non-local host: credentials (pairing codes / ws_token) would travel in the clear to an unauthenticated server. Use an https://server URL. To override on a trusted private network only, set FOURPM_ALLOW_INSECURE_TRANSPORT=1.";
+function assertSecureRemoteUrl(url) {
+  if (isInsecureRemoteUrl(url) && !insecureTransportAllowed()) {
+    throw new Error(INSECURE_URL_BLOCKED);
+  }
+}
+
 // src/services/api.ts
 var CliApiError = class extends Error {
   constructor(errorCode, message, status) {
@@ -28443,6 +28468,7 @@ async function unwrap(res) {
   return envelope.data;
 }
 async function post(serverUrl, path, body) {
+  assertSecureRemoteUrl(serverUrl);
   const res = await fetch(`${serverUrl}${path}`, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
@@ -28478,30 +28504,12 @@ async function fetchCliVersion(serverUrl) {
   return unwrap(res);
 }
 
-// src/utils/secure-url.ts
-function isLocalHost(hostname2) {
-  return hostname2 === "localhost" || hostname2 === "127.0.0.1" || hostname2 === "::1" || hostname2.endsWith(".localhost");
-}
-function isInsecureRemoteUrl(url) {
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    return false;
-  }
-  if (parsed.protocol === "https:" || parsed.protocol === "wss:") return false;
-  return !isLocalHost(parsed.hostname);
-}
-var INSECURE_URL_WARNING = "\u26A0 Insecure transport: connecting over plaintext (http/ws) to a non-local host. Pairing codes and the ws_token are sent in cleartext and the server is not authenticated (the app-layer encryption does not protect against a man-in-the-middle). Use an https:// server URL in production.";
-
 // src/commands/link.ts
 function sanitizeProfileName(name) {
   return name.replace(/[^a-zA-Z0-9._-]/g, "_") || "profile";
 }
 async function runLink(serverUrl, explicitProfile, token = null) {
-  if (isInsecureRemoteUrl(serverUrl)) console.warn(`
-${INSECURE_URL_WARNING}
-`);
+  assertSecureRemoteUrl(serverUrl);
   let result;
   if (token) {
     console.log(`\u2500\u2500 4PM cli headless pairing (profile: ${explicitProfile ?? "default"}) \u2500\u2500`);
@@ -28782,17 +28790,17 @@ function isValidRoleSet(roles) {
 
 // vendor/@4pm/constants/worker-tools.ts
 var WORKER_TOOL_CATALOG = [
-  { id: "git", label: "Git", category: "vcs", versionArg: "--version", installPackage: null },
-  { id: "node", label: "Node.js", category: "runtime", versionArg: "--version", installPackage: null },
-  { id: "npm", label: "npm", category: "runtime", versionArg: "--version", installPackage: null },
-  { id: "pnpm", label: "pnpm", category: "runtime", versionArg: "--version", installPackage: "pnpm" },
-  { id: "claude", label: "Claude Code", category: "ai-cli", versionArg: "--version", installPackage: "@anthropic-ai/claude-code" },
-  { id: "codex", label: "Codex", category: "ai-cli", versionArg: "--version", installPackage: "@openai/codex" },
-  { id: "gh", label: "GitHub CLI", category: "vcs", versionArg: "--version", installPackage: null },
-  { id: "glab", label: "GitLab CLI", category: "vcs", versionArg: "--version", installPackage: null }
+  { id: "git", label: "Git", category: "vcs", versionArg: "--version", installPackage: null, installable: false },
+  { id: "node", label: "Node.js", category: "runtime", versionArg: "--version", installPackage: null, installable: false },
+  { id: "npm", label: "npm", category: "runtime", versionArg: "--version", installPackage: null, installable: false },
+  { id: "pnpm", label: "pnpm", category: "runtime", versionArg: "--version", installPackage: "pnpm", installable: false },
+  { id: "claude", label: "Claude Code", category: "ai-cli", versionArg: "--version", installPackage: "@anthropic-ai/claude-code", installable: false },
+  { id: "codex", label: "Codex", category: "ai-cli", versionArg: "--version", installPackage: "@openai/codex", installable: false },
+  { id: "gh", label: "GitHub CLI", category: "vcs", versionArg: "--version", installPackage: null, installable: false },
+  { id: "glab", label: "GitLab CLI", category: "vcs", versionArg: "--version", installPackage: null, installable: false }
 ];
 var WORKER_TOOL_PREREQUISITE_IDS = WORKER_TOOL_CATALOG.filter(
-  (t) => t.installPackage === null
+  (t) => !t.installable
 ).map((t) => t.id);
 var WORKER_TOOL_BUNDLED_GLOBALS = ["npm", "corepack"];
 
@@ -34906,6 +34914,7 @@ import { createHash as createHash3 } from "crypto";
 import { existsSync as existsSync8, mkdirSync as mkdirSync4, readdirSync as readdirSync4, readFileSync as readFileSync12, statSync as statSync3 } from "fs";
 import { join as join12 } from "path";
 import { promisify as promisify2 } from "util";
+var NO_USAGE = { tokens: 0, input: 0, output: 0, cacheRead: 0, cacheCreation: 0 };
 var execFileAsync = promisify2(execFile2);
 var MAX_CONTEXT_CHARS = 12e4;
 var ANSWER_TIMEOUT_MS = 12e4;
@@ -34992,13 +35001,19 @@ function buildPrompt(docs, question, askerRole) {
 }
 function runClaudeOnce(cmd, profile, prompt, extraEnv) {
   return new Promise((resolve8, reject) => {
-    const args = ["-p", ...profile?.model ? ["--model", profile.model] : []];
+    const isClaude = cmd.includes("claude");
+    const args = [
+      "-p",
+      ...profile?.model ? ["--model", profile.model] : [],
+      ...isClaude ? ["--output-format", "stream-json", "--verbose"] : []
+    ];
     const env3 = {
       ...process.env,
       ...extraEnv,
       ...profile ? { CLAUDE_CONFIG_DIR: profile.dir } : {}
     };
     const child = spawn4(cmd, args, { stdio: ["pipe", "pipe", "pipe"], env: env3 });
+    const parser = createAiStreamParser(cmd);
     let out = "";
     let err = "";
     const timer = setTimeout(() => {
@@ -35006,7 +35021,7 @@ function runClaudeOnce(cmd, profile, prompt, extraEnv) {
       reject(new Error("claude answer timed out"));
     }, ANSWER_TIMEOUT_MS);
     timer.unref();
-    child.stdout.on("data", (d) => out += d.toString());
+    child.stdout.on("data", (d) => out += parser.push(d.toString()));
     child.stderr.on("data", (d) => err += d.toString());
     child.on("error", (e) => {
       clearTimeout(timer);
@@ -35014,7 +35029,8 @@ function runClaudeOnce(cmd, profile, prompt, extraEnv) {
     });
     child.on("close", (code) => {
       clearTimeout(timer);
-      resolve8({ code: code ?? -1, out, err });
+      out += parser.flush();
+      resolve8({ code: code ?? -1, out, err, usage: parser.usage() });
     });
     child.stdin.write(prompt);
     child.stdin.end();
@@ -35024,8 +35040,8 @@ async function runClaudeWithFailover(prompt, ai) {
   const attempts = ai.profiles.length > 0 ? ai.profiles : [null];
   let lastReason = "no attempt";
   for (let i = 0; i < attempts.length; i++) {
-    const { code, out, err } = await runClaudeOnce(ai.cmd, attempts[i], prompt, ai.env);
-    if (code === 0 && out.trim()) return out.trim();
+    const { code, out, err, usage } = await runClaudeOnce(ai.cmd, attempts[i], prompt, ai.env);
+    if (code === 0 && out.trim()) return { text: out.trim(), usage };
     const combined = err || out;
     lastReason = `exited ${code}: ${combined.slice(0, 500)}`;
     if (!isAuthFailure(combined) && !isSessionLimit(combined) || i === attempts.length - 1) break;
@@ -35037,9 +35053,25 @@ async function runSupportAnswer(req, ai, profileDir2) {
     const dir2 = await ensureRepo(profileDir2, req.repo);
     const docs = collectDocs(dir2);
     if (!docs.trim()) return { body: "", error: "KB repo has no documentation" };
-    const body = await runClaudeWithFailover(buildPrompt(docs, req.question, req.askerRole), ai);
-    if (!body) return { body: "", error: "empty answer" };
-    return { body };
+    const { text, usage } = await runClaudeWithFailover(
+      buildPrompt(docs, req.question, req.askerRole),
+      ai
+    );
+    if (!text) return { body: "", error: "empty answer" };
+    const u = usage.tokens > 0 ? usage : { ...NO_USAGE, tokens: estimateTokens(text) };
+    return {
+      body: text,
+      tokens: u.tokens,
+      ...usage.tokens > 0 ? {
+        tokensBreakdown: {
+          input: usage.input,
+          output: usage.output,
+          cacheRead: usage.cacheRead,
+          cacheCreation: usage.cacheCreation
+        }
+      } : {},
+      finishedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
   } catch (err) {
     logger.warn("support.answer.failed", { error: String(err) });
     return { body: "", error: String(err) };
@@ -36636,7 +36668,7 @@ async function detectWorkerTools() {
         category: t.category,
         installed: version !== null,
         version,
-        installable: t.installPackage !== null
+        installable: t.installable
       };
     })
   );
@@ -36646,10 +36678,10 @@ async function detectWorkerTools() {
 function resolvePackage(name, op) {
   const entry = WORKER_TOOL_CATALOG.find((t) => t.id === name);
   if (entry) {
-    if (entry.installPackage === null) {
+    if (!entry.installable) {
       return { error: `"${name}" is a prerequisite and cannot be ${op}ed from here.` };
     }
-    return { pkg: entry.installPackage };
+    return { pkg: entry.installPackage ?? name };
   }
   if (WORKER_TOOL_PREREQUISITE_IDS.includes(name)) {
     return { error: `"${name}" is a prerequisite and cannot be ${op}ed from here.` };
@@ -36725,7 +36757,6 @@ var WsClient = class {
   ecdh = null;
   wsToken = "";
   /** Warn about a plaintext-remote server URL only once per process (ADR-0194 finding #1). */
-  insecureWarned = false;
   heartbeat = null;
   usageTimer = null;
   logUploadTimer = null;
@@ -36969,10 +37000,12 @@ var WsClient = class {
         }
         const wsBase = this.credential.wsUrl ?? this.credential.serverUrl;
         const wsUrl = wsBase.replace(/^http/, "ws") + "/ws";
-        if (!this.insecureWarned && isInsecureRemoteUrl(wsUrl)) {
-          this.insecureWarned = true;
-          this.bus.log(INSECURE_URL_WARNING, "warn");
-          logger.warn("ws.insecure-transport", { url: wsBase });
+        if (isInsecureRemoteUrl(wsUrl) && !insecureTransportAllowed()) {
+          this.stopped = true;
+          this.bus.log(INSECURE_URL_BLOCKED, "error");
+          this.bus.setStatus("stopped");
+          logger.error("ws.insecure-transport-blocked", { url: wsBase });
+          throw new Error(INSECURE_URL_BLOCKED);
         }
         const socket = new wrapper_default(wsUrl);
         this.socket = socket;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@4pm/cli",
-  "version": "1.4.4",
+  "version": "1.4.6",
   "private": false,
   "description": "4PM CLI — drives Claude/Codex CLIs on AI worker machines (Node + TypeScript)",
   "license": "LicenseRef-4PM-Source-Available",