@camerontaylor/paseo-cli 0.12.0-fork.1 → 0.13.0-fork.1

package/dist/cli.js

@@ -1,3 +1,4 @@
+import { createHostCommand } from "./commands/host/index.js";
 import { pairCommand } from "./commands/daemon/pair.js";
 import { Command, Option } from "commander";
 import { createAgentCommand } from "./commands/agent/index.js";
@@ -50,6 +51,7 @@ export function createCli() {
         .option("--no-headers", "omit table headers")
         .option("--no-color", "disable colored output");
     addDaemonHostOption(program);
+    program.addCommand(createHostCommand());
     // Primary agent commands (top-level)
     addJsonAndDaemonHostOptions(addLsOptions(program.command("ls"))).action(withOutput(runLsCommand));
     addJsonAndDaemonHostOptions(addRunOptions(program.command("run"))).action(withOutput(runRunCommand));

package/dist/commands/agent/archive.js

@@ -1,4 +1,5 @@
 import { connectToDaemon, resolveAgentId } from "../../utils/client.js";
+import { fetchAllAgents } from "../../utils/agent-directory.js";
 /** Schema for archive command output */
 export const archiveSchema = {
     idField: "agentId",
@@ -26,8 +27,7 @@ export async function runArchiveCommand(agentIdArg, options, _command) {
     }
     const client = await connectToDaemon({ target: options.daemonTarget });
     try {
-        const agentsPayload = await client.fetchAgents({ filter: { includeArchived: true } });
-        const agents = agentsPayload.entries.map((entry) => entry.agent);
+        const agents = await fetchAllAgents(client, { filter: { includeArchived: true } });
         const agentId = resolveAgentId(agentIdArg, agents);
         if (!agentId) {
             const error = {

package/dist/commands/agent/ls.js

@@ -1,4 +1,5 @@
 import { connectToDaemon } from "../../utils/client.js";
+import { fetchAllAgents } from "../../utils/agent-directory.js";
 import { collectMultiple } from "../../utils/command-options.js";
 import { isSameOrDescendantPath } from "../../utils/paths.js";
 export function addLsOptions(cmd) {
@@ -139,18 +140,7 @@ export async function listAgents(options, connect = connectToDaemon) {
         }
         const labelFilters = parseLabelFilters(options.label);
         const fetchOptions = buildAgentLsFetchOptions(options);
-        let agents = [];
-        let cursor;
-        // createdAt never changes, so agents cannot move past the cursor while the pages are read.
-        do {
-            const payload = await client.fetchAgents({
-                ...fetchOptions,
-                sort: [{ key: "created_at", direction: "desc" }],
-                page: { limit: 200, ...(cursor ? { cursor } : {}) },
-            });
-            agents.push(...payload.entries.map((entry) => entry.agent));
-            cursor = payload.pageInfo.nextCursor ?? undefined;
-        } while (cursor);
+        let agents = await fetchAllAgents(client, fetchOptions);
         // By default, exclude archived agents. `-a` includes them.
         if (!options.all) {
             agents = agents.filter((a) => !a.archivedAt);

package/dist/commands/agent/send.d.ts

@@ -4,7 +4,7 @@ import type { CommandOptions, SingleResult, OutputSchema } from "../../output/in
 /** Result type for agent send command */
 export interface AgentSendResult {
     agentId: string;
-    status: "sent" | "completed" | "timeout" | "permission" | "error";
+    status: "queued" | "sent" | "completed" | "timeout" | "permission" | "error";
     message: string;
 }
 /** Schema for agent send output */

package/dist/commands/agent/send.js

@@ -142,7 +142,7 @@ export async function runSendCommand(agentIdArg, prompt, options, _command) {
         const images = options.image && options.image.length > 0 ? await readImageFiles(options.image) : undefined;
         const sourceAgentId = process.env.PASEO_AGENT_ID?.trim() || undefined;
         // Send the message
-        await client.sendAgentMessage(agentIdArg, promptInput, {
+        const receipt = await client.sendAgentMessage(agentIdArg, promptInput, {
             images,
             sourceAgentId,
             activeTurnBehavior: options.behavior ?? (sourceAgentId ? "steer" : "interrupt"),
@@ -154,8 +154,10 @@ export async function runSendCommand(agentIdArg, prompt, options, _command) {
                 type: "single",
                 data: {
                     agentId: agentIdArg,
-                    status: "sent",
-                    message: "Message sent, not waiting for completion",
+                    status: receipt.deliveryStatus ?? "sent",
+                    message: receipt.deliveryStatus === "queued"
+                        ? "Message queued for delivery after two quiet seconds"
+                        : "Message sent, not waiting for completion",
                 },
                 schema: agentSendSchema,
             };

package/dist/commands/daemon/pair.js

@@ -47,6 +47,7 @@ export async function resolveLocalPairingOffer(options) {
         relayPublicEndpoint: config.relayPublicEndpoint,
         relayUseTls: config.relayUseTls,
         relayPublicUseTls: config.relayPublicUseTls,
+        relayRequireProtectedSecurity: config.relayRequireProtectedSecurity,
         appBaseUrl: config.appBaseUrl,
         includeQr: true,
     });

package/dist/commands/host/index.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare function createHostCommand(): Command;
+//# sourceMappingURL=index.d.ts.map

package/dist/commands/host/index.js

@@ -0,0 +1,92 @@
+import { Command } from "commander";
+import { withOutput, } from "../../output/index.js";
+import { addJsonAndDaemonHostOptions, collectMultiple } from "../../utils/command-options.js";
+import { connectToDaemon } from "../../utils/client.js";
+const schema = {
+    idField: "registrationId",
+    columns: [
+        { header: "ID", field: "registrationId" },
+        { header: "LABEL", field: "label" },
+        { header: "SERVER", field: "serverId" },
+        { header: "ENABLED", field: "enabled" },
+        { header: "STATUS", field: "status" },
+        { header: "SOURCE", field: (row) => `${row.source.id}/${row.source.key}` },
+    ],
+};
+function metadata(values = []) {
+    return Object.fromEntries(values.map((entry) => {
+        const split = entry.indexOf("=");
+        if (split < 1)
+            throw { code: "invalid_metadata", message: "Metadata must use key=value" };
+        return [entry.slice(0, split), entry.slice(split + 1)];
+    }));
+}
+async function run(action, id, options) {
+    const client = await connectToDaemon({ target: options.daemonTarget });
+    try {
+        if (action === "add")
+            return {
+                type: "single",
+                data: await client.addHost({
+                    connection: id,
+                    label: options.label,
+                    metadata: metadata(options.meta),
+                }),
+                schema,
+            };
+        if (action === "ls")
+            return { type: "list", data: (await client.listHosts()).hosts, schema };
+        const host = (await client.listHosts()).hosts.find((entry) => entry.registrationId === id);
+        if (!host)
+            throw { code: "host_unknown", message: `Unknown registration ${id}` };
+        if (action === "inspect")
+            return {
+                type: "single",
+                data: host,
+                schema: { ...schema, renderHuman: () => JSON.stringify(host, null, 2) },
+            };
+        if (action === "rm") {
+            await client.removeHost(id);
+            return { type: "single", data: host, schema };
+        }
+        const patch = {};
+        if (action === "enable" || action === "disable")
+            patch.enabled = action === "enable";
+        if (options.label !== undefined)
+            patch.label = options.label || null;
+        if (options.connection !== undefined)
+            patch.connection = options.connection;
+        if (options.replaceIdentity)
+            patch.replaceIdentity = true;
+        if (options.meta?.length || options.removeMeta?.length) {
+            patch.metadata = { ...host.metadata, ...metadata(options.meta) };
+            for (const key of options.removeMeta ?? [])
+                delete patch.metadata[key];
+        }
+        return { type: "single", data: await client.updateHost(id, patch), schema };
+    }
+    finally {
+        await client.close();
+    }
+}
+export function createHostCommand() {
+    const host = new Command("host").description("Manage hosts connected to the selected daemon");
+    addJsonAndDaemonHostOptions(host.command("ls").description("List saved hosts, including disabled and failed entries")).action(withOutput((options, _command) => run("ls", undefined, options)));
+    addJsonAndDaemonHostOptions(host
+        .command("add")
+        .argument("<connection>")
+        .option("--label <name>")
+        .option("--meta <key=value>", "Set metadata", collectMultiple, [])).action(withOutput((connection, options, _command) => run("add", connection, options)));
+    addJsonAndDaemonHostOptions(host
+        .command("update")
+        .argument("<registration-id>")
+        .option("--label <name>")
+        .option("--connection <connection>")
+        .option("--replace-identity", "Accept a new destination identity")
+        .option("--meta <key=value>", "Replace supplied metadata keys", collectMultiple, [])
+        .option("--remove-meta <key>", "Remove a metadata key", collectMultiple, [])).action(withOutput((id, options, _command) => run("update", id, options)));
+    for (const action of ["inspect", "enable", "disable", "rm"])
+        addJsonAndDaemonHostOptions(host.command(action).argument("<registration-id>")).action(withOutput((id, options, _command) => run(action, id, options)));
+    return host;
+}
+//# sourceMappingURL=index.js.map

package/dist/commands/plugin/scaffold.js

@@ -27,6 +27,9 @@ when they help. Use sentence case and plain factual language, with no em dashes.
 Omit installation commands, badges, changelog, contributing or license sections,
 marketing, and unsupported claims. Avoid implementation filler such as empty
 cleanup functions, theme-token field lists, or lists of absent features.
+
+To translate the overview, add a whole copy beside this file named for the
+language, such as OVERVIEW.zh-CN.md. Readers in that language see it instead.
 -->
 `;
 const TSCONFIG = {
@@ -166,6 +169,7 @@ export async function scaffoldPluginDirectory(targetDirectory, requestedId) {
         files: [
             "paseo-plugin.json",
             "OVERVIEW.md",
+            "OVERVIEW.*.md",
             "index.client.ts",
             "index.client.tsx",
             "index.server.ts",

package/dist/ssh/ssh-tunnel.d.ts

@@ -1,9 +1,3 @@
-import { type SshTransportTarget } from "@camerontaylor/paseo-protocol/ssh-transport";
-export interface SshTunnel {
-    endpoint: string;
-    close(): void;
-    failureDetail(): string | null;
-}
-export declare function resolveSshFailureDetail(failure: string | null, stderr: string): string | null;
-export declare function createSshTunnel(target: SshTransportTarget): Promise<SshTunnel>;
+export { createSshTunnel, resolveSshFailureDetail } from "@camerontaylor/paseo-client/node";
+export type { SshTunnel } from "@camerontaylor/paseo-client/node";
 //# sourceMappingURL=ssh-tunnel.d.ts.map

package/dist/ssh/ssh-tunnel.js

@@ -1,79 +1,2 @@
-import { spawn } from "node:child_process";
-import { createServer } from "node:net";
-import { buildSshTunnelArgs } from "@camerontaylor/paseo-protocol/ssh-transport";
-const SSH_STDERR_LIMIT = 8192;
-function formatSshFailure(stderr, code, signal) {
-    const detail = stderr.trim();
-    if (detail)
-        return detail;
-    if (signal)
-        return `ssh exited with signal ${signal}`;
-    return `ssh exited with code ${code ?? "unknown"}`;
-}
-export function resolveSshFailureDetail(failure, stderr) {
-    return failure ?? (stderr.trim() || null);
-}
-export function createSshTunnel(target) {
-    let server = null;
-    let socket = null;
-    let child = null;
-    let stderr = "";
-    let failure = null;
-    function close() {
-        server?.close();
-        server = null;
-        socket?.destroy();
-        socket = null;
-        if (child && !child.killed)
-            child.kill();
-        child = null;
-    }
-    return new Promise((resolve, reject) => {
-        server = createServer((acceptedSocket) => {
-            socket = acceptedSocket;
-            server?.close();
-            server = null;
-            child = spawn("ssh", buildSshTunnelArgs(target), {
-                stdio: ["pipe", "pipe", "pipe"],
-                windowsHide: true,
-            });
-            child.stderr.on("data", (chunk) => {
-                stderr = `${stderr}${chunk.toString()}`.slice(-SSH_STDERR_LIMIT);
-            });
-            child.on("error", (error) => {
-                failure = error.message;
-                acceptedSocket.destroy(error);
-            });
-            child.on("exit", (code, signal) => {
-                if (code !== 0 || signal)
-                    failure = formatSshFailure(stderr, code, signal);
-                acceptedSocket.destroy(failure ? new Error(failure) : undefined);
-            });
-            acceptedSocket.on("error", () => undefined);
-            acceptedSocket.on("close", () => {
-                if (child && !child.killed)
-                    child.kill();
-            });
-            acceptedSocket.pipe(child.stdin);
-            child.stdout.pipe(acceptedSocket);
-        });
-        server.once("error", (error) => {
-            close();
-            reject(error);
-        });
-        server.listen(0, "127.0.0.1", () => {
-            const address = server?.address();
-            if (!address || typeof address === "string") {
-                close();
-                reject(new Error("Failed to allocate the SSH tunnel port"));
-                return;
-            }
-            resolve({
-                endpoint: `127.0.0.1:${address.port}`,
-                close,
-                failureDetail: () => resolveSshFailureDetail(failure, stderr),
-            });
-        });
-    });
-}
+export { createSshTunnel, resolveSshFailureDetail } from "@camerontaylor/paseo-client/node";
 //# sourceMappingURL=ssh-tunnel.js.map

package/dist/utils/agent-directory.d.ts

@@ -0,0 +1,17 @@
+import type { AgentSnapshotPayload } from "@camerontaylor/paseo-protocol/messages";
+import type { connectToDaemon } from "./client.js";
+type FetchAgentsOptions = NonNullable<Parameters<Awaited<ReturnType<typeof connectToDaemon>>["fetchAgents"]>[0]>;
+interface AgentDirectoryClient {
+    fetchAgents(options?: FetchAgentsOptions): Promise<{
+        entries: {
+            agent: AgentSnapshotPayload;
+        }[];
+        pageInfo: {
+            nextCursor: string | null;
+        };
+    }>;
+}
+/** Read the complete directory without agents moving between pages as they update. */
+export declare function fetchAllAgents(client: AgentDirectoryClient, options?: Omit<FetchAgentsOptions, "page" | "sort" | "subscribe">): Promise<AgentSnapshotPayload[]>;
+export {};
+//# sourceMappingURL=agent-directory.d.ts.map

package/dist/utils/agent-directory.js

@@ -0,0 +1,17 @@
+/** Read the complete directory without agents moving between pages as they update. */
+export async function fetchAllAgents(client, options = {}) {
+    const agents = [];
+    let cursor;
+    // createdAt never changes, so agents cannot move past the cursor while the pages are read.
+    do {
+        const payload = await client.fetchAgents({
+            ...options,
+            sort: [{ key: "created_at", direction: "desc" }],
+            page: { limit: 200, ...(cursor ? { cursor } : {}) },
+        });
+        agents.push(...payload.entries.map((entry) => entry.agent));
+        cursor = payload.pageInfo.nextCursor ?? undefined;
+    } while (cursor);
+    return agents;
+}
+//# sourceMappingURL=agent-directory.js.map

package/dist/utils/client.js

@@ -1,13 +1,9 @@
+import { createHostClient, parseHostTarget } from "@camerontaylor/paseo-client/node";
 import { waitForDaemonReady, resolvePaseoHome, readLocalCredentialForTarget, } from "@camerontaylor/paseo-server/daemon-control";
 import { describeDaemonTarget } from "./daemon-target.js";
-import { buildDaemonWebSocketUrl, buildRelayWebSocketUrl, normalizeHostPort, parseConnectionUri, shouldUseTlsForDefaultHostedRelay, } from "@camerontaylor/paseo-protocol/daemon-endpoints";
-import { parseConnectionOfferFromUrl, } from "@camerontaylor/paseo-protocol/connection-offer";
-import { parseSshTransportUri } from "@camerontaylor/paseo-protocol/ssh-transport";
-import { DaemonClient } from "@camerontaylor/paseo-client/internal/daemon-client";
-import { WebSocket } from "ws";
+import { buildDaemonWebSocketUrl, normalizeHostPort, parseConnectionUri, } from "@camerontaylor/paseo-protocol/daemon-endpoints";
 import { getOrCreateCliClientId } from "./client-id.js";
 import { resolveCliVersion } from "../version.js";
-import { createSshTunnel } from "../ssh/ssh-tunnel.js";
 export function resolveClientPaseoHome(target, env = process.env) {
     return target.kind === "instance" ? target.home : resolvePaseoHome(env);
 }
@@ -22,8 +18,6 @@ export function buildDaemonConnectionCommandError(options) {
         message = String(error.message);
     if (options.target.kind === "endpoint")
         message = message.replaceAll(options.target.host, describeDaemonTarget(options.target));
-    if (message.startsWith("Cannot connect to daemon at "))
-        return error;
     let code = "DAEMON_UNREACHABLE";
     if (typeof error === "object" && error !== null && "code" in error)
         code = String(error.code);
@@ -33,7 +27,9 @@ export function buildDaemonConnectionCommandError(options) {
         code = "AUTH_FAILED";
     return {
         code,
-        message: `Cannot connect to daemon at ${describeDaemonTarget(options.target)}: ${message}`,
+        message: message.startsWith("Cannot connect to daemon at ")
+            ? message
+            : `Cannot connect to daemon at ${describeDaemonTarget(options.target)}: ${message}`,
         details: describeConnectionRemedy(code, options.target),
     };
 }
@@ -127,12 +123,9 @@ export function resolveDaemonTarget(host) {
     };
 }
 export function resolveDaemonPassword(host) {
-    const trimmed = host.trim();
-    if (trimmed.startsWith("tcp://")) {
-        const fromUri = parseConnectionUri(trimmed).password;
-        if (fromUri)
-            return fromUri;
-    }
+    const fromUri = parseHostTarget(host).password;
+    if (fromUri)
+        return fromUri;
     const fromEnv = process.env.PASEO_PASSWORD;
     return fromEnv && fromEnv.length > 0 ? fromEnv : undefined;
 }
@@ -143,26 +136,18 @@ export function resolveDaemonCredential(host, home) {
     const token = readLocalCredentialForTarget(home, host);
     return token ? { kind: "localCredential", token } : null;
 }
-/**
- * Create a WebSocket factory that works in Node.js
- */
-function createNodeWebSocketFactory() {
-    return (url, options) => {
-        return new WebSocket(url, options?.protocols, {
-            headers: options?.headers,
-            ...(options?.socketPath ? { socketPath: options.socketPath } : {}),
-        });
-    };
-}
-/**
- * Create and connect a daemon client
- * Returns the connected client or throws if connection fails
- */
-async function tryConnectHost(host, credential, home, clientId, timeout, nodeWebSocketFactory) {
-    const target = resolveDaemonTarget(host);
-    const client = new DaemonClient({
-        url: target.url,
-        clientId,
+async function connectSelectedDaemon(options) {
+    const timeout = options.timeout ?? DEFAULT_TIMEOUT;
+    const host = options.target.kind === "endpoint"
+        ? options.target.host
+        : (await waitForDaemonReady(options.target.home, {
+            timeoutMs: timeout,
+            instance: options.instance,
+        })).listen;
+    const home = resolveClientPaseoHome(options.target);
+    const credential = resolveDaemonCredential(host, home);
+    const client = createHostClient(host, {
+        clientId: await getOrCreateCliClientId(home),
         clientType: "cli",
         appVersion: resolveCliVersion(),
         ...(credential?.kind === "password" ? { password: credential.password } : {}),
@@ -170,37 +155,6 @@ async function tryConnectHost(host, credential, home, clientId, timeout, nodeWeb
             ? { localCredential: () => readLocalCredentialForTarget(home, host) ?? undefined }
             : {}),
         connectTimeoutMs: timeout,
-        webSocketFactory: (url, config) => nodeWebSocketFactory(url, {
-            headers: config?.headers,
-            protocols: config?.protocols,
-            ...(target.type === "ipc" ? { socketPath: target.socketPath } : {}),
-        }),
-        reconnect: { enabled: false },
-    });
-    try {
-        await client.connect();
-        return { client };
-    }
-    catch (error) {
-        await client.close().catch(() => { });
-        return { error };
-    }
-}
-async function connectViaRelayOffer(offer, clientId, timeout, nodeWebSocketFactory) {
-    const url = buildRelayWebSocketUrl({
-        endpoint: offer.relay.endpoint,
-        serverId: offer.serverId,
-        role: "client",
-        useTls: offer.relay.useTls ?? shouldUseTlsForDefaultHostedRelay(offer.relay.endpoint),
-    });
-    const client = new DaemonClient({
-        url,
-        clientId,
-        clientType: "cli",
-        appVersion: resolveCliVersion(),
-        connectTimeoutMs: timeout,
-        webSocketFactory: (target, config) => nodeWebSocketFactory(target, { headers: config?.headers, protocols: config?.protocols }),
-        e2ee: { enabled: true, daemonPublicKeyB64: offer.daemonPublicKeyB64 },
         reconnect: { enabled: false },
     });
     try {
@@ -208,66 +162,9 @@ async function connectViaRelayOffer(offer, clientId, timeout, nodeWebSocketFacto
         return client;
     }
     catch (error) {
-        await client.close().catch(() => { });
-        const message = error instanceof Error ? error.message : String(error);
-        const lastError = client.lastError ? ` (${client.lastError})` : "";
-        throw new Error(`Failed to connect via relay offer: ${message}${lastError}`, { cause: error });
-    }
-}
-function parseHostOfferOrNull(host) {
-    if (!host)
-        return null;
-    try {
-        return parseConnectionOfferFromUrl(host);
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        throw new Error(`Invalid pairing offer URL: ${message}`, { cause: error });
-    }
-}
-async function connectSelectedDaemon(options) {
-    const timeout = options.timeout ?? DEFAULT_TIMEOUT;
-    const deadline = Date.now() + timeout;
-    const explicitHost = options.target.kind === "endpoint"
-        ? options.target.host
-        : (await waitForDaemonReady(options.target.home, {
-            timeoutMs: timeout,
-            instance: options.instance,
-        })).listen;
-    const home = resolveClientPaseoHome(options.target);
-    const clientId = await getOrCreateCliClientId(home);
-    const nodeWebSocketFactory = createNodeWebSocketFactory();
-    if (explicitHost?.trim().startsWith("ssh://")) {
-        const target = parseSshTransportUri(explicitHost.trim());
-        const tunnel = await createSshTunnel(target);
-        const password = resolveDaemonPassword(explicitHost);
-        const result = await tryConnectHost(tunnel.endpoint, password ? { kind: "password", password } : null, home, clientId, Math.max(1, deadline - Date.now()), nodeWebSocketFactory);
-        if ("client" in result) {
-            const close = result.client.close.bind(result.client);
-            result.client.close = async () => {
-                try {
-                    await close();
-                }
-                finally {
-                    tunnel.close();
-                }
-            };
-            return result.client;
-        }
-        const failure = tunnel.failureDetail();
-        tunnel.close();
-        if (failure)
-            throw new Error(`SSH connection failed: ${failure}`, { cause: result.error });
-        throw result.error;
-    }
-    const offer = parseHostOfferOrNull(explicitHost);
-    if (offer) {
-        return connectViaRelayOffer(offer, clientId, Math.max(1, deadline - Date.now()), nodeWebSocketFactory);
+        await client.close();
+        throw error;
     }
-    const result = await tryConnectHost(explicitHost, resolveDaemonCredential(explicitHost, home), home, clientId, Math.max(1, deadline - Date.now()), nodeWebSocketFactory);
-    if ("client" in result)
-        return result.client;
-    throw result.error;
 }
 export async function connectToDaemon(options) {
     try {

package/dist/utils/daemon-target.js

@@ -1,3 +1,4 @@
+import { parseHostTarget } from "@camerontaylor/paseo-protocol/host-target";
 import { resolvePaseoHome } from "@camerontaylor/paseo-server/daemon-control";
 export function selectDaemonTarget(options, env = process.env, localOnly = false) {
     for (const key of ["home", "host"]) {
@@ -34,18 +35,29 @@ export function describeDaemonTarget(target) {
     if (target.kind === "instance")
         return `home ${target.home}`;
     try {
-        const url = new URL(target.host);
-        if (url.password)
-            url.password = "REDACTED";
-        for (const key of url.searchParams.keys())
-            if (/password|token|secret/i.test(key))
-                url.searchParams.set(key, "REDACTED");
-        if (url.hash)
-            url.hash = "REDACTED";
-        return url.toString();
+        const input = target.host.trim();
+        const parsed = parseHostTarget(input);
+        // Discovery descriptions are display text; command hints must preserve the address syntax.
+        if (parsed.kind === "ssh" || (!parsed.offer && !parsed.socketPath && input.includes("://"))) {
+            const url = new URL(input);
+            if (decodeURIComponent(url.username).includes(":"))
+                url.username = "REDACTED";
+            for (const key of new Set(url.searchParams.keys())) {
+                const routingOption = (parsed.kind === "ssh" && key === "daemonPort") ||
+                    (key === "ssl" &&
+                        url.searchParams.getAll(key).every((value) => value === "true" || value === "false"));
+                if (!routingOption)
+                    url.searchParams.set(key, "REDACTED");
+            }
+            return url.toString();
+        }
+        // Pairing offers must always use safe display text, including prefix-free fragments.
+        return parsed.kind === "socket" && !parsed.offer && !input.includes("://")
+            ? input
+            : parsed.description;
     }
     catch {
-        return target.host.replace(/([?&](?:password|token|secret)=)[^&]*/gi, "$1REDACTED");
+        return "<invalid endpoint>";
     }
 }
 //# sourceMappingURL=daemon-target.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camerontaylor/paseo-cli",
-  "version": "0.12.0-fork.1",
+  "version": "0.13.0-fork.1",
   "description": "Paseo CLI - control your AI coding agents from the command line",
   "bin": {
     "paseo": "bin/paseo"
@@ -28,9 +28,9 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.0.0",
-    "@camerontaylor/paseo-client": "0.12.0-fork.1",
-    "@camerontaylor/paseo-protocol": "0.12.0-fork.1",
-    "@camerontaylor/paseo-server": "0.12.0-fork.1",
+    "@camerontaylor/paseo-client": "0.13.0-fork.1",
+    "@camerontaylor/paseo-protocol": "0.13.0-fork.1",
+    "@camerontaylor/paseo-server": "0.13.0-fork.1",
     "chalk": "^5.3.0",
     "commander": "^12.0.0",
     "mime-types": "^2.1.35",