@openhoo/hoopilot 2.1.4 → 2.1.6

package/README.md

@@ -66,7 +66,7 @@ $env:OPENAI_BASE_URL = "http://127.0.0.1:4141/v1"
 $env:OPENAI_API_KEY = "hoopilot"
 ```
 
-To require clients to authenticate — recommended whenever you expose the proxy beyond localhost — set `HOOPILOT_API_KEY` to a strong, unique secret and send that value as the client key:
+To require clients to authenticate — recommended whenever you expose the proxy beyond localhost — set `HOOPILOT_API_KEY` to a strong, unique secret of at least 24 characters and send that value as the client key:
 
 ```sh
 export HOOPILOT_API_KEY=$(openssl rand -hex 24)
@@ -161,7 +161,7 @@ Tags follow the release version, for example `ghcr.io/openhoo/hoopilot:1.3`, `:1
 
 #### Exposing the proxy beyond loopback
 
-The image binds `0.0.0.0` and cannot tell whether the published port is loopback-only, so it fails closed: drop the `-e HOOPILOT_ALLOW_UNAUTHENTICATED=1` opt-in (or map the port to a non-loopback interface) and it refuses to start without a strong, unique `HOOPILOT_API_KEY` (well-known demo keys are rejected). Clients then send that key as `Authorization: Bearer <key>` or `x-api-key: <key>`:
+The image binds `0.0.0.0` and cannot tell whether the published port is loopback-only, so it fails closed: drop the `-e HOOPILOT_ALLOW_UNAUTHENTICATED=1` opt-in (or map the port to a non-loopback interface) and it refuses to start without a strong, unique `HOOPILOT_API_KEY` of at least 24 characters. Short, repeated, and well-known demo keys are rejected. Clients then send that key as `Authorization: Bearer <key>` or `x-api-key: <key>`:
 
 ```sh
 export HOOPILOT_API_KEY=$(openssl rand -hex 24)
@@ -201,7 +201,7 @@ Start the server:
 hoopilot --port 4141
 ```
 
-By default Hoopilot listens on `127.0.0.1:4141`. If `HOOPILOT_API_KEY` is unset, local requests are accepted without client authentication. Binding to a non-loopback host requires either a strong, unique `HOOPILOT_API_KEY` or the explicit `--allow-unauthenticated` / `HOOPILOT_ALLOW_UNAUTHENTICATED=1` opt-in. Well-known demo keys are always rejected on a non-loopback host, even with the unauthenticated opt-in.
+By default Hoopilot listens on `127.0.0.1:4141`. If `HOOPILOT_API_KEY` is unset, local requests are accepted without client authentication. Binding to a non-loopback host requires either a strong, unique `HOOPILOT_API_KEY` of at least 24 characters or the explicit `--allow-unauthenticated` / `HOOPILOT_ALLOW_UNAUTHENTICATED=1` opt-in. Short, repeated, and well-known demo keys are always rejected on a non-loopback host, even with the unauthenticated opt-in.
 
 When an API key is configured, clients may send it as either `Authorization: Bearer <key>` or `x-api-key: <key>`.
 
@@ -366,7 +366,7 @@ Server and local-client settings:
 | --- | --- |
 | `HOST` / `--host` | Host to listen on. Default: `127.0.0.1` for local runs; Docker sets `0.0.0.0`. |
 | `PORT` / `--port` | Port to listen on. Default: `4141`. |
-| `HOOPILOT_API_KEY` / `--api-key` | Require clients to send `Authorization: Bearer <key>` or `x-api-key: <key>`. Must be a strong, unique secret on non-loopback binds; well-known demo keys are rejected. |
+| `HOOPILOT_API_KEY` / `--api-key` | Require clients to send `Authorization: Bearer <key>` or `x-api-key: <key>`. Must be a strong, unique secret of at least 24 characters on non-loopback binds; short, repeated, and well-known demo keys are rejected. |
 | `--api-key-file` | Read the local API key from a file instead of argv. |
 | `HOOPILOT_ALLOWED_ORIGINS` | Comma-separated browser origins allowed to make cross-origin requests. Loopback origins are always allowed; every other origin is blocked. |
 | `HOOPILOT_ALLOW_UNAUTHENTICATED` / `--allow-unauthenticated` | Allow non-loopback binds without a local API key. |

package/dist/cli.js

@@ -2613,10 +2613,10 @@ footer.foot .end { margin-left:auto; }
     pollGen += 1; var myGen = pollGen;
     if (inflightFetch){ try { inflightFetch.abort(); } catch (e) {} }
     var ctrl = new AbortController(); inflightFetch = ctrl;
-    var to = setTimeout(function(){ try { ctrl.abort(); } catch (e) {} }, 3000);
+    var to = setTimeout(function(){ try { ctrl.abort(); } catch (e) {} }, Math.max(10000, intervalMs * 2));
     var headers = { "accept":"application/json" };
     if (apiKey) headers["x-api-key"] = apiKey;
-    fetch("/v1/usage", { headers: headers, signal: ctrl.signal, cache:"no-store" }).then(function(res){
+    fetch("/v1/usage?view=dashboard", { headers: headers, signal: ctrl.signal, cache:"no-store" }).then(function(res){
       clearTimeout(to);
       if (myGen !== pollGen) return null;
       if (res.status === 401 || res.status === 403){ inflightFetch = null; showAuth(!!apiKey); return null; }
@@ -2898,6 +2898,7 @@ var MetricsRegistry = class {
   #inFlight = 0;
   #requests = /* @__PURE__ */ new Map();
   #durations = /* @__PURE__ */ new Map();
+  #inFlightByRoute = /* @__PURE__ */ new Map();
   #tokens = /* @__PURE__ */ new Map();
   #upstream = /* @__PURE__ */ new Map();
   #copilotQuota;
@@ -2907,14 +2908,23 @@ var MetricsRegistry = class {
     this.#startedAtMs = (options.now ?? Date.now)();
   }
   /** Mark a request as started; pair with exactly one {@link observe}. */
-  startRequest() {
+  startRequest(route) {
     this.#inFlight += 1;
+    if (route) {
+      this.#inFlightByRoute.set(route, (this.#inFlightByRoute.get(route) ?? 0) + 1);
+    }
   }
   /** Record a completed request and clear its in-flight slot. */
   observe(observation) {
     if (this.#inFlight > 0) {
       this.#inFlight -= 1;
     }
+    const inFlightForRoute = this.#inFlightByRoute.get(observation.route) ?? 0;
+    if (inFlightForRoute > 1) {
+      this.#inFlightByRoute.set(observation.route, inFlightForRoute - 1);
+    } else if (inFlightForRoute === 1) {
+      this.#inFlightByRoute.delete(observation.route);
+    }
     const key = labelKey(observation.route, observation.method, String(observation.status));
     this.#requests.set(key, (this.#requests.get(key) ?? 0) + 1);
     this.#observeDuration(observation.route, observation.durationMs / 1e3);
@@ -2999,12 +3009,19 @@ var MetricsRegistry = class {
     this.#durations.set(route, entry);
   }
   /** A JSON-friendly view of the current counters. */
-  snapshot(now = Date.now) {
+  snapshot(nowOrOptions = Date.now) {
+    const options = typeof nowOrOptions === "function" ? { now: nowOrOptions } : nowOrOptions;
+    const now = options.now ?? Date.now;
+    const excludeRoutes = new Set(options.excludeRoutes ?? []);
+    const excludeUpstreamPaths = new Set(options.excludeUpstreamPaths ?? []);
     const byRoute = {};
     const byStatus = {};
     let requestsTotal = 0;
     for (const [key, count] of this.#requests) {
       const [route = "", , status = ""] = key.split(LABEL_SEPARATOR);
+      if (excludeRoutes.has(route)) {
+        continue;
+      }
       byRoute[route] = (byRoute[route] ?? 0) + count;
       byStatus[status] = (byStatus[status] ?? 0) + count;
       requestsTotal += count;
@@ -3022,8 +3039,12 @@ var MetricsRegistry = class {
     let upstreamTotal = 0;
     let upstreamErrors = 0;
     for (const [key, count] of this.#upstream) {
+      const [path = "", outcome = ""] = key.split(LABEL_SEPARATOR);
+      if (excludeUpstreamPaths.has(path)) {
+        continue;
+      }
       upstreamTotal += count;
-      if (key.endsWith(`${LABEL_SEPARATOR}error`)) {
+      if (outcome === "error") {
         upstreamErrors += count;
       }
     }
@@ -3033,8 +3054,8 @@ var MetricsRegistry = class {
     }
     return {
       githubRateLimit,
-      inFlight: this.#inFlight,
-      latency: this.#latencySnapshot(),
+      inFlight: this.#filteredInFlight(excludeRoutes),
+      latency: this.#latencySnapshot(excludeRoutes),
       requests: { byRoute, byStatus, total: requestsTotal },
       startedAt: new Date(this.#startedAtMs).toISOString(),
       tokens: { byModel, extraction: { ...this.#extraction }, ...tokenTotals },
@@ -3042,15 +3063,30 @@ var MetricsRegistry = class {
       uptimeSeconds: Math.max(0, Math.round((now() - this.#startedAtMs) / 1e3))
     };
   }
+  #filteredInFlight(excludeRoutes) {
+    if (excludeRoutes.size === 0) {
+      return this.#inFlight;
+    }
+    let excluded = 0;
+    for (const [route, count] of this.#inFlightByRoute) {
+      if (excludeRoutes.has(route)) {
+        excluded += count;
+      }
+    }
+    return Math.max(0, this.#inFlight - excluded);
+  }
   // Summarize the duration histogram into a JSON latency view: per-route count and
   // exact average, plus overall average and estimated p50/p95. The percentiles come
   // from the buckets aggregated across routes, so they share /metrics' resolution.
-  #latencySnapshot() {
+  #latencySnapshot(excludeRoutes = /* @__PURE__ */ new Set()) {
     const byRoute = {};
     const aggregateBuckets = new Array(DURATION_BUCKETS_SECONDS.length).fill(0);
     let totalCount = 0;
     let totalSum = 0;
     for (const [route, entry] of this.#durations) {
+      if (excludeRoutes.has(route)) {
+        continue;
+      }
       byRoute[route] = {
         avgMs: entry.count > 0 ? round2(entry.sum / entry.count * 1e3) : 0,
         count: entry.count
@@ -3288,17 +3324,15 @@ function observeResponseUsage(response, fallbackModel, onUsage, signal, onOutcom
   if (!body) {
     return response;
   }
-  const [clientBranch, observerBranch] = body.tee();
   const isSse = response.headers.get("content-type")?.includes("text/event-stream") ?? false;
-  void consumeUsage(observerBranch, isSse, fallbackModel, onUsage, signal, onOutcome).catch(
-    () => {
+  return new Response(
+    streamWithUsageObservation(body, isSse, fallbackModel, onUsage, signal, onOutcome),
+    {
+      headers: response.headers,
+      status: response.status,
+      statusText: response.statusText
     }
   );
-  return new Response(clientBranch, {
-    headers: response.headers,
-    status: response.status,
-    statusText: response.statusText
-  });
 }
 function recordResponseTextUsage(text, isSse, fallbackModel, onUsage, onOutcome) {
   const accumulator = createUsageAccumulator(fallbackModel, onUsage, onOutcome);
@@ -3314,13 +3348,16 @@ function recordResponseTextUsage(text, isSse, fallbackModel, onUsage, onOutcome)
   }
   accumulator.finish();
 }
-async function consumeUsage(stream, isSse, fallbackModel, onUsage, signal, onOutcome) {
+function streamWithUsageObservation(stream, isSse, fallbackModel, onUsage, signal, onOutcome) {
   const reader = stream.getReader();
+  let aborted = signal?.aborted ?? false;
+  let released = false;
   const onAbort = () => {
+    aborted = true;
     reader.cancel().catch(() => {
     });
   };
-  if (signal?.aborted) {
+  if (aborted) {
     reader.cancel().catch(() => {
     });
   } else {
@@ -3328,7 +3365,7 @@ async function consumeUsage(stream, isSse, fallbackModel, onUsage, signal, onOut
   }
   const decoder = new TextDecoder();
   const guardedOutcome = onOutcome ? (extracted) => {
-    if (!signal?.aborted) {
+    if (!aborted) {
       onOutcome(extracted);
     }
   } : void 0;
@@ -3336,33 +3373,40 @@ async function consumeUsage(stream, isSse, fallbackModel, onUsage, signal, onOut
   let buffer = "";
   let bufferedBytes = 0;
   let overflowed = false;
-  try {
-    while (true) {
-      const result = await reader.read();
-      if (result.done) {
-        break;
+  const release = () => {
+    if (released) {
+      return;
+    }
+    released = true;
+    signal?.removeEventListener("abort", onAbort);
+    reader.releaseLock();
+  };
+  const observeChunk = (chunkBytes) => {
+    const chunk = decoder.decode(chunkBytes, { stream: true });
+    if (isSse) {
+      buffer += chunk;
+      const lines = buffer.split(/\r?\n/);
+      buffer = lines.pop() ?? "";
+      for (const line of lines) {
+        considerSseLine(line, accumulator.consider);
       }
-      const chunk = decoder.decode(result.value, { stream: true });
-      if (isSse) {
-        buffer += chunk;
-        const lines = buffer.split(/\r?\n/);
-        buffer = lines.pop() ?? "";
-        for (const line of lines) {
-          considerSseLine(line, accumulator.consider);
-        }
-        if (buffer.length > USAGE_BUFFER_LIMIT_BYTES) {
-          buffer = "";
-        }
-      } else if (!overflowed) {
-        bufferedBytes += result.value.byteLength;
-        if (bufferedBytes > USAGE_BUFFER_LIMIT_BYTES) {
-          overflowed = true;
-          buffer = "";
-        } else {
-          buffer += chunk;
-        }
+      if (buffer.length > USAGE_BUFFER_LIMIT_BYTES) {
+        buffer = "";
       }
+      return;
+    }
+    if (overflowed) {
+      return;
+    }
+    bufferedBytes += chunkBytes.byteLength;
+    if (bufferedBytes > USAGE_BUFFER_LIMIT_BYTES) {
+      overflowed = true;
+      buffer = "";
+      return;
     }
+    buffer += chunk;
+  };
+  const finishObservation = () => {
     const finalBuffer = buffer + decoder.decode();
     if (isSse) {
       if (finalBuffer) {
@@ -3374,11 +3418,41 @@ async function consumeUsage(stream, isSse, fallbackModel, onUsage, signal, onOut
         accumulator.consider(parsed);
       }
     }
-  } finally {
-    signal?.removeEventListener("abort", onAbort);
-    reader.releaseLock();
-  }
-  accumulator.finish();
+    if (!aborted) {
+      safeFinishAccumulator(accumulator);
+    }
+  };
+  return new ReadableStream({
+    async pull(controller) {
+      const result = await reader.read().catch((error) => {
+        release();
+        controller.error(error);
+        return void 0;
+      });
+      if (!result) {
+        return;
+      }
+      if (result.done) {
+        finishObservation();
+        controller.close();
+        release();
+        return;
+      }
+      try {
+        observeChunk(result.value);
+      } catch {
+      }
+      controller.enqueue(result.value);
+    },
+    async cancel(reason) {
+      aborted = true;
+      try {
+        await reader.cancel(reason);
+      } finally {
+        release();
+      }
+    }
+  });
 }
 function createUsageAccumulator(fallbackModel, onUsage, onOutcome) {
   let model = fallbackModel;
@@ -3403,6 +3477,12 @@ function createUsageAccumulator(fallbackModel, onUsage, onOutcome) {
     }
   };
 }
+function safeFinishAccumulator(accumulator) {
+  try {
+    accumulator.finish();
+  } catch {
+  }
+}
 function considerSseLine(line, consider) {
   const trimmed = line.trim();
   if (!trimmed.startsWith("data:")) {
@@ -3521,13 +3601,33 @@ async function getVersion() {
 var DEFAULT_HOST = "127.0.0.1";
 var DEFAULT_PORT = 4141;
 var FORBIDDEN_BROWSER_ORIGIN_MESSAGE = "Cross-origin browser requests are blocked unless the Origin is loopback or listed in HOOPILOT_ALLOWED_ORIGINS.";
-var WELL_KNOWN_DEMO_API_KEYS = /* @__PURE__ */ new Set(["local-key"]);
+var MIN_NON_LOOPBACK_API_KEY_LENGTH = 24;
+var WELL_KNOWN_DEMO_API_KEYS = /* @__PURE__ */ new Set([
+  "changeme",
+  "demo",
+  "example",
+  "hoopilot",
+  "local-key",
+  "password",
+  "password123",
+  "secret",
+  "test"
+]);
 var INVALID_JSON_MESSAGE = "Request body must be valid JSON.";
 var JSON_OBJECT_MESSAGE = "Request body must be a JSON object.";
 var MAX_REQUEST_BODY_BYTES = 16 * 1024 * 1024;
 var REQUEST_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;
 var REQUEST_TOO_LARGE_MESSAGE = `Request body must be ${MAX_REQUEST_BODY_BYTES} bytes or smaller.`;
 var USAGE_CACHE_TTL_MS = 6e4;
+var DASHBOARD_USAGE_VIEW = "dashboard";
+var DASHBOARD_EXCLUDED_ROUTES = [
+  "cors.preflight",
+  "dashboard",
+  "health",
+  "metrics",
+  "usage"
+];
+var DASHBOARD_EXCLUDED_UPSTREAM_PATHS = ["/copilot_internal/user"];
 var RequestBodyTooLargeError = class extends Error {
   constructor() {
     super(REQUEST_TOO_LARGE_MESSAGE);
@@ -3580,7 +3680,7 @@ function createHoopilotHandler(options = {}) {
       requestId,
       route
     });
-    metrics.startRequest();
+    metrics.startRequest(route);
     const origin = request.headers.get("origin")?.trim() || void 0;
     const corsOrigin = resolveCorsAllowOrigin(origin, allowedOrigins);
     const inner = normalizeInnerRequest(request, apiPath, url);
@@ -3703,7 +3803,7 @@ function buildApp(deps) {
     }
     logger.error({ err: errorDetails(error), event: "http.request.failed" }, "request failed");
     return jsonError(500, "internal_error", message);
-  }).get("/", () => jsonResponse({ name: "hoopilot", object: "health", status: "ok" })).get("/healthz", () => jsonResponse({ name: "hoopilot", object: "health", status: "ok" })).get("/metrics", () => metricsResponse(metrics)).get("/v1/usage", ({ request }) => handleUsage(metrics, readUsage, request.signal)).get(
+  }).get("/", () => jsonResponse({ name: "hoopilot", object: "health", status: "ok" })).get("/healthz", () => jsonResponse({ name: "hoopilot", object: "health", status: "ok" })).get("/metrics", () => metricsResponse(metrics)).get("/v1/usage", ({ request }) => handleUsage(metrics, readUsage, request)).get(
     "/v1/models",
     ({ request }) => handleModels(client, metrics, request.signal, loggerFor(request))
   ).get("/v1/responses", () => websocketUnsupportedResponse()).post(
@@ -3799,10 +3899,9 @@ function startHoopilotServer(options = {}) {
         "Refusing to listen on a non-loopback host without HOOPILOT_API_KEY. Set an API key or pass --allow-unauthenticated."
       );
     }
-    if (apiKey && isWellKnownDemoApiKey(apiKey)) {
-      throw new Error(
-        "Refusing to listen on a non-loopback host with a well-known demo HOOPILOT_API_KEY. Set a strong, unique API key."
-      );
+    const rejection = apiKey ? apiKeyRejectionReason(apiKey) : void 0;
+    if (rejection) {
+      throw new Error(`Refusing to listen on a non-loopback host: ${rejection}`);
     }
   }
   const server = Bun.serve({
@@ -4100,12 +4199,16 @@ async function readRequestText(request) {
   const reader = body.getReader();
   const decoder = new TextDecoder();
   let bytes = 0;
-  let text = "";
+  const chunks = [];
   try {
     while (true) {
       const { done, value } = await reader.read();
       if (done) {
-        return `${text}${decoder.decode()}`;
+        const tail = decoder.decode();
+        if (tail) {
+          chunks.push(tail);
+        }
+        return chunks.join("");
       }
       bytes += value.byteLength;
       if (bytes > MAX_REQUEST_BODY_BYTES) {
@@ -4113,7 +4216,7 @@ async function readRequestText(request) {
         });
         throw new RequestBodyTooLargeError();
       }
-      text += decoder.decode(value, { stream: true });
+      chunks.push(decoder.decode(value, { stream: true }));
     }
   } finally {
     reader.releaseLock();
@@ -4210,8 +4313,18 @@ function resolveCorsAllowOrigin(origin, allowedOrigins) {
   }
   return isAllowedOrigin(origin, allowedOrigins) ? origin : void 0;
 }
-function isWellKnownDemoApiKey(apiKey) {
-  return WELL_KNOWN_DEMO_API_KEYS.has(apiKey.trim().toLowerCase());
+function apiKeyRejectionReason(apiKey) {
+  const normalized = apiKey.trim();
+  if (WELL_KNOWN_DEMO_API_KEYS.has(normalized.toLowerCase())) {
+    return "HOOPILOT_API_KEY is a well-known demo value. Set a strong, unique API key.";
+  }
+  if (normalized.length < MIN_NON_LOOPBACK_API_KEY_LENGTH) {
+    return `HOOPILOT_API_KEY must be at least ${MIN_NON_LOOPBACK_API_KEY_LENGTH} characters when listening on a non-loopback host.`;
+  }
+  if (/^(.)\1+$/.test(normalized)) {
+    return "HOOPILOT_API_KEY must not be a repeated single character. Set a strong, unique API key.";
+  }
+  return void 0;
 }
 function isUpstreamAuthStatus(status) {
   return status === 401 || status === 403;
@@ -4448,9 +4561,13 @@ function dashboardResponse() {
     status: 200
   });
 }
-async function handleUsage(metrics, readUsage, signal) {
-  const { copilot, error } = await readUsage(signal);
-  const proxy = metrics.snapshot();
+async function handleUsage(metrics, readUsage, request) {
+  const view = new URL(request.url).searchParams.get("view");
+  const { copilot, error } = await readUsage(request.signal);
+  const proxy = view === DASHBOARD_USAGE_VIEW ? metrics.snapshot({
+    excludeRoutes: DASHBOARD_EXCLUDED_ROUTES,
+    excludeUpstreamPaths: DASHBOARD_EXCLUDED_UPSTREAM_PATHS
+  }) : metrics.snapshot();
   const body = {
     copilot: copilot ?? null,
     object: "usage",
@@ -4467,25 +4584,30 @@ function createUsageReader(client, metrics, now = Date.now, ttlMs = USAGE_CACHE_
   let cache;
   return async (signal) => {
     if (cache && now() - cache.atMs < ttlMs) {
-      return { copilot: cache.value };
+      return cache.result;
     }
     try {
       const upstream = await client.usage(signal);
       metrics.recordUpstream(usagePath, upstream.ok);
       metrics.recordGithubRateLimit(parseRateLimitHeaders(upstream.headers, now()));
       if (!upstream.ok) {
-        return { error: `GitHub Copilot usage request failed with ${upstream.status}.` };
+        const result2 = { error: `GitHub Copilot usage request failed with ${upstream.status}.` };
+        cache = { atMs: now(), result: result2 };
+        return result2;
       }
       const value = normalizeCopilotUsage(await upstream.json().catch(() => ({})));
-      cache = { atMs: now(), value };
+      const result = { copilot: value };
+      cache = { atMs: now(), result };
       metrics.recordCopilotQuota(value);
-      return { copilot: value };
+      return result;
     } catch (error) {
       if (error instanceof CopilotAuthError) {
         return { error: error.message };
       }
       metrics.recordUpstream(usagePath, false);
-      return { error: errorMessage(error) };
+      const result = { error: errorMessage(error) };
+      cache = { atMs: now(), result };
+      return result;
     }
   };
 }
@@ -4591,8 +4713,14 @@ function versionFromTag(tag) {
   return tag.trim().replace(/^v/, "");
 }
 function assetSuffixFor(platform, arch, isMusl) {
-  const os = platform === "win32" ? "windows" : platform === "darwin" ? "darwin" : "linux";
-  const cpu = arch === "arm64" || arch === "aarch64" ? "arm64" : "x64";
+  const os = platform === "linux" ? "linux" : platform === "win32" ? "windows" : platform === "darwin" ? "darwin" : void 0;
+  if (!os) {
+    throw new Error(`Unsupported platform for standalone updates: ${platform}.`);
+  }
+  const cpu = arch === "x64" || arch === "amd64" ? "x64" : arch === "arm64" || arch === "aarch64" ? "arm64" : void 0;
+  if (!cpu) {
+    throw new Error(`Unsupported architecture for standalone updates: ${arch}.`);
+  }
   const libc = os === "linux" && isMusl ? "-musl" : "";
   return `${os}-${cpu}${libc}`;
 }
@@ -5481,6 +5609,7 @@ Options:
   -p, --port <port>                 Port to listen on. Default: 4141
       --host <host>                 Host to listen on. Default: 127.0.0.1
       --api-key <key>               Require clients to send Authorization: Bearer <key> or x-api-key: <key>
+                                    Non-loopback binds require at least 24 characters.
       --api-key-file <path>         Read the local API key from a file instead of argv
       --auth-file <path>            OAuth credential store path
       --copilot-api-base-url <url>  Copilot API base URL override