@prohost/cli 0.1.2 → 0.2.1

package/dist/agent/run.d.ts

@@ -36,7 +36,19 @@ export interface AgentRunOptions {
     dryRun?: boolean;
     /** Execute runs whose signature could not be verified. Off by default. */
     allowUnverified?: boolean;
-    /** Working directory for the agent command. */
+    /**
+     * Gate the agent's tools behind permission prompts instead of bypassing them.
+     *
+     * Off by default: a paired brain is hired to act, and in print mode there is
+     * nobody to approve anything, so a gated agent silently declines to do the
+     * work. `agent run --safe-tools` turns this on. Claude Code only — no other
+     * `--exec` command is shaped at all.
+     */
+    safeTools?: boolean;
+    /**
+     * Working directory for the agent command. Defaults to
+     * ``$PROHOST_HOME/workspace`` — see {@link workspacePath} for why not "here".
+     */
     cwd?: string;
     onLine?: (line: string) => void;
     webSocketCtor?: typeof WebSocket;

package/dist/agent/run.js

@@ -20,11 +20,13 @@
 import os from 'node:os';
 import WebSocket from 'ws';
 import { completeRun, postReply } from './api.js';
+import { MCP_SERVER_NAME, claudeCommand, isClaudeExec, looksLikeResumeFailure, parseClaudeOutput, writeMcpConfig, } from './claude.js';
 import { EVENT_AGENT_RUN_REQUESTED, EVENT_MENTION_CREATED, EVENT_MESSAGE_TEAM_CHAT, eventData, parseRunRequest, } from './contract.js';
-import { streamUrlFor } from './credentials.js';
+import { ensureWorkspace, streamUrlFor, workspacePath } from './credentials.js';
 import { execAgent } from './exec.js';
 import { buildPrompt, replyFromStdout } from './prompt.js';
 import { RunStore } from './runstore.js';
+import { SessionStore, sessionKeyFor } from './sessionstore.js';
 import { verifySignature } from './signature.js';
 import { isWebhookEvent } from '../forward.js';
 import { DEFAULT_WS_URL } from '../listen.js';
@@ -85,34 +87,192 @@ async function completeWithRetry(api, path, outcome, log, sleep) {
     }
     return result;
 }
+/**
+ * Decide where the agent command runs.
+ *
+ * The default is a dedicated directory rather than the CLI's own cwd, because
+ * coding agents treat their working directory as configuration — a `CLAUDE.md`,
+ * a `.claude/settings.json` permission list, a project `.mcp.json`. Started
+ * from a checkout of some unrelated service (which is how this was first run in
+ * production), the agent picks up that repo's instructions and denials and
+ * answers a customer as if it were working on that codebase.
+ *
+ * A home directory we can't create in costs the isolation, not the run: fall
+ * back to inheriting the CLI's cwd and say what happened.
+ */
+function resolveWorkdir(options, log) {
+    if (options.cwd)
+        return options.cwd;
+    try {
+        return ensureWorkspace(options.env);
+    }
+    catch (err) {
+        log(`${timestamp()} ! could not create ${workspacePath(options.env)} ` +
+            `(${err instanceof Error ? err.message : String(err)}); running in the current directory ` +
+            'instead, which means the agent inherits any agent config it finds there');
+        return undefined;
+    }
+}
+/**
+ * Assemble the per-process runtime: workspace, session ledger, and — for Claude
+ * Code only — the MCP config that gives the agent tools.
+ *
+ * Every step here is allowed to fail without stopping the harness. An agent
+ * that answers from the prompt alone is the product as it shipped; refusing to
+ * start because a config file couldn't be written would be a regression
+ * dressed up as a safety check.
+ */
+function buildRuntime(options, log) {
+    const workdir = resolveWorkdir(options, log);
+    const sessions = SessionStore.load(options.env, log);
+    const claude = isClaudeExec(options.exec);
+    const skipPermissions = options.safeTools !== true;
+    if (!claude)
+        return { workdir, sessions, claude, skipPermissions };
+    let mcpConfigPath;
+    const mcpUrl = options.credentials.mcp_url;
+    if (mcpUrl) {
+        try {
+            mcpConfigPath = writeMcpConfig({
+                mcpUrl,
+                apiKey: options.credentials.api_key,
+                env: options.env,
+            });
+        }
+        catch (err) {
+            // Said out loud rather than swallowed: the visible symptom would
+            // otherwise be an agent that answers "I can't look that up", which reads
+            // like a model problem and sends someone to the wrong file.
+            log(`${timestamp()} ! could not write the MCP config ` +
+                `(${err instanceof Error ? err.message : String(err)}); the agent will run without ` +
+                'ProhostAI tools');
+        }
+    }
+    else {
+        log(`${timestamp()} ! this pairing carries no MCP endpoint; the agent will run without ProhostAI tools`);
+    }
+    log(`${timestamp()} ⚙ Claude Code detected — resuming a session per conversation` +
+        (mcpConfigPath ? `, ProhostAI tools wired in as ${MCP_SERVER_NAME}` : '') +
+        `${workdir ? ` (workspace: ${workdir})` : ''}`);
+    // Said out loud every start-up, not buried in --help. This is the line that
+    // tells an operator their machine will run tool calls, unprompted, on text
+    // written by someone else in their workspace.
+    log(skipPermissions
+        ? `${timestamp()} ⚠ tools run WITHOUT permission prompts ` +
+            '(--dangerously-skip-permissions). The agent acts as you, with your local ' +
+            'access, on instructions from your workspace. Use --safe-tools to gate them.'
+        : `${timestamp()} ⚙ --safe-tools: tools are permission-gated; anything needing ` +
+            'approval will not run (nobody is at a terminal to approve it).');
+    return { workdir, sessions, claude, mcpConfigPath, skipPermissions };
+}
+/**
+ * Run the agent command once and turn its output into a reply.
+ *
+ * The two branches are the whole point of the split: a plain command's stdout
+ * *is* the reply (the contract every other agent speaks), while Claude Code in
+ * print mode is asked for JSON so the harness can pull out the session id and
+ * tell a failed turn from a successful one. A plain command's behaviour here is
+ * byte-for-byte what it was before this function existed.
+ */
+async function runTurn(run, prompt, options, runtime, log) {
+    // `--timeout` is a ceiling on the run, not on each attempt: the retry below
+    // must not let one run take twice what the operator allowed. Both attempts
+    // share one deadline, which costs the retry nothing in practice — a rejected
+    // `--resume` fails in milliseconds, long before any of the budget is spent.
+    const budgetMs = options.timeoutMs ?? DEFAULT_EXEC_TIMEOUT_MS;
+    const startedAt = Date.now();
+    const remainingMs = () => budgetMs - (Date.now() - startedAt);
+    const exec = (command) => execAgent({
+        command,
+        prompt,
+        timeoutMs: remainingMs(),
+        cwd: runtime.workdir,
+        spawnImpl: options.spawnImpl,
+    });
+    // Wall clock for the whole turn, retry included — what the operator waited,
+    // rather than what the last attempt took.
+    const elapsed = () => Date.now() - startedAt;
+    const failure = (result) => ({
+        ok: false,
+        reason: result.error ??
+            (result.exitCode === null ? 'agent command did not run' : `agent command exited ${result.exitCode}`),
+        detail: result.stderr.trim().slice(-500),
+        durationMs: elapsed(),
+    });
+    if (!runtime.claude) {
+        const result = await exec(options.exec);
+        if (!result.ok)
+            return failure(result);
+        const reply = replyFromStdout(result.stdout);
+        return reply
+            ? { ok: true, reply, durationMs: elapsed() }
+            : { ok: false, reason: 'agent produced no output', durationMs: elapsed() };
+    }
+    // No session bookkeeping on a dry run. `--dry-run` promises to make no
+    // writes, and a resumed turn is a write: Claude Code records it in the
+    // transcript whether or not we post the reply, so remembering the session
+    // would leave the next *real* run continuing from an answer nobody saw.
+    const key = options.dryRun ? undefined : sessionKeyFor(run);
+    const sessionId = runtime.sessions.get(key);
+    const shape = { mcpConfigPath: runtime.mcpConfigPath, skipPermissions: runtime.skipPermissions };
+    let result = await exec(claudeCommand(options.exec, { ...shape, sessionId }));
+    // A remembered session may simply be gone — transcripts are cleaned up and
+    // the ledger can't know. One retry without it, because the alternative is a
+    // surface that fails every run forever over an optimisation.
+    if (!result.ok &&
+        sessionId &&
+        looksLikeResumeFailure(`${result.stderr}\n${result.stdout}`, sessionId) &&
+        // Skipped rather than squeezed into a token budget: a retry with no time
+        // left would be killed on the spot and reported as a timeout, which is a
+        // worse error message than the resume failure it replaced.
+        remainingMs() > 0) {
+        log(`    … session ${sessionId.slice(0, 12)} could not be resumed; starting a fresh one`);
+        runtime.sessions.forget(key);
+        result = await exec(claudeCommand(options.exec, shape));
+    }
+    if (!result.ok)
+        return failure(result);
+    const parsed = parseClaudeOutput(result.stdout);
+    // A denied tool is not an error the agent reports — the turn succeeds and the
+    // reply just quietly lacks whatever the tool would have found. Printing it is
+    // the difference between "the agent seems dumb" and "the agent asked for
+    // WebSearch and there was nobody to approve it".
+    if (parsed.denials.length > 0) {
+        log(`    ! tools the agent asked for and was refused: ${parsed.denials.join(', ')}`);
+    }
+    if (!parsed.ok) {
+        return {
+            ok: false,
+            reason: 'the agent did not produce a usable reply',
+            detail: parsed.error,
+            durationMs: elapsed(),
+        };
+    }
+    return { ok: true, reply: parsed.text, durationMs: elapsed(), sessionId: parsed.sessionId };
+}
 /**
  * Handle one verified run end-to-end.
  *
  * Every path except a dry run — including every failure — calls the completion
  * endpoint before returning.
  */
-async function handleRun(run, options, api, log, sleep) {
+async function handleRun(run, options, runtime, api, log, sleep) {
     const label = `run ${run.run_id.slice(0, 12)}`;
     const surface = run.conversation_id ?? run.kind ?? 'no conversation';
     log(`${timestamp()} ▶ ${label} started (${surface})`);
     const prompt = buildPrompt(run, {
         agentName: options.credentials.agent?.name ?? 'your agent',
-        mcpUrl: options.credentials.mcp_url,
-    });
-    const result = await execAgent({
-        command: options.exec,
-        prompt,
-        timeoutMs: options.timeoutMs ?? DEFAULT_EXEC_TIMEOUT_MS,
-        cwd: options.cwd,
-        spawnImpl: options.spawnImpl,
+        // Named only when the tools are actually reachable from this invocation.
+        // Telling an agent about an endpoint it has no client for is what produced
+        // replies describing lookups that never happened.
+        mcpServerName: runtime.mcpConfigPath ? MCP_SERVER_NAME : undefined,
+        toolsGated: !runtime.skipPermissions,
     });
+    const result = await runTurn(run, prompt, options, runtime, log);
     const seconds = (result.durationMs / 1000).toFixed(1);
     if (!result.ok) {
-        const reason = result.error ??
-            (result.exitCode === null
-                ? 'agent command did not run'
-                : `agent command exited ${result.exitCode}`);
-        const detail = result.stderr.trim().slice(-500);
+        const { reason } = result;
+        const detail = result.detail ?? '';
         log(`${timestamp()} ✗ ${label} failed after ${seconds}s — ${reason}`);
         if (detail)
             log(`    stderr: ${detail}`);
@@ -127,14 +287,7 @@ async function handleRun(run, options, api, log, sleep) {
         }
         return 'failed';
     }
-    const reply = replyFromStdout(result.stdout);
-    if (!reply) {
-        log(`${timestamp()} ✗ ${label} produced no output after ${seconds}s`);
-        if (options.dryRun)
-            return 'skipped';
-        const reported = await completeWithRetry(api, run.completion_path, { ok: false, error: 'agent produced no output' }, log, sleep);
-        return reported.ok ? 'failed' : 'unreported';
-    }
+    const { reply } = result;
     if (options.dryRun) {
         const destination = run.reply_surface === 'none' ? '(no reply surface)' : `${run.reply_surface} ${run.reply_path}`;
         log(`${timestamp()} ◦ ${label} dry-run — would post to ${destination}:`);
@@ -159,14 +312,23 @@ async function handleRun(run, options, api, log, sleep) {
             log(`    ! could not mark the run complete (HTTP ${completed.status})`);
             return 'unreported';
         }
+        if (result.sessionId) {
+            runtime.sessions.remember(sessionKeyFor(run), result.sessionId);
+        }
         return 'succeeded';
     }
-    const posted = await postReply(api, run.reply_path, run.reply_body_key, reply, run.run_id);
+    const posted = await postReply(api, run.reply_path, run.reply_body_key, reply, run.run_id, run.reply_body_extra);
     if (!posted.ok) {
         log(`${timestamp()} ✗ ${label} reply rejected (HTTP ${posted.status}) ${posted.error ?? ''}`);
         const reported = await completeWithRetry(api, run.completion_path, { ok: false, error: `posting the reply failed with HTTP ${posted.status}` }, log, sleep);
         return reported.ok ? 'failed' : 'unreported';
     }
+    // Advance continuity only after the answer is durable on its reply surface.
+    // Remembering at process exit would strand the conversation behind an answer
+    // it never received whenever this POST is rejected.
+    if (result.sessionId) {
+        runtime.sessions.remember(sessionKeyFor(run), result.sessionId);
+    }
     const completed = await completeWithRetry(api, run.completion_path, { ok: true }, log, sleep);
     if (!completed.ok) {
         // The reply is already in the conversation, so this is a bookkeeping
@@ -192,6 +354,7 @@ export async function runAgentHarness(options) {
     const machine = options.machine ?? os.hostname();
     const url = options.url ?? streamUrlFor(options.credentials, DEFAULT_WS_URL);
     const metrics = newMetrics();
+    const runtime = buildRuntime(options, log);
     // A credential file written by 0.1.0 stores a socket URL on a host that only
     // ever answers 403. Upgrading the CLI would not have fixed those installs on
     // its own — the stored value wins over the constant — so say what happened
@@ -391,7 +554,7 @@ export async function runAgentHarness(options) {
                         metrics.runsFailed += 1;
                         return;
                     }
-                    const outcome = await handleRun(run, options, api, log, sleep).catch((err) => {
+                    const outcome = await handleRun(run, options, runtime, api, log, sleep).catch((err) => {
                         log(`${timestamp()} ✗ run ${run.run_id} crashed the harness handler: ${String(err)}`);
                         return 'failed';
                     });

package/dist/agent/sessionstore.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Which agent session belongs to which conversation.
+ *
+ * Every run spawns a fresh one-shot process, so without this the agent meets
+ * each message as its first: someone answers a clarifying question and gets a
+ * reply that has forgotten the question. Server-supplied thread history
+ * (`recent_messages`) narrows that gap but does not close it — history is what
+ * was *said*, not what the agent worked out, looked up, or decided on the last
+ * turn.
+ *
+ * Keyed by surface rather than by run: a run is one turn, and continuity is a
+ * property of the thread the turns are in.
+ *
+ * Deliberately a separate ledger from `runs.json`. That one is a safety
+ * mechanism whose entries must never be lost; this one is an optimisation whose
+ * worst failure is an agent starting fresh. Mixing them would give the
+ * important file the churn rate of the unimportant one.
+ */
+import type { AgentRunRequest } from './contract.js';
+export interface SessionRecord {
+    /** Surface key — see {@link sessionKeyFor}. */
+    key: string;
+    session_id: string;
+    updated_at: string;
+}
+/** Cap on retained sessions. Oldest are dropped first (insertion order). */
+export declare const SESSION_LEDGER_LIMIT = 200;
+export declare function sessionLedgerPath(env?: NodeJS.ProcessEnv): string;
+/**
+ * The thread a run belongs to, or ``undefined`` when it belongs to none.
+ *
+ * A trigger fan-out (`reservation.created` and friends) has no surface and no
+ * predecessor, so it deliberately gets no key: resuming an unrelated session
+ * into it would carry over context that has nothing to do with the event, which
+ * is worse than starting clean.
+ *
+ * Keyed by agent as well as surface. The ledger outlives a pairing — re-pair
+ * this machine to a different AI employee and the file is still there — so a
+ * surface-only key would have the new agent resume the old one's session and
+ * answer in its predecessor's voice, carrying its reasoning and tool state.
+ */
+export declare function sessionKeyFor(run: AgentRunRequest): string | undefined;
+/**
+ * Surface → session id, backed by a JSON file.
+ *
+ * Like {@link RunStore}, every persistence failure degrades to memory-only
+ * rather than throwing: a read-only home directory should cost continuity, not
+ * the ability to answer.
+ */
+export declare class SessionStore {
+    private readonly file;
+    private readonly onWarn;
+    private records;
+    private constructor();
+    /** Read the ledger from disk. A missing or corrupt file starts empty. */
+    static load(env?: NodeJS.ProcessEnv, onWarn?: (line: string) => void): SessionStore;
+    /** The session to resume for a surface, if one is remembered. */
+    get(key: string | undefined): string | undefined;
+    /**
+     * Remember the session a surface's last turn ran in.
+     *
+     * Re-inserted rather than mutated in place so the map's insertion order stays
+     * a real least-recently-used order — {@link trim} drops from the front, and
+     * mutating in place would make the busiest thread the first one evicted.
+     */
+    remember(key: string | undefined, sessionId: string): void;
+    /** Drop a surface's session — used when the agent rejected it as unresumable. */
+    forget(key: string | undefined): void;
+    private trim;
+    private persist;
+}

package/dist/agent/sessionstore.js

@@ -0,0 +1,138 @@
+/**
+ * Which agent session belongs to which conversation.
+ *
+ * Every run spawns a fresh one-shot process, so without this the agent meets
+ * each message as its first: someone answers a clarifying question and gets a
+ * reply that has forgotten the question. Server-supplied thread history
+ * (`recent_messages`) narrows that gap but does not close it — history is what
+ * was *said*, not what the agent worked out, looked up, or decided on the last
+ * turn.
+ *
+ * Keyed by surface rather than by run: a run is one turn, and continuity is a
+ * property of the thread the turns are in.
+ *
+ * Deliberately a separate ledger from `runs.json`. That one is a safety
+ * mechanism whose entries must never be lost; this one is an optimisation whose
+ * worst failure is an agent starting fresh. Mixing them would give the
+ * important file the churn rate of the unimportant one.
+ */
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+import { prohostHome } from './credentials.js';
+/** Cap on retained sessions. Oldest are dropped first (insertion order). */
+export const SESSION_LEDGER_LIMIT = 200;
+export function sessionLedgerPath(env = process.env) {
+    return path.join(prohostHome(env), 'sessions.json');
+}
+/**
+ * The thread a run belongs to, or ``undefined`` when it belongs to none.
+ *
+ * A trigger fan-out (`reservation.created` and friends) has no surface and no
+ * predecessor, so it deliberately gets no key: resuming an unrelated session
+ * into it would carry over context that has nothing to do with the event, which
+ * is worse than starting clean.
+ *
+ * Keyed by agent as well as surface. The ledger outlives a pairing — re-pair
+ * this machine to a different AI employee and the file is still there — so a
+ * surface-only key would have the new agent resume the old one's session and
+ * answer in its predecessor's voice, carrying its reasoning and tool state.
+ */
+export function sessionKeyFor(run) {
+    const surface = run.conversation_id
+        ? `conversation:${run.conversation_id}`
+        : run.task_id
+            ? `task:${run.task_id}`
+            : run.cleaning_id
+                ? `cleaning:${run.cleaning_id}`
+                : undefined;
+    if (!surface)
+        return undefined;
+    return `${run.agent_id ?? 'agent'}/${surface}`;
+}
+/**
+ * Surface → session id, backed by a JSON file.
+ *
+ * Like {@link RunStore}, every persistence failure degrades to memory-only
+ * rather than throwing: a read-only home directory should cost continuity, not
+ * the ability to answer.
+ */
+export class SessionStore {
+    file;
+    onWarn;
+    records = new Map();
+    constructor(file, onWarn) {
+        this.file = file;
+        this.onWarn = onWarn;
+    }
+    /** Read the ledger from disk. A missing or corrupt file starts empty. */
+    static load(env = process.env, onWarn = () => { }) {
+        const store = new SessionStore(sessionLedgerPath(env), onWarn);
+        try {
+            const parsed = JSON.parse(readFileSync(store.file, 'utf8'));
+            if (Array.isArray(parsed)) {
+                for (const entry of parsed) {
+                    const record = entry;
+                    if (typeof record?.key === 'string' && record.key && typeof record.session_id === 'string' && record.session_id) {
+                        store.records.set(record.key, {
+                            key: record.key,
+                            session_id: record.session_id,
+                            updated_at: typeof record.updated_at === 'string' ? record.updated_at : '',
+                        });
+                    }
+                }
+            }
+        }
+        catch {
+            // No ledger yet, or an unreadable one — either way, start clean.
+        }
+        return store;
+    }
+    /** The session to resume for a surface, if one is remembered. */
+    get(key) {
+        if (!key)
+            return undefined;
+        return this.records.get(key)?.session_id;
+    }
+    /**
+     * Remember the session a surface's last turn ran in.
+     *
+     * Re-inserted rather than mutated in place so the map's insertion order stays
+     * a real least-recently-used order — {@link trim} drops from the front, and
+     * mutating in place would make the busiest thread the first one evicted.
+     */
+    remember(key, sessionId) {
+        if (!key || !sessionId)
+            return;
+        this.records.delete(key);
+        this.records.set(key, { key, session_id: sessionId, updated_at: new Date().toISOString() });
+        this.trim();
+        this.persist();
+    }
+    /** Drop a surface's session — used when the agent rejected it as unresumable. */
+    forget(key) {
+        if (!key)
+            return;
+        if (this.records.delete(key))
+            this.persist();
+    }
+    trim() {
+        while (this.records.size > SESSION_LEDGER_LIMIT) {
+            const oldest = this.records.keys().next().value;
+            if (oldest === undefined)
+                return;
+            this.records.delete(oldest);
+        }
+    }
+    persist() {
+        try {
+            mkdirSync(path.dirname(this.file), { recursive: true, mode: 0o700 });
+            writeFileSync(this.file, `${JSON.stringify([...this.records.values()], null, 2)}\n`, {
+                mode: 0o600,
+            });
+        }
+        catch (err) {
+            this.onWarn(`    ! could not write the session ledger (${err instanceof Error ? err.message : String(err)}); ` +
+                'the agent will start a fresh session each run until this is fixed');
+        }
+    }
+}

package/dist/index.d.ts

@@ -2,11 +2,12 @@
 /**
  * `@prohost/cli` — entrypoint.
  *
- * Two commands:
+ * Commands:
  *
  *     npx @prohost/cli listen --forward-to http://localhost:3000/webhook
  *     npx @prohost/cli agent pair --code <pairing-code>
  *     npx @prohost/cli agent run --exec 'claude -p'
+ *     npx @prohost/cli agent install-daemon --exec 'claude -p'
  *
  * Parses arguments with a zero-dep, zero-magic flag parser so the published
  * binary stays small and starts fast.

package/dist/index.js

@@ -2,11 +2,12 @@
 /**
  * `@prohost/cli` — entrypoint.
  *
- * Two commands:
+ * Commands:
  *
  *     npx @prohost/cli listen --forward-to http://localhost:3000/webhook
  *     npx @prohost/cli agent pair --code <pairing-code>
  *     npx @prohost/cli agent run --exec 'claude -p'
+ *     npx @prohost/cli agent install-daemon --exec 'claude -p'
  *
  * Parses arguments with a zero-dep, zero-magic flag parser so the published
  * binary stays small and starts fast.
@@ -24,7 +25,9 @@ function printHelp() {
         'Usage:',
         '  prohost listen --forward-to <local-url> [--api-key <key>] [--url <ws-url>] [--machine <name>] [--subscription-id <id>]',
         '  prohost agent pair --code <pairing-code> [--webhook-url <https-url>] [--base-url <url>]',
-        "  prohost agent run --exec '<command>' [--timeout <seconds>] [--dry-run] [--cwd <dir>]",
+        "  prohost agent run --exec '<command>' [--timeout <seconds>] [--dry-run] [--workdir <dir>]",
+        "  prohost agent install-daemon --exec '<command>' [--workdir <dir>]   Keep the agent running",
+        '  prohost agent uninstall-daemon',
         '',
         'listen flags:',
         '  --forward-to     Local URL to POST each webhook payload to (required)',
@@ -42,10 +45,21 @@ function printHelp() {
         '  --exec           Command to run for each mention; the prompt arrives on stdin (required)',
         '  --timeout        Seconds one run may take before it is killed. Defaults to 300.',
         '  --dry-run        Print the reply that would be posted; write nothing.',
-        '  --cwd            Working directory for the agent command.',
+        '  --workdir        Working directory for the agent command. Defaults to $PROHOST_HOME/workspace.',
+        '                   Avoid pointing it at a code checkout: agents read CLAUDE.md, .claude/settings.json',
+        '                   and .mcp.json from their working directory and will inherit them.',
+        '  --cwd            Deprecated alias for --workdir.',
         '  --machine        Machine name displayed in the UI. Defaults to the OS hostname.',
         '  --url            Websocket endpoint. Defaults to the paired value.',
         '  --allow-unverified  Run events whose signature could not be verified (not recommended).',
+        '  --safe-tools     Gate the agent\'s tools behind permission prompts instead of bypassing them.',
+        '                   Claude Code runs default to --dangerously-skip-permissions so the agent can',
+        '                   act; with --safe-tools expect it to answer rather than do. Alias:',
+        '                   --no-skip-permissions.',
+        '',
+        'agent install-daemon flags:  (macOS: launchd; Linux: prints a systemd-user unit)',
+        '  --exec           The same command you would pass to `agent run` (required).',
+        '  --workdir, --timeout, --machine, --url, --allow-unverified, --safe-tools — passed to `agent run`.',
         '',
         'Global flags:',
         '  --help, -h       Show this help and exit.',
@@ -55,7 +69,7 @@ function printHelp() {
         '  PROHOST_API_KEY       Used by `listen` when --api-key is not provided.',
         '  PROHOST_WS_URL        Used when --url is not provided.',
         '  PROHOST_PAIRING_CODE  Used by `agent pair` when --code is not provided.',
-        '  PROHOST_HOME          Credential directory. Defaults to ~/.prohost.',
+        '  PROHOST_HOME          Credential, ledger, workspace and log directory. Defaults to ~/.prohost.',
     ];
     process.stdout.write(`${lines.join('\n')}\n`);
 }

package/dist/version.d.ts

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export declare const CLI_VERSION = "0.1.2";
+export declare const CLI_VERSION = "0.2.1";
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
-export declare const USER_AGENT = "prohost-cli/0.1.2";
+export declare const USER_AGENT = "prohost-cli/0.2.1";

package/dist/version.js

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export const CLI_VERSION = '0.1.2';
+export const CLI_VERSION = '0.2.1';
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
 export const USER_AGENT = `prohost-cli/${CLI_VERSION}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prohost/cli",
-  "version": "0.1.2",
+  "version": "0.2.1",
   "description": "Run your own AI agent as a ProhostAI teammate, and stream your account's webhooks to your laptop.",
   "type": "module",
   "license": "MIT",