@prohost/cli 0.10.0 → 0.10.1

package/CHANGELOG.md

@@ -4,6 +4,30 @@ Versions follow [semver](https://semver.org/). Publishing is automated: merging
 a version bump to `main` triggers `.github/workflows/npm-publish-cli.yml`, which
 builds via `prepack`, runs the suite, publishes, and tags `cli-v<version>`.
 
+## 0.10.1
+
+Safer key handling for `prohost usage connect`, and no credential ever goes to
+a plain-http API base.
+
+- **`usage connect` reads the key without exposing it.** It prompts with echo
+  off at a terminal, reads piped stdin (`pbpaste | prohost usage connect --key -`),
+  or takes `$PROHOST_API_KEY`. `--key <value>` still works but prints a warning:
+  it leaves the key in shell history and the process list. A connected machine
+  (or one with a paired agent) is not prompted again.
+- **`--base-url` must be `https://`.** `usage connect --base-url` and
+  `agent pair --base-url` reject anything else before a key is stored or a
+  pairing code is spent; `http://` is allowed only for `localhost`, `127.0.0.1`
+  and `[::1]`. `usage start`, `install-daemon` and every reporter tick refuse to
+  send a key to a stored base URL that fails the same check, and `usage status`
+  flags it. A pairing whose server reports a plain-http `mcp_url` or plain-ws
+  `ws_url` keeps the requested base, `<base>/mcp` and the default stream URL
+  instead, and `agent pair --url` / `listen --url` must be `wss://` (`ws://`
+  only on loopback).
+- **`agent run` and `agent install-daemon` refuse insecure stored credentials.**
+  An `agent.json` whose API base, MCP URL or stream URL would carry the key in
+  plaintext (paired over http by an older CLI) is refused with a re-pair hint,
+  before anything is sent.
+
 ## 0.10.0
 
 Every Claude Code and Codex login on a machine can report its remaining

package/README.md

@@ -682,7 +682,7 @@ decision to make.
 | `--code` | `$PROHOST_PAIRING_CODE` | The one-time pairing code. |
 | `--account` | the home's current account, else `default` | Which Claude Code / Codex login this agent runs on (see Accounts). |
 | `--webhook-url` | none | Also push events to this HTTPS endpoint. Omit for stream-only, which is the normal laptop setup. |
-| `--base-url` | `https://connect.prohost.ai` | Public API base. |
+| `--base-url` | `https://connect.prohost.ai` | Public API base. Must be `https://`; `http://` only for `localhost`, `127.0.0.1` and `[::1]`. `agent run` refuses an `agent.json` whose API, MCP or stream URL is plain http/ws off loopback. |
 
 ### About `--allow-unverified`
 
@@ -736,12 +736,15 @@ through ProhostAI's own approval path, not around it via an API key.
 `prohost usage` reports, for every Claude Code and Codex login on this machine,
 how much of its subscription is left (the 5-hour and weekly windows, with their
 reset times) and how many tokens it used per day, model and project folder.
-ProhostAI shows it in the workspace's AI Usage view. No agent pairing needed.
+ProhostAI shows it in the workspace's Usage Monitor app. No agent pairing needed.
 
 ```bash
-# 1. In ProhostAI: Settings → API keys → create a key with the usage:write scope.
-#    (A machine with a paired agent can skip --key: its credential is accepted.)
-npx @prohost/cli usage connect --key <api-key>
+# 1. In ProhostAI: Settings → API keys → create a key with the usage:write scope,
+#    then paste it at the prompt (input is hidden)…
+npx @prohost/cli usage connect
+#    …or pipe it in, so it never lands in your shell history:
+pbpaste | npx @prohost/cli usage connect --key -
+#    (A machine with a paired agent can skip the key: its credential is accepted.)
 
 # 2. Report now, then every 5 minutes, in the foreground…
 npx @prohost/cli usage start
@@ -792,7 +795,7 @@ under the daemon.
 
 | Command | What it does |
 | --- | --- |
-| `usage connect [--key <key>] [--base-url <url>]` | Store the key (`$PROHOST_HOME/usage.json`, `0600`; `$PROHOST_API_KEY` works too), then discover logins. |
+| `usage connect [--key -] [--base-url <url>]` | Store the key (`$PROHOST_HOME/usage.json`, `0600`), then discover logins. The key comes from `--key -` (stdin, or a hidden prompt at a terminal), piped stdin, `$PROHOST_API_KEY`, or a hidden prompt. `--key <value>` still works but warns: it leaves the key in shell history and the process list. `--base-url` must be `https://` (`http://` only for `localhost`, `127.0.0.1`, `[::1]`). |
 | `usage discover [--dry-run]` | Register logins found on this machine. |
 | `usage start [--once] [--machine <name>]` | Report every 5 minutes; `--once` runs one pass and exits. |
 | `usage status` | Connection, daemon, last report and upload, and each login's local totals. |

package/dist/agent/base-url.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Which URLs an API key or pairing code may be sent to.
+ *
+ * `--base-url` points the CLI at another ProhostAI deployment, and every
+ * request to it carries a secret — the pairing code on redeem, the API key on
+ * every call after, on the MCP endpoint, and in the stream's auth frame. So
+ * each of those URLs must be encrypted (`https://`, or `wss://` for the
+ * stream); plain `http://` / `ws://` is allowed only for this machine's
+ * loopback (`localhost`, `127.0.0.1`, `[::1]`), which is what local
+ * development uses.
+ */
+declare const SCHEMES: {
+    readonly http: {
+        readonly secure: "https:";
+        readonly plain: "http:";
+    };
+    readonly ws: {
+        readonly secure: "wss:";
+        readonly plain: "ws:";
+    };
+};
+/**
+ * Why a credential may not be sent to `value`, or `undefined` when it may.
+ * `kind` is `http` for API and MCP URLs, `ws` for the event stream. A whole
+ * sentence, so callers can prefix it with what was being checked.
+ */
+export declare function endpointProblem(value: string, kind?: keyof typeof SCHEMES): string | undefined;
+/** Why `value` cannot be an API base URL (see {@link endpointProblem}). */
+export declare function baseUrlProblem(value: string): string | undefined;
+/** True when an API key may be sent to `value`. */
+export declare function isAllowedBaseUrl(value: string): boolean;
+/**
+ * Why stored agent credentials must not be used, or `undefined` when every URL
+ * the key would go to is safe: the API base, the MCP URL, and `streamUrl` —
+ * the stream URL `agent run` would actually connect to. An `agent.json`
+ * paired over plain http by an older CLI is caught here, before anything is
+ * sent.
+ */
+export declare function storedCredentialsProblem(credentials: {
+    base_url?: string;
+    mcp_url?: string;
+}, streamUrl: string): string | undefined;
+export {};

package/dist/agent/base-url.js

@@ -0,0 +1,72 @@
+/**
+ * Which URLs an API key or pairing code may be sent to.
+ *
+ * `--base-url` points the CLI at another ProhostAI deployment, and every
+ * request to it carries a secret — the pairing code on redeem, the API key on
+ * every call after, on the MCP endpoint, and in the stream's auth frame. So
+ * each of those URLs must be encrypted (`https://`, or `wss://` for the
+ * stream); plain `http://` / `ws://` is allowed only for this machine's
+ * loopback (`localhost`, `127.0.0.1`, `[::1]`), which is what local
+ * development uses.
+ */
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]']);
+const SCHEMES = {
+    http: { secure: 'https:', plain: 'http:' },
+    ws: { secure: 'wss:', plain: 'ws:' },
+};
+/**
+ * Why a credential may not be sent to `value`, or `undefined` when it may.
+ * `kind` is `http` for API and MCP URLs, `ws` for the event stream. A whole
+ * sentence, so callers can prefix it with what was being checked.
+ */
+export function endpointProblem(value, kind = 'http') {
+    const { secure, plain } = SCHEMES[kind];
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        // Not echoed: an unparseable value can still hold a secret.
+        return `It is not a full URL such as ${secure}//connect.prohost.ai.`;
+    }
+    if (parsed.protocol === secure)
+        return undefined;
+    if (parsed.protocol === plain && LOOPBACK_HOSTS.has(parsed.hostname))
+        return undefined;
+    if (parsed.protocol === plain) {
+        return (`${parsed.origin} is not ${secure}//, so the credential would travel in plaintext. ` +
+            `Plain ${plain}// is allowed only for localhost, 127.0.0.1 and [::1].`);
+    }
+    return `${parsed.protocol} URLs are not supported here; use ${secure}//.`;
+}
+/** Why `value` cannot be an API base URL (see {@link endpointProblem}). */
+export function baseUrlProblem(value) {
+    return endpointProblem(value, 'http');
+}
+/** True when an API key may be sent to `value`. */
+export function isAllowedBaseUrl(value) {
+    return baseUrlProblem(value) === undefined;
+}
+/**
+ * Why stored agent credentials must not be used, or `undefined` when every URL
+ * the key would go to is safe: the API base, the MCP URL, and `streamUrl` —
+ * the stream URL `agent run` would actually connect to. An `agent.json`
+ * paired over plain http by an older CLI is caught here, before anything is
+ * sent.
+ */
+export function storedCredentialsProblem(credentials, streamUrl) {
+    const checks = [
+        ['API base URL', credentials.base_url, 'http'],
+        ['MCP URL', credentials.mcp_url, 'http'],
+        ['stream URL', streamUrl, 'ws'],
+    ];
+    for (const [name, url, kind] of checks) {
+        if (!url)
+            continue;
+        const problem = endpointProblem(url, kind);
+        // The URL itself is not echoed: a stored one can carry userinfo or a token.
+        if (problem)
+            return `The stored ${name} is unusable. ${problem}`;
+    }
+    return undefined;
+}

package/dist/agent/command.js

@@ -12,13 +12,15 @@ import { fileURLToPath } from 'node:url';
 import { agentLogPath, buildSystemdUnit, harnessArguments, installLaunchdDaemon, launchdLabel, uninstallLaunchdDaemon, } from './daemon.js';
 import { accountCommand, listCommand, workspaceCommand } from './agent_commands.js';
 import { AccountError, loadAccounts, setAgentAccount } from './accounts.js';
+import { storedCredentialsProblem } from './base-url.js';
 import { acquireRunLock } from './lock.js';
 import { PairError, runPair } from './pair.js';
-import { CredentialsMissingError, ensureWorkspace, loadCredentials, prohostHome, tryLoadCredentials, } from './credentials.js';
+import { CredentialsMissingError, ensureWorkspace, loadCredentials, prohostHome, streamUrlFor, tryLoadCredentials, } from './credentials.js';
 import { DEFAULT_EXEC_TIMEOUT_MS, DEFAULT_IDLE_TIMEOUT_MS, runAgentHarness } from './run.js';
 import { MAX_CONCURRENCY } from './scheduler.js';
 import { ReposFlagError, isCheckout, parseReposFlag } from './worktrees.js';
 import { announceUpgradeIfAvailable } from '../upgrade.js';
+import { DEFAULT_WS_URL } from '../listen.js';
 function flagString(flags, name) {
     const value = flags[name];
     return typeof value === 'string' ? value : undefined;
@@ -227,10 +229,16 @@ export async function runAgent(subcommand, flags, printHelp, args = []) {
     printHelp();
     return 1;
 }
-/** Load credentials, reporting the "you haven't paired" case as an exit code. */
-function loadOrExplain() {
+/**
+ * Load credentials, reporting the "you haven't paired" case as an exit code —
+ * and refusing credentials whose API, MCP or stream URL (`streamOverride`
+ * when given) would carry the key in plaintext, such as an `agent.json`
+ * paired over http by a CLI older than 0.10.1.
+ */
+function loadOrExplain(streamOverride) {
+    let credentials;
     try {
-        return loadCredentials();
+        credentials = loadCredentials();
     }
     catch (err) {
         if (err instanceof CredentialsMissingError) {
@@ -239,6 +247,13 @@ function loadOrExplain() {
         }
         throw err;
     }
+    const problem = storedCredentialsProblem(credentials, streamOverride ?? streamUrlFor(credentials, DEFAULT_WS_URL));
+    if (problem) {
+        process.stderr.write(`✗ Refusing to send the API key: ${problem} Re-pair with an https:// --base-url ` +
+            '(prohost agent pair --code <code>).\n');
+        return null;
+    }
+    return credentials;
 }
 async function installDaemonCommand(flags) {
     const exec = flagString(flags, 'exec');
@@ -246,7 +261,7 @@ async function installDaemonCommand(flags) {
         process.stderr.write("Missing required flag: --exec. Example: prohost agent install-daemon --exec 'claude -p'\n");
         return 1;
     }
-    const credentials = loadOrExplain();
+    const credentials = loadOrExplain(flagString(flags, 'url'));
     if (!credentials)
         return 1;
     if (!applyAccountFlag(flags))
@@ -380,7 +395,7 @@ async function runCommand(flags) {
         process.stderr.write("Missing required flag: --exec. Example: prohost agent run --exec 'claude -p'\n");
         return 1;
     }
-    const credentials = loadOrExplain();
+    const credentials = loadOrExplain(flagString(flags, 'url') ?? process.env.PROHOST_WS_URL);
     if (!credentials)
         return 1;
     const parsedTimeout = parseTimeoutSeconds(flags);

package/dist/agent/credentials.d.ts

@@ -69,6 +69,15 @@ export declare const CREDENTIALS_VERSION = 2;
  * @param fallback Used when neither the stored URL nor ``base_url`` is usable.
  */
 export declare function streamUrlFor(credentials: AgentCredentials, fallback: string): string;
+/**
+ * Turn an API base URL into the websocket URL on the same host.
+ *
+ * Mirrors the server's derivation (`shared/agents/connections.py`
+ * ``pairing_endpoints``): only plain ``http`` maps to ``ws``, so a local dev
+ * base keeps working and nothing else can downgrade a socket that carries an
+ * API key. Returns ``undefined`` for anything not parseable as a URL.
+ */
+export declare function wsUrlFromBaseUrl(baseUrl: string | undefined): string | undefined;
 /** Directory holding CLI state. Overridable with ``$PROHOST_HOME`` for tests. */
 export declare function prohostHome(env?: NodeJS.ProcessEnv): string;
 /** Absolute path of the credential file. */

package/dist/agent/credentials.js

@@ -47,7 +47,7 @@ export function streamUrlFor(credentials, fallback) {
  * base keeps working and nothing else can downgrade a socket that carries an
  * API key. Returns ``undefined`` for anything not parseable as a URL.
  */
-function wsUrlFromBaseUrl(baseUrl) {
+export function wsUrlFromBaseUrl(baseUrl) {
     if (!baseUrl)
         return undefined;
     let parsed;

package/dist/agent/pair.js

@@ -10,8 +10,9 @@
  * specific than "invalid, expired, or already used".
  */
 import { USER_AGENT } from '../version.js';
+import { baseUrlProblem, endpointProblem, isAllowedBaseUrl } from './base-url.js';
 import { DEFAULT_API_BASE_URL, REDEEM_PATH } from './contract.js';
-import { CREDENTIALS_VERSION, clearCredentials, maskSecret, saveCredentials, tryLoadCredentials, } from './credentials.js';
+import { CREDENTIALS_VERSION, clearCredentials, maskSecret, saveCredentials, tryLoadCredentials, wsUrlFromBaseUrl, } from './credentials.js';
 import { DEFAULT_WS_URL } from '../listen.js';
 export class PairError extends Error {
 }
@@ -20,28 +21,34 @@ const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{
 function isUuid(value) {
     return typeof value === 'string' && UUID_PATTERN.test(value);
 }
-/** Derive the API base from the server-reported MCP URL, so the server wins. */
+/**
+ * Derive the API base from the server-reported MCP URL, so the server wins —
+ * unless it is one the API key may not be sent to (see `base-url.ts`).
+ */
 function baseFromMcpUrl(mcpUrl, fallback) {
-    return mcpUrl.endsWith('/mcp') ? mcpUrl.slice(0, -'/mcp'.length) : fallback;
+    const base = mcpUrl.endsWith('/mcp') ? mcpUrl.slice(0, -'/mcp'.length) : '';
+    return base && isAllowedBaseUrl(base) ? base : fallback;
 }
 /**
  * The websocket URL the server told us to use, or ``undefined``.
  *
- * ``undefined`` covers both "this server predates the field" and "the value is
- * not a websocket URL". A cosmetic bad value must not fail a redeem — the code
- * is already spent by the time we read the body — so the caller falls back to
- * {@link DEFAULT_WS_URL} and says so.
+ * ``undefined`` covers "this server predates the field", "the value is not a
+ * websocket URL" and "it is plain ws:// off loopback". A bad value must not
+ * fail a redeem — the code is already spent by the time we read the body — so
+ * the caller falls back to the stream on the stored API base's host and says so.
  */
 function serverWsUrl(value) {
     if (typeof value !== 'string' || value.length === 0)
         return undefined;
-    try {
-        const protocol = new URL(value).protocol;
-        return protocol === 'ws:' || protocol === 'wss:' ? value : undefined;
-    }
-    catch {
-        return undefined;
-    }
+    // `wss://`, or `ws://` on loopback only: the stream's auth frame carries the key.
+    return endpointProblem(value, 'ws') === undefined ? value : undefined;
+}
+/**
+ * The MCP URL to store: the server's, unless the API key may not be sent to
+ * it, in which case the one on the (already validated) API base.
+ */
+function safeMcpUrl(mcpUrl, baseUrl) {
+    return mcpUrl && isAllowedBaseUrl(mcpUrl) ? mcpUrl : `${baseUrl}/mcp`;
 }
 /**
  * Redeem ``code`` and persist the resulting credentials.
@@ -52,6 +59,14 @@ export async function runPair(options) {
     const fetchImpl = options.fetchImpl ?? fetch;
     const onLine = options.onLine ?? ((line) => process.stdout.write(`${line}\n`));
     const baseUrl = (options.baseUrl ?? DEFAULT_API_BASE_URL).replace(/\/+$/, '');
+    // Checked before the code is spent: the code goes to this URL, and the API
+    // key comes back from it.
+    const baseProblem = baseUrlProblem(baseUrl);
+    if (baseProblem)
+        throw new PairError(`--base-url rejected: ${baseProblem}`);
+    const wsProblem = options.wsUrl ? endpointProblem(options.wsUrl, 'ws') : undefined;
+    if (wsProblem)
+        throw new PairError(`--url rejected: ${wsProblem}`);
     if (options.webhookUrl && !options.webhookUrl.startsWith('https://')) {
         throw new PairError('--webhook-url must be an https:// URL');
     }
@@ -136,18 +151,24 @@ export async function runPair(options) {
     //   2. The server's `ws_url`, derived server-side from the same setting as
     //      `mcp_url` (`shared/agents/connections.py::pairing_endpoints`). This is
     //      the normal path, and the reason a host move no longer needs a release.
-    //   3. `DEFAULT_WS_URL`, for a server that predates the field.
+    //   3. No usable `ws_url` (a server that predates the field, or a value that
+    //      is not a websocket URL or is plain ws:// off loopback): the stream on
+    //      the stored API base's host, as the server derives it — never another
+    //      deployment's, which would get this key. For the default base that is
+    //      `DEFAULT_WS_URL`, which is also the last resort.
+    const storedBase = baseFromMcpUrl(body.mcp_url ?? '', baseUrl);
     const fromServer = serverWsUrl(body.ws_url);
-    const wsUrl = options.wsUrl ?? fromServer ?? DEFAULT_WS_URL;
+    const fallbackWsUrl = wsUrlFromBaseUrl(storedBase) ?? DEFAULT_WS_URL;
+    const wsUrl = options.wsUrl ?? fromServer ?? fallbackWsUrl;
     const credentials = {
         version: CREDENTIALS_VERSION,
-        base_url: baseFromMcpUrl(body.mcp_url ?? '', baseUrl),
+        base_url: storedBase,
         ws_url: wsUrl,
         api_key: body.api_key,
         webhook_secret: body.webhook_secret ?? null,
         subscription_id: body.subscription_id ?? null,
         stream_only: body.stream_only,
-        mcp_url: body.mcp_url,
+        mcp_url: safeMcpUrl(body.mcp_url, storedBase),
         events: body.events ?? [],
         agent: body.agent,
         paired_at: new Date().toISOString(),
@@ -156,7 +177,7 @@ export async function runPair(options) {
     onLine(`✓ Paired as "${body.agent.name}" (agent ${body.agent.id})`);
     onLine(`  API key      ${maskSecret(body.api_key)}  (stored, never printed in full)`);
     onLine(`  Credentials  ${file}  (chmod 600)`);
-    onLine(`  MCP URL      ${body.mcp_url}`);
+    onLine(`  MCP URL      ${credentials.mcp_url}`);
     // Printed because 0.1.0's wrong websocket host was invisible here: pairing
     // reported success and the mismatch only surfaced as a 403 reconnect loop in
     // a different command. Showing it makes a bad host obvious at pair time.
@@ -171,7 +192,7 @@ export async function runPair(options) {
         // answer either.
         onLine('');
         onLine(`  ! The server reported an unusable stream URL (${JSON.stringify(body.ws_url)}).`);
-        onLine(`    Using ${DEFAULT_WS_URL} instead — override with --url if that is wrong.`);
+        onLine(`    Using ${fallbackWsUrl} instead — override with --url if that is wrong.`);
     }
     if (!credentials.webhook_secret) {
         // Without a secret the runner can't prove an event came from ProhostAI,

package/dist/index.js

@@ -16,6 +16,7 @@
 import { realpathSync } from 'node:fs';
 import process from 'node:process';
 import { fileURLToPath } from 'node:url';
+import { endpointProblem } from './agent/base-url.js';
 import { runAgent } from './agent/command.js';
 import { DEFAULT_WS_URL, runListen } from './listen.js';
 import { runUsage } from './usage/command.js';
@@ -35,7 +36,7 @@ function printHelp() {
         '  prohost agent account list | remove <label>',
         '  prohost agent list                   Every paired agent on this machine, and its accounts',
         '  prohost agent workspace init --developer --repo <checkout> [--workdir <dir>]',
-        '  prohost usage connect [--key <api-key>] [--base-url <url>]   Report AI usage without pairing an agent',
+        '  prohost usage connect [--key -] [--base-url <url>]   Report AI usage without pairing an agent (prompts for the key; --key - reads it from stdin)',
         '  prohost usage discover [--dry-run] | start [--once] [--machine <name>] | status',
         '  prohost usage install-daemon [--machine <name>] | uninstall-daemon',
         '',
@@ -49,7 +50,7 @@ function printHelp() {
         'agent pair flags:',
         '  --code           One-time pairing code from the hire modal. Defaults to $PROHOST_PAIRING_CODE.',
         '  --webhook-url    Also push events to this HTTPS endpoint. Omit it: stream-only is the normal setup.',
-        '  --base-url       Public API base. Defaults to https://connect.prohost.ai.',
+        '  --base-url       Public API base. Defaults to https://connect.prohost.ai. Must be https:// (http:// only for localhost).',
         '',
         'agent run flags:',
         '  --exec           Command to run for each mention; the prompt arrives on stdin (required)',
@@ -162,7 +163,8 @@ export function parseArgs(argv) {
             i += 1;
             continue;
         }
-        if (next === undefined || next.startsWith('-')) {
+        // A bare `-` is a value ("read it from stdin", as in `--key -`), not a flag.
+        if (next === undefined || (next.startsWith('-') && next !== '-')) {
             flags[key] = true;
             i += 1;
         }
@@ -218,6 +220,12 @@ async function main(argv) {
     const url = (typeof flags['url'] === 'string' ? flags['url'] : undefined) ??
         process.env.PROHOST_WS_URL ??
         DEFAULT_WS_URL;
+    // The auth frame carries the API key: wss://, or ws:// on loopback only.
+    const urlProblem = endpointProblem(url, 'ws');
+    if (urlProblem) {
+        process.stderr.write(`✗ --url rejected: ${urlProblem}\n`);
+        return 1;
+    }
     const machine = typeof flags['machine'] === 'string' ? flags['machine'] : undefined;
     const subscriptionId = typeof flags['subscription-id'] === 'string' ? flags['subscription-id'] : undefined;
     const controller = new AbortController();

package/dist/usage/command.d.ts

@@ -6,11 +6,14 @@
  * `scanner.ts` and `service.ts`.
  */
 import type { DiscoveryResult } from './discovery.js';
+import type { KeyStdin } from './key-input.js';
 type Flags = Record<string, string | boolean>;
 export interface UsageIO {
     out: (line: string) => void;
     err: (line: string) => void;
     env?: NodeJS.ProcessEnv;
+    /** Where `connect` reads a key from (`--key -`, a pipe, or a hidden prompt). Defaults to `process.stdin`. */
+    stdin?: KeyStdin;
 }
 /** launchd label prefix for the usage reporter — distinct from the agent daemon's. */
 export declare const USAGE_LAUNCHD_PREFIX = "ai.prohost.usage";

package/dist/usage/command.js

@@ -11,12 +11,14 @@ import process from 'node:process';
 import { existsSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { DEFAULT_ACCOUNT_LABEL, loadAccounts, runtimeName } from '../agent/accounts.js';
+import { baseUrlProblem } from '../agent/base-url.js';
 import { daemonEnvironment } from '../agent/command.js';
 import { maskSecret, prohostHome } from '../agent/credentials.js';
 import { buildSystemdUnit, installLaunchdDaemon, launchdLabel, launchdPlistPath, uninstallLaunchdDaemon, } from '../agent/daemon.js';
 import { acquireRunLock } from '../agent/lock.js';
 import { ensurePrivateDir, resolveUsageKey, saveUsageCredentials, usageStateDir } from './config.js';
 import { accountConfigDir, discoverAccounts } from './discovery.js';
+import { PipedKeyTooLongError, promptHiddenKey, readPipedKey } from './key-input.js';
 import { RETENTION_DAYS, dayKey, loadScanState, localTotals, pendingDays } from './scanner.js';
 import { UsageService, loadStatus, runUsageLoop, scanStatePath } from './service.js';
 const defaultIO = {
@@ -83,21 +85,77 @@ export function renderDiscovery(result, env, dryRun) {
         lines.push(row('!', s.label, s.runtime, s.dir, `skipped: ${s.reason}`));
     return lines;
 }
+/**
+ * The key `connect` should store, in order: `--key -` (stdin, or a hidden
+ * prompt at a terminal), a literal `--key <value>` (warned about), then
+ * `$PROHOST_API_KEY`, then piped stdin, then — at a terminal, with no
+ * credential to fall back on — a hidden prompt. `undefined` means "none given";
+ * `null` means a usage error that has already been printed.
+ */
+async function connectKey(flags, io, env) {
+    const stdin = io.stdin ?? process.stdin;
+    const prompt = () => promptHiddenKey(stdin, (text) => process.stderr.write(text));
+    const literal = flagString(flags, 'key');
+    if (literal === '-') {
+        const key = stdin.isTTY ? await prompt() : await readPipedKey(stdin);
+        if (!key)
+            io.err('✗ --key - got no key. Pipe one in (pbpaste | prohost usage connect --key -) or type it at the prompt.');
+        return key ?? null;
+    }
+    if (literal) {
+        io.err('! --key <value> leaves the key in your shell history and the process list. ' +
+            'Next time pipe it instead: pbpaste | prohost usage connect --key -');
+        return literal.trim();
+    }
+    if (env.PROHOST_API_KEY)
+        return env.PROHOST_API_KEY.trim();
+    if (!stdin.isTTY)
+        return readPipedKey(stdin);
+    // At a terminal: prompt only when there is nothing to fall back on, so a
+    // connected machine (or one with a paired agent) is not asked again.
+    if (resolveUsageKey(env))
+        return undefined;
+    return prompt();
+}
 async function connectCommand(flags, io) {
     const env = io.env ?? process.env;
     if (flags.key === true) {
-        io.err('--key needs a value. Create a key with the usage:write scope in ProhostAI → Settings → API keys.');
+        io.err('--key needs a value. Use --key - to read it from stdin (pbpaste | prohost usage connect --key -), ' +
+            'or leave --key off to be prompted. Create a key with the usage:write scope in ProhostAI → Settings → API keys.');
+        return 1;
+    }
+    if (flags['base-url'] === true) {
+        io.err('--base-url needs a value, e.g. --base-url https://connect.prohost.ai');
+        return 1;
+    }
+    // Checked before any key is read or stored: the key goes to this URL.
+    const baseUrl = flagString(flags, 'base-url');
+    const problem = baseUrl ? baseUrlProblem(baseUrl) : undefined;
+    if (problem) {
+        io.err(`✗ --base-url rejected: ${problem}`);
+        return 1;
+    }
+    let key;
+    try {
+        key = await connectKey(flags, io, env);
+    }
+    catch (err) {
+        if (!(err instanceof PipedKeyTooLongError))
+            throw err;
+        io.err('✗ The piped input is not an API key (no line ended within 4096 characters). Nothing was saved.');
         return 1;
     }
-    const key = flagString(flags, 'key') ?? env.PROHOST_API_KEY;
+    if (key === null)
+        return 1;
     if (key) {
-        const file = saveUsageCredentials({ apiKey: key.trim(), baseUrl: flagString(flags, 'base-url') }, env);
-        io.out(`✓ Saved key ${maskSecret(key.trim())} to ${file} (owner-only).`);
+        const file = saveUsageCredentials({ apiKey: key, baseUrl }, env);
+        io.out(`✓ Saved key ${maskSecret(key)} to ${file} (owner-only).`);
     }
     else {
         const existing = resolveUsageKey(env);
         if (!existing) {
-            io.err('✗ No API key. Pass --key <key> (scope usage:write) or set $PROHOST_API_KEY. ' +
+            io.err('✗ No API key. Run prohost usage connect at a terminal to be prompted, pipe one in with --key -, ' +
+                'or set $PROHOST_API_KEY (scope usage:write). ' +
                 'A machine with a paired agent can skip this — its credential is used.');
             return 1;
         }
@@ -112,6 +170,26 @@ async function connectCommand(flags, io) {
     io.out('Report now and every 5 minutes: prohost usage start   (or keep it running: prohost usage install-daemon)');
     return 0;
 }
+/**
+ * The stored key, when it can be sent: present, and its base URL is https://
+ * (or loopback http://). Prints why not and returns `null` otherwise.
+ */
+function usableKey(env, io) {
+    const key = resolveUsageKey(env);
+    if (!key) {
+        io.err('✗ Not connected. Run: prohost usage connect');
+        return null;
+    }
+    const problem = baseUrlProblem(key.baseUrl);
+    if (problem) {
+        io.err(`✗ Refusing to send the API key: the stored API base URL is unusable. ${problem} ` +
+            (key.source === 'agent'
+                ? 'Re-pair the agent with an https:// --base-url.'
+                : 'Reconnect: prohost usage connect --key - --base-url https://…'));
+        return null;
+    }
+    return key;
+}
 function discoverCommand(flags, io) {
     const env = io.env ?? process.env;
     const dryRun = flags['dry-run'] === true;
@@ -121,10 +199,8 @@ function discoverCommand(flags, io) {
 }
 async function startCommand(flags, io) {
     const env = io.env ?? process.env;
-    if (!resolveUsageKey(env)) {
-        io.err('✗ Not connected. Run: prohost usage connect --key <api key>');
+    if (!usableKey(env, io))
         return 1;
-    }
     // Its own lock, under $PROHOST_HOME/usage — `agent run` holds the home's.
     const stateDir = ensurePrivateDir(usageStateDir(env));
     const lock = acquireRunLock({ ...env, PROHOST_HOME: stateDir });
@@ -163,10 +239,8 @@ function cliEntrypoint() {
 }
 function installCommand(flags, io) {
     const env = io.env ?? process.env;
-    if (!resolveUsageKey(env)) {
-        io.err('✗ Not connected. Run: prohost usage connect --key <api key>');
+    if (!usableKey(env, io))
         return 1;
-    }
     const workdir = ensurePrivateDir(usageStateDir(env));
     const spec = {
         label: usageLaunchdLabel(prohostHome(env)),
@@ -233,8 +307,9 @@ function statusCommand(io) {
     const env = io.env ?? process.env;
     const key = resolveUsageKey(env);
     io.out(key
-        ? `Connected   ${maskSecret(key.apiKey)} → ${key.baseUrl}${key.source === 'agent' ? '  (paired agent credential)' : ''}`
-        : 'Connected   no — run: prohost usage connect --key <api key>');
+        ? `Connected   ${maskSecret(key.apiKey)} → ${key.baseUrl}${key.source === 'agent' ? '  (paired agent credential)' : ''}` +
+            `${baseUrlProblem(key.baseUrl) ? '  (not https:// — nothing is sent)' : ''}`
+        : 'Connected   no — run: prohost usage connect');
     const plist = launchdPlistPath(usageLaunchdLabel(prohostHome(env)));
     io.out(`Daemon      ${os.platform() === 'darwin' ? (existsSync(plist) ? `installed (${tildify(plist, env)})` : 'not installed') : 'see systemd'}`);
     const status = loadStatus(env);

package/dist/usage/key-input.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Reading an API key for `prohost usage connect` without putting it on the
+ * command line, where it would land in shell history and the process list.
+ *
+ * Two safe paths: piped stdin (`pbpaste | prohost usage connect --key -`) and,
+ * at a terminal, a prompt that does not echo what is typed or pasted.
+ */
+/** The slice of `process.stdin` this module uses, so tests can pass a stream. */
+export interface KeyStdin extends AsyncIterable<string | Buffer> {
+    isTTY?: boolean;
+    setRawMode?(mode: boolean): unknown;
+    setEncoding(encoding: BufferEncoding): unknown;
+    on(event: 'data', listener: (chunk: string | Buffer) => void): unknown;
+    removeListener(event: 'data', listener: (chunk: string | Buffer) => void): unknown;
+    resume(): unknown;
+    pause(): unknown;
+}
+/** Longer than any ProhostAI key; a pipe that runs past it is not a key. */
+export declare const MAX_PIPED_KEY_CHARS = 4096;
+export declare class PipedKeyTooLongError extends Error {
+}
+/**
+ * The first non-empty line of piped stdin, trimmed; `undefined` when there is
+ * none. Returns as soon as that line ends, so a producer that keeps the pipe
+ * open does not hang `connect`, and stops reading past
+ * {@link MAX_PIPED_KEY_CHARS}.
+ *
+ * @throws PipedKeyTooLongError when no line ends within the limit.
+ */
+export declare function readPipedKey(stdin: KeyStdin): Promise<string | undefined>;
+/**
+ * Prompt for a key at a terminal without echoing it. Resolves with the
+ * trimmed key, or `undefined` when nothing was entered or the user pressed
+ * Ctrl-C. The prompt goes to `write` (stderr), keeping stdout clean.
+ */
+export declare function promptHiddenKey(stdin: KeyStdin, write: (text: string) => void, prompt?: string): Promise<string | undefined>;

package/dist/usage/key-input.js

@@ -0,0 +1,79 @@
+/**
+ * Reading an API key for `prohost usage connect` without putting it on the
+ * command line, where it would land in shell history and the process list.
+ *
+ * Two safe paths: piped stdin (`pbpaste | prohost usage connect --key -`) and,
+ * at a terminal, a prompt that does not echo what is typed or pasted.
+ */
+/** Longer than any ProhostAI key; a pipe that runs past it is not a key. */
+export const MAX_PIPED_KEY_CHARS = 4096;
+export class PipedKeyTooLongError extends Error {
+}
+/**
+ * The first non-empty line of piped stdin, trimmed; `undefined` when there is
+ * none. Returns as soon as that line ends, so a producer that keeps the pipe
+ * open does not hang `connect`, and stops reading past
+ * {@link MAX_PIPED_KEY_CHARS}.
+ *
+ * @throws PipedKeyTooLongError when no line ends within the limit.
+ */
+export async function readPipedKey(stdin) {
+    let pending = '';
+    for await (const chunk of stdin) {
+        pending += typeof chunk === 'string' ? chunk : chunk.toString('utf8');
+        let newline = pending.search(/\r?\n/);
+        while (newline !== -1) {
+            // Measured before trimming: padding counts toward the bound too.
+            const raw = pending.slice(0, newline);
+            if (raw.length > MAX_PIPED_KEY_CHARS)
+                throw new PipedKeyTooLongError('piped input is not a key');
+            const line = raw.trim();
+            if (line)
+                return line;
+            pending = pending.slice(newline).replace(/^\r?\n/, '');
+            newline = pending.search(/\r?\n/);
+        }
+        if (pending.length > MAX_PIPED_KEY_CHARS)
+            throw new PipedKeyTooLongError('piped input is not a key');
+    }
+    if (pending.length > MAX_PIPED_KEY_CHARS)
+        throw new PipedKeyTooLongError('piped input is not a key');
+    return pending.trim() || undefined;
+}
+const ENTER = new Set(['\r', '\n', '\u0004']); // Return, or Ctrl-D
+const CTRL_C = '\u0003';
+const BACKSPACE = new Set(['\u007f', '\b']);
+/**
+ * Prompt for a key at a terminal without echoing it. Resolves with the
+ * trimmed key, or `undefined` when nothing was entered or the user pressed
+ * Ctrl-C. The prompt goes to `write` (stderr), keeping stdout clean.
+ */
+export function promptHiddenKey(stdin, write, prompt = 'API key (usage:write scope; input hidden): ') {
+    return new Promise((resolve) => {
+        let value = '';
+        const finish = (result) => {
+            stdin.removeListener('data', onData);
+            stdin.setRawMode?.(false);
+            stdin.pause();
+            write('\n');
+            resolve(result);
+        };
+        const onData = (chunk) => {
+            for (const ch of typeof chunk === 'string' ? chunk : chunk.toString('utf8')) {
+                if (ENTER.has(ch))
+                    return finish(value.trim() || undefined);
+                if (ch === CTRL_C)
+                    return finish(undefined);
+                if (BACKSPACE.has(ch))
+                    value = value.slice(0, -1);
+                else if (ch >= ' ')
+                    value += ch;
+            }
+        };
+        write(prompt);
+        stdin.setRawMode?.(true);
+        stdin.setEncoding('utf8');
+        stdin.on('data', onData);
+        stdin.resume();
+    });
+}

package/dist/usage/service.d.ts

@@ -71,7 +71,7 @@ export interface UsageServiceOptions {
 export interface TickResult {
     reported: boolean;
     uploadedRows: number;
-    skipped?: 'no_key' | 'no_machine_id';
+    skipped?: 'no_key' | 'insecure_base_url' | 'no_machine_id';
 }
 /** One process's reporter. Holds the backoff state and the scan cursor in memory. */
 export declare class UsageService {

package/dist/usage/service.js

@@ -12,6 +12,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { loadAccounts, machineId as machineIdFor } from '../agent/accounts.js';
 import { postJson } from '../agent/api.js';
+import { baseUrlProblem } from '../agent/base-url.js';
 import { Backoff } from './backoff.js';
 import { resolveUsageKey, usageStateDir, writePrivateFile } from './config.js';
 import { accountConfigDir } from './discovery.js';
@@ -115,10 +116,17 @@ export class UsageService {
         try {
             const key = resolveUsageKey(this.env);
             if (!key) {
-                this.warnOnce('no_key', 'Not connected — run `prohost usage connect --key <api key>`. Checking again each tick.');
+                this.warnOnce('no_key', 'Not connected — run `prohost usage connect`. Checking again each tick.');
                 return { ...result, skipped: 'no_key' };
             }
             this.warned.delete('no_key');
+            // The key travels to this URL; a stored http:// one would send it in plaintext.
+            const problem = baseUrlProblem(key.baseUrl);
+            if (problem) {
+                this.warnOnce('insecure_base_url', `Not sending: the stored API base URL is unusable. ${problem}`);
+                return { ...result, skipped: 'insecure_base_url' };
+            }
+            this.warned.delete('insecure_base_url');
             const machineId = machineIdFor(this.env);
             if (!machineId) {
                 this.warnOnce('no_machine_id', 'Could not create this machine\'s id in the accounts root; nothing can be reported.');

package/dist/version.d.ts

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export declare const CLI_VERSION = "0.10.0";
+export declare const CLI_VERSION = "0.10.1";
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
-export declare const USER_AGENT = "prohost-cli/0.10.0";
+export declare const USER_AGENT = "prohost-cli/0.10.1";

package/dist/version.js

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export const CLI_VERSION = '0.10.0';
+export const CLI_VERSION = '0.10.1';
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
 export const USER_AGENT = `prohost-cli/${CLI_VERSION}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prohost/cli",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "description": "Run your own AI agent as a ProhostAI teammate, and stream your account's webhooks to your laptop.",
   "type": "module",
   "license": "MIT",