@prohost/cli 0.10.0 → 0.10.2

package/CHANGELOG.md

@@ -4,6 +4,54 @@ Versions follow [semver](https://semver.org/). Publishing is automated: merging
 a version bump to `main` triggers `.github/workflows/npm-publish-cli.yml`, which
 builds via `prepack`, runs the suite, publishes, and tags `cli-v<version>`.
 
+## 0.10.2
+
+Token totals are attributed to the repository, not the directory a session ran in.
+
+- **Projects are repositories.** A session in a git worktree
+  (`.worktrees/backend-service/fix-something`, `.claude/worktrees/agent-…`) or
+  a subdirectory (`iosApp`, `Sources`) now counts toward its repository
+  (`backend-service`, `mobile`) in "By project". The repository is found from
+  the `.git` the directory sits under — a worktree's `gitdir` / `commondir`
+  lead back to the main repository — with no `git` process per line, and
+  cached per directory. A worktree that has since been removed is recognised by
+  its `…/.worktrees/<repo>/<name>` or `…/<repo>/.claude/worktrees/<name>`
+  path; anything else keeps its basename.
+- **Days are replaced whole.** Each upload now names the (day, account) pairs
+  it carries in full (`completeDays`), and the server deletes that day's other
+  rows for the account, so a renamed project never counts twice.
+- **The upgrade re-reads the last 30 days.** The local scan state is rebuilt
+  once with the new attribution and every day re-sent whole, which replaces
+  the old per-worktree rows. Those days wait until the server confirms it
+  replaces a day whole (an empty upload answered with `replacedDays`, asked at
+  most hourly), so an older server never counts them twice. A day that reads
+  back smaller than first counted (a log removed or rewritten since) is left
+  as it is on the server: per-folder, but with the right total.
+
+## 0.10.1
+
+Safer key handling for `prohost usage connect`, and no credential ever goes to
+a plain-http API base.
+
+- **`usage connect` reads the key without exposing it.** It prompts with echo
+  off at a terminal, reads piped stdin (`pbpaste | prohost usage connect --key -`),
+  or takes `$PROHOST_API_KEY`. `--key <value>` still works but prints a warning:
+  it leaves the key in shell history and the process list. A connected machine
+  (or one with a paired agent) is not prompted again.
+- **`--base-url` must be `https://`.** `usage connect --base-url` and
+  `agent pair --base-url` reject anything else before a key is stored or a
+  pairing code is spent; `http://` is allowed only for `localhost`, `127.0.0.1`
+  and `[::1]`. `usage start`, `install-daemon` and every reporter tick refuse to
+  send a key to a stored base URL that fails the same check, and `usage status`
+  flags it. A pairing whose server reports a plain-http `mcp_url` or plain-ws
+  `ws_url` keeps the requested base, `<base>/mcp` and the default stream URL
+  instead, and `agent pair --url` / `listen --url` must be `wss://` (`ws://`
+  only on loopback).
+- **`agent run` and `agent install-daemon` refuse insecure stored credentials.**
+  An `agent.json` whose API base, MCP URL or stream URL would carry the key in
+  plaintext (paired over http by an older CLI) is refused with a re-pair hint,
+  before anything is sent.
+
 ## 0.10.0
 
 Every Claude Code and Codex login on a machine can report its remaining

package/README.md

@@ -24,8 +24,9 @@ npx @prohost/cli --version    # the version you're running
 Pair once, then leave the agent running:
 
 ```bash
-# 1. In ProhostAI: Hire an AI employee → Bring your own agent → copy the code.
-#    Codes are single-use and expire 15 minutes after they're generated.
+# 1. In ProhostAI: AI Employees → Computers → Pair a computer. It shows this
+#    command with your code filled in. Codes are single-use and expire 15
+#    minutes after they're generated.
 npx @prohost/cli agent pair --code <pairing-code>
 
 # 2. Point it at whatever agent you already use.
@@ -48,8 +49,9 @@ doesn't know or care which one it is.
 
 ### 1. Get a pairing code
 
-In ProhostAI: **Hire an AI employee → Bring your own agent**. You'll get a
-one-time code. It is single-use and expires 15 minutes after it's generated.
+In ProhostAI: **AI Employees → Computers → Pair a computer**. You'll get a
+one-time code, already filled into the command it shows you. It is single-use
+and expires 15 minutes after it's generated.
 
 ### 2. Pair
 
@@ -682,7 +684,7 @@ decision to make.
 | `--code` | `$PROHOST_PAIRING_CODE` | The one-time pairing code. |
 | `--account` | the home's current account, else `default` | Which Claude Code / Codex login this agent runs on (see Accounts). |
 | `--webhook-url` | none | Also push events to this HTTPS endpoint. Omit for stream-only, which is the normal laptop setup. |
-| `--base-url` | `https://connect.prohost.ai` | Public API base. |
+| `--base-url` | `https://connect.prohost.ai` | Public API base. Must be `https://`; `http://` only for `localhost`, `127.0.0.1` and `[::1]`. `agent run` refuses an `agent.json` whose API, MCP or stream URL is plain http/ws off loopback. |
 
 ### About `--allow-unverified`
 
@@ -735,13 +737,16 @@ through ProhostAI's own approval path, not around it via an API key.
 
 `prohost usage` reports, for every Claude Code and Codex login on this machine,
 how much of its subscription is left (the 5-hour and weekly windows, with their
-reset times) and how many tokens it used per day, model and project folder.
-ProhostAI shows it in the workspace's AI Usage view. No agent pairing needed.
+reset times) and how many tokens it used per day, model and project (repository).
+ProhostAI shows it in the workspace's Usage Monitor app. No agent pairing needed.
 
 ```bash
-# 1. In ProhostAI: Settings → API keys → create a key with the usage:write scope.
-#    (A machine with a paired agent can skip --key: its credential is accepted.)
-npx @prohost/cli usage connect --key <api-key>
+# 1. In ProhostAI: Settings → API keys → create a key with the usage:write scope,
+#    then paste it at the prompt (input is hidden)…
+npx @prohost/cli usage connect
+#    …or pipe it in, so it never lands in your shell history:
+pbpaste | npx @prohost/cli usage connect --key -
+#    (A machine with a paired agent can skip the key: its credential is accepted.)
 
 # 2. Report now, then every 5 minutes, in the foreground…
 npx @prohost/cli usage start
@@ -770,11 +775,17 @@ spends a model turn. Sign-in state comes from `claude auth status` /
 **Tokens.** Read from the session logs the CLIs already write —
 `<config dir>/projects/**/*.jsonl` for Claude Code, `sessions/**/rollout-*.jsonl`
 for Codex — and summed per local day, login, model and project, where the
-project is the **name** of the working directory (`backend-service`, never its
-path). Only usage counters are read: no prompt, reply, tool call or file content
-is kept or sent. The first run looks back 30 days; after that only what was
-appended is read, using a cursor in `$PROHOST_HOME/usage/`. A day that changes
-is re-sent whole, and the server replaces it.
+project is the **name** of the repository the working directory belongs to
+(`backend-service`, never its path). A git worktree or a subdirectory counts as
+its main repository: `.worktrees/backend-service/fix-x` and
+`backend-service/web/src` are both `backend-service`. A directory outside any
+repository is its own name; a removed worktree is recognised by its
+`…/.worktrees/<repo>/<name>` or `…/<repo>/.claude/worktrees/<name>` path. Only
+usage counters are read: no prompt, reply, tool call or file content is kept or
+sent. The first run looks back 30 days; after that only what was appended is
+read, using a cursor in `$PROHOST_HOME/usage/`. A day that changes is re-sent
+whole, marked complete, and the server replaces that day's rows for the login —
+including deleting any project the day no longer has.
 Totals for a login go only after the server has accepted a capacity report
 for it (the server ignores totals for logins it hasn't seen), so each pass
 reports first. When the server says why it skipped a login's rows, the reason
@@ -792,7 +803,7 @@ under the daemon.
 
 | Command | What it does |
 | --- | --- |
-| `usage connect [--key <key>] [--base-url <url>]` | Store the key (`$PROHOST_HOME/usage.json`, `0600`; `$PROHOST_API_KEY` works too), then discover logins. |
+| `usage connect [--key -] [--base-url <url>]` | Store the key (`$PROHOST_HOME/usage.json`, `0600`), then discover logins. The key comes from `--key -` (stdin, or a hidden prompt at a terminal), piped stdin, `$PROHOST_API_KEY`, or a hidden prompt. `--key <value>` still works but warns: it leaves the key in shell history and the process list. `--base-url` must be `https://` (`http://` only for `localhost`, `127.0.0.1`, `[::1]`). |
 | `usage discover [--dry-run]` | Register logins found on this machine. |
 | `usage start [--once] [--machine <name>]` | Report every 5 minutes; `--once` runs one pass and exits. |
 | `usage status` | Connection, daemon, last report and upload, and each login's local totals. |

package/dist/agent/base-url.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Which URLs an API key or pairing code may be sent to.
+ *
+ * `--base-url` points the CLI at another ProhostAI deployment, and every
+ * request to it carries a secret — the pairing code on redeem, the API key on
+ * every call after, on the MCP endpoint, and in the stream's auth frame. So
+ * each of those URLs must be encrypted (`https://`, or `wss://` for the
+ * stream); plain `http://` / `ws://` is allowed only for this machine's
+ * loopback (`localhost`, `127.0.0.1`, `[::1]`), which is what local
+ * development uses.
+ */
+declare const SCHEMES: {
+    readonly http: {
+        readonly secure: "https:";
+        readonly plain: "http:";
+    };
+    readonly ws: {
+        readonly secure: "wss:";
+        readonly plain: "ws:";
+    };
+};
+/**
+ * Why a credential may not be sent to `value`, or `undefined` when it may.
+ * `kind` is `http` for API and MCP URLs, `ws` for the event stream. A whole
+ * sentence, so callers can prefix it with what was being checked.
+ */
+export declare function endpointProblem(value: string, kind?: keyof typeof SCHEMES): string | undefined;
+/** Why `value` cannot be an API base URL (see {@link endpointProblem}). */
+export declare function baseUrlProblem(value: string): string | undefined;
+/** True when an API key may be sent to `value`. */
+export declare function isAllowedBaseUrl(value: string): boolean;
+/**
+ * Why stored agent credentials must not be used, or `undefined` when every URL
+ * the key would go to is safe: the API base, the MCP URL, and `streamUrl` —
+ * the stream URL `agent run` would actually connect to. An `agent.json`
+ * paired over plain http by an older CLI is caught here, before anything is
+ * sent.
+ */
+export declare function storedCredentialsProblem(credentials: {
+    base_url?: string;
+    mcp_url?: string;
+}, streamUrl: string): string | undefined;
+export {};

package/dist/agent/base-url.js

@@ -0,0 +1,72 @@
+/**
+ * Which URLs an API key or pairing code may be sent to.
+ *
+ * `--base-url` points the CLI at another ProhostAI deployment, and every
+ * request to it carries a secret — the pairing code on redeem, the API key on
+ * every call after, on the MCP endpoint, and in the stream's auth frame. So
+ * each of those URLs must be encrypted (`https://`, or `wss://` for the
+ * stream); plain `http://` / `ws://` is allowed only for this machine's
+ * loopback (`localhost`, `127.0.0.1`, `[::1]`), which is what local
+ * development uses.
+ */
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]']);
+const SCHEMES = {
+    http: { secure: 'https:', plain: 'http:' },
+    ws: { secure: 'wss:', plain: 'ws:' },
+};
+/**
+ * Why a credential may not be sent to `value`, or `undefined` when it may.
+ * `kind` is `http` for API and MCP URLs, `ws` for the event stream. A whole
+ * sentence, so callers can prefix it with what was being checked.
+ */
+export function endpointProblem(value, kind = 'http') {
+    const { secure, plain } = SCHEMES[kind];
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        // Not echoed: an unparseable value can still hold a secret.
+        return `It is not a full URL such as ${secure}//connect.prohost.ai.`;
+    }
+    if (parsed.protocol === secure)
+        return undefined;
+    if (parsed.protocol === plain && LOOPBACK_HOSTS.has(parsed.hostname))
+        return undefined;
+    if (parsed.protocol === plain) {
+        return (`${parsed.origin} is not ${secure}//, so the credential would travel in plaintext. ` +
+            `Plain ${plain}// is allowed only for localhost, 127.0.0.1 and [::1].`);
+    }
+    return `${parsed.protocol} URLs are not supported here; use ${secure}//.`;
+}
+/** Why `value` cannot be an API base URL (see {@link endpointProblem}). */
+export function baseUrlProblem(value) {
+    return endpointProblem(value, 'http');
+}
+/** True when an API key may be sent to `value`. */
+export function isAllowedBaseUrl(value) {
+    return baseUrlProblem(value) === undefined;
+}
+/**
+ * Why stored agent credentials must not be used, or `undefined` when every URL
+ * the key would go to is safe: the API base, the MCP URL, and `streamUrl` —
+ * the stream URL `agent run` would actually connect to. An `agent.json`
+ * paired over plain http by an older CLI is caught here, before anything is
+ * sent.
+ */
+export function storedCredentialsProblem(credentials, streamUrl) {
+    const checks = [
+        ['API base URL', credentials.base_url, 'http'],
+        ['MCP URL', credentials.mcp_url, 'http'],
+        ['stream URL', streamUrl, 'ws'],
+    ];
+    for (const [name, url, kind] of checks) {
+        if (!url)
+            continue;
+        const problem = endpointProblem(url, kind);
+        // The URL itself is not echoed: a stored one can carry userinfo or a token.
+        if (problem)
+            return `The stored ${name} is unusable. ${problem}`;
+    }
+    return undefined;
+}

package/dist/agent/command.js

@@ -12,13 +12,15 @@ import { fileURLToPath } from 'node:url';
 import { agentLogPath, buildSystemdUnit, harnessArguments, installLaunchdDaemon, launchdLabel, uninstallLaunchdDaemon, } from './daemon.js';
 import { accountCommand, listCommand, workspaceCommand } from './agent_commands.js';
 import { AccountError, loadAccounts, setAgentAccount } from './accounts.js';
+import { storedCredentialsProblem } from './base-url.js';
 import { acquireRunLock } from './lock.js';
 import { PairError, runPair } from './pair.js';
-import { CredentialsMissingError, ensureWorkspace, loadCredentials, prohostHome, tryLoadCredentials, } from './credentials.js';
+import { CredentialsMissingError, ensureWorkspace, loadCredentials, prohostHome, streamUrlFor, tryLoadCredentials, } from './credentials.js';
 import { DEFAULT_EXEC_TIMEOUT_MS, DEFAULT_IDLE_TIMEOUT_MS, runAgentHarness } from './run.js';
 import { MAX_CONCURRENCY } from './scheduler.js';
 import { ReposFlagError, isCheckout, parseReposFlag } from './worktrees.js';
 import { announceUpgradeIfAvailable } from '../upgrade.js';
+import { DEFAULT_WS_URL } from '../listen.js';
 function flagString(flags, name) {
     const value = flags[name];
     return typeof value === 'string' ? value : undefined;
@@ -227,10 +229,16 @@ export async function runAgent(subcommand, flags, printHelp, args = []) {
     printHelp();
     return 1;
 }
-/** Load credentials, reporting the "you haven't paired" case as an exit code. */
-function loadOrExplain() {
+/**
+ * Load credentials, reporting the "you haven't paired" case as an exit code —
+ * and refusing credentials whose API, MCP or stream URL (`streamOverride`
+ * when given) would carry the key in plaintext, such as an `agent.json`
+ * paired over http by a CLI older than 0.10.1.
+ */
+function loadOrExplain(streamOverride) {
+    let credentials;
     try {
-        return loadCredentials();
+        credentials = loadCredentials();
     }
     catch (err) {
         if (err instanceof CredentialsMissingError) {
@@ -239,6 +247,13 @@ function loadOrExplain() {
         }
         throw err;
     }
+    const problem = storedCredentialsProblem(credentials, streamOverride ?? streamUrlFor(credentials, DEFAULT_WS_URL));
+    if (problem) {
+        process.stderr.write(`✗ Refusing to send the API key: ${problem} Re-pair with an https:// --base-url ` +
+            '(prohost agent pair --code <code>).\n');
+        return null;
+    }
+    return credentials;
 }
 async function installDaemonCommand(flags) {
     const exec = flagString(flags, 'exec');
@@ -246,7 +261,7 @@ async function installDaemonCommand(flags) {
         process.stderr.write("Missing required flag: --exec. Example: prohost agent install-daemon --exec 'claude -p'\n");
         return 1;
     }
-    const credentials = loadOrExplain();
+    const credentials = loadOrExplain(flagString(flags, 'url'));
     if (!credentials)
         return 1;
     if (!applyAccountFlag(flags))
@@ -380,7 +395,7 @@ async function runCommand(flags) {
         process.stderr.write("Missing required flag: --exec. Example: prohost agent run --exec 'claude -p'\n");
         return 1;
     }
-    const credentials = loadOrExplain();
+    const credentials = loadOrExplain(flagString(flags, 'url') ?? process.env.PROHOST_WS_URL);
     if (!credentials)
         return 1;
     const parsedTimeout = parseTimeoutSeconds(flags);

package/dist/agent/credentials.d.ts

@@ -69,6 +69,15 @@ export declare const CREDENTIALS_VERSION = 2;
  * @param fallback Used when neither the stored URL nor ``base_url`` is usable.
  */
 export declare function streamUrlFor(credentials: AgentCredentials, fallback: string): string;
+/**
+ * Turn an API base URL into the websocket URL on the same host.
+ *
+ * Mirrors the server's derivation (`shared/agents/connections.py`
+ * ``pairing_endpoints``): only plain ``http`` maps to ``ws``, so a local dev
+ * base keeps working and nothing else can downgrade a socket that carries an
+ * API key. Returns ``undefined`` for anything not parseable as a URL.
+ */
+export declare function wsUrlFromBaseUrl(baseUrl: string | undefined): string | undefined;
 /** Directory holding CLI state. Overridable with ``$PROHOST_HOME`` for tests. */
 export declare function prohostHome(env?: NodeJS.ProcessEnv): string;
 /** Absolute path of the credential file. */

package/dist/agent/credentials.js

@@ -47,7 +47,7 @@ export function streamUrlFor(credentials, fallback) {
  * base keeps working and nothing else can downgrade a socket that carries an
  * API key. Returns ``undefined`` for anything not parseable as a URL.
  */
-function wsUrlFromBaseUrl(baseUrl) {
+export function wsUrlFromBaseUrl(baseUrl) {
     if (!baseUrl)
         return undefined;
     let parsed;

package/dist/agent/pair.js

@@ -10,8 +10,9 @@
  * specific than "invalid, expired, or already used".
  */
 import { USER_AGENT } from '../version.js';
+import { baseUrlProblem, endpointProblem, isAllowedBaseUrl } from './base-url.js';
 import { DEFAULT_API_BASE_URL, REDEEM_PATH } from './contract.js';
-import { CREDENTIALS_VERSION, clearCredentials, maskSecret, saveCredentials, tryLoadCredentials, } from './credentials.js';
+import { CREDENTIALS_VERSION, clearCredentials, maskSecret, saveCredentials, tryLoadCredentials, wsUrlFromBaseUrl, } from './credentials.js';
 import { DEFAULT_WS_URL } from '../listen.js';
 export class PairError extends Error {
 }
@@ -20,28 +21,34 @@ const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{
 function isUuid(value) {
     return typeof value === 'string' && UUID_PATTERN.test(value);
 }
-/** Derive the API base from the server-reported MCP URL, so the server wins. */
+/**
+ * Derive the API base from the server-reported MCP URL, so the server wins —
+ * unless it is one the API key may not be sent to (see `base-url.ts`).
+ */
 function baseFromMcpUrl(mcpUrl, fallback) {
-    return mcpUrl.endsWith('/mcp') ? mcpUrl.slice(0, -'/mcp'.length) : fallback;
+    const base = mcpUrl.endsWith('/mcp') ? mcpUrl.slice(0, -'/mcp'.length) : '';
+    return base && isAllowedBaseUrl(base) ? base : fallback;
 }
 /**
  * The websocket URL the server told us to use, or ``undefined``.
  *
- * ``undefined`` covers both "this server predates the field" and "the value is
- * not a websocket URL". A cosmetic bad value must not fail a redeem — the code
- * is already spent by the time we read the body — so the caller falls back to
- * {@link DEFAULT_WS_URL} and says so.
+ * ``undefined`` covers "this server predates the field", "the value is not a
+ * websocket URL" and "it is plain ws:// off loopback". A bad value must not
+ * fail a redeem — the code is already spent by the time we read the body — so
+ * the caller falls back to the stream on the stored API base's host and says so.
  */
 function serverWsUrl(value) {
     if (typeof value !== 'string' || value.length === 0)
         return undefined;
-    try {
-        const protocol = new URL(value).protocol;
-        return protocol === 'ws:' || protocol === 'wss:' ? value : undefined;
-    }
-    catch {
-        return undefined;
-    }
+    // `wss://`, or `ws://` on loopback only: the stream's auth frame carries the key.
+    return endpointProblem(value, 'ws') === undefined ? value : undefined;
+}
+/**
+ * The MCP URL to store: the server's, unless the API key may not be sent to
+ * it, in which case the one on the (already validated) API base.
+ */
+function safeMcpUrl(mcpUrl, baseUrl) {
+    return mcpUrl && isAllowedBaseUrl(mcpUrl) ? mcpUrl : `${baseUrl}/mcp`;
 }
 /**
  * Redeem ``code`` and persist the resulting credentials.
@@ -52,6 +59,14 @@ export async function runPair(options) {
     const fetchImpl = options.fetchImpl ?? fetch;
     const onLine = options.onLine ?? ((line) => process.stdout.write(`${line}\n`));
     const baseUrl = (options.baseUrl ?? DEFAULT_API_BASE_URL).replace(/\/+$/, '');
+    // Checked before the code is spent: the code goes to this URL, and the API
+    // key comes back from it.
+    const baseProblem = baseUrlProblem(baseUrl);
+    if (baseProblem)
+        throw new PairError(`--base-url rejected: ${baseProblem}`);
+    const wsProblem = options.wsUrl ? endpointProblem(options.wsUrl, 'ws') : undefined;
+    if (wsProblem)
+        throw new PairError(`--url rejected: ${wsProblem}`);
     if (options.webhookUrl && !options.webhookUrl.startsWith('https://')) {
         throw new PairError('--webhook-url must be an https:// URL');
     }
@@ -136,18 +151,24 @@ export async function runPair(options) {
     //   2. The server's `ws_url`, derived server-side from the same setting as
     //      `mcp_url` (`shared/agents/connections.py::pairing_endpoints`). This is
     //      the normal path, and the reason a host move no longer needs a release.
-    //   3. `DEFAULT_WS_URL`, for a server that predates the field.
+    //   3. No usable `ws_url` (a server that predates the field, or a value that
+    //      is not a websocket URL or is plain ws:// off loopback): the stream on
+    //      the stored API base's host, as the server derives it — never another
+    //      deployment's, which would get this key. For the default base that is
+    //      `DEFAULT_WS_URL`, which is also the last resort.
+    const storedBase = baseFromMcpUrl(body.mcp_url ?? '', baseUrl);
     const fromServer = serverWsUrl(body.ws_url);
-    const wsUrl = options.wsUrl ?? fromServer ?? DEFAULT_WS_URL;
+    const fallbackWsUrl = wsUrlFromBaseUrl(storedBase) ?? DEFAULT_WS_URL;
+    const wsUrl = options.wsUrl ?? fromServer ?? fallbackWsUrl;
     const credentials = {
         version: CREDENTIALS_VERSION,
-        base_url: baseFromMcpUrl(body.mcp_url ?? '', baseUrl),
+        base_url: storedBase,
         ws_url: wsUrl,
         api_key: body.api_key,
         webhook_secret: body.webhook_secret ?? null,
         subscription_id: body.subscription_id ?? null,
         stream_only: body.stream_only,
-        mcp_url: body.mcp_url,
+        mcp_url: safeMcpUrl(body.mcp_url, storedBase),
         events: body.events ?? [],
         agent: body.agent,
         paired_at: new Date().toISOString(),
@@ -156,7 +177,7 @@ export async function runPair(options) {
     onLine(`✓ Paired as "${body.agent.name}" (agent ${body.agent.id})`);
     onLine(`  API key      ${maskSecret(body.api_key)}  (stored, never printed in full)`);
     onLine(`  Credentials  ${file}  (chmod 600)`);
-    onLine(`  MCP URL      ${body.mcp_url}`);
+    onLine(`  MCP URL      ${credentials.mcp_url}`);
     // Printed because 0.1.0's wrong websocket host was invisible here: pairing
     // reported success and the mismatch only surfaced as a 403 reconnect loop in
     // a different command. Showing it makes a bad host obvious at pair time.
@@ -171,7 +192,7 @@ export async function runPair(options) {
         // answer either.
         onLine('');
         onLine(`  ! The server reported an unusable stream URL (${JSON.stringify(body.ws_url)}).`);
-        onLine(`    Using ${DEFAULT_WS_URL} instead — override with --url if that is wrong.`);
+        onLine(`    Using ${fallbackWsUrl} instead — override with --url if that is wrong.`);
     }
     if (!credentials.webhook_secret) {
         // Without a secret the runner can't prove an event came from ProhostAI,

package/dist/index.js

@@ -16,6 +16,7 @@
 import { realpathSync } from 'node:fs';
 import process from 'node:process';
 import { fileURLToPath } from 'node:url';
+import { endpointProblem } from './agent/base-url.js';
 import { runAgent } from './agent/command.js';
 import { DEFAULT_WS_URL, runListen } from './listen.js';
 import { runUsage } from './usage/command.js';
@@ -35,7 +36,7 @@ function printHelp() {
         '  prohost agent account list | remove <label>',
         '  prohost agent list                   Every paired agent on this machine, and its accounts',
         '  prohost agent workspace init --developer --repo <checkout> [--workdir <dir>]',
-        '  prohost usage connect [--key <api-key>] [--base-url <url>]   Report AI usage without pairing an agent',
+        '  prohost usage connect [--key -] [--base-url <url>]   Report AI usage without pairing an agent (prompts for the key; --key - reads it from stdin)',
         '  prohost usage discover [--dry-run] | start [--once] [--machine <name>] | status',
         '  prohost usage install-daemon [--machine <name>] | uninstall-daemon',
         '',
@@ -49,7 +50,7 @@ function printHelp() {
         'agent pair flags:',
         '  --code           One-time pairing code from the hire modal. Defaults to $PROHOST_PAIRING_CODE.',
         '  --webhook-url    Also push events to this HTTPS endpoint. Omit it: stream-only is the normal setup.',
-        '  --base-url       Public API base. Defaults to https://connect.prohost.ai.',
+        '  --base-url       Public API base. Defaults to https://connect.prohost.ai. Must be https:// (http:// only for localhost).',
         '',
         'agent run flags:',
         '  --exec           Command to run for each mention; the prompt arrives on stdin (required)',
@@ -162,7 +163,8 @@ export function parseArgs(argv) {
             i += 1;
             continue;
         }
-        if (next === undefined || next.startsWith('-')) {
+        // A bare `-` is a value ("read it from stdin", as in `--key -`), not a flag.
+        if (next === undefined || (next.startsWith('-') && next !== '-')) {
             flags[key] = true;
             i += 1;
         }
@@ -218,6 +220,12 @@ async function main(argv) {
     const url = (typeof flags['url'] === 'string' ? flags['url'] : undefined) ??
         process.env.PROHOST_WS_URL ??
         DEFAULT_WS_URL;
+    // The auth frame carries the API key: wss://, or ws:// on loopback only.
+    const urlProblem = endpointProblem(url, 'ws');
+    if (urlProblem) {
+        process.stderr.write(`✗ --url rejected: ${urlProblem}\n`);
+        return 1;
+    }
     const machine = typeof flags['machine'] === 'string' ? flags['machine'] : undefined;
     const subscriptionId = typeof flags['subscription-id'] === 'string' ? flags['subscription-id'] : undefined;
     const controller = new AbortController();

package/dist/usage/command.d.ts

@@ -6,11 +6,14 @@
  * `scanner.ts` and `service.ts`.
  */
 import type { DiscoveryResult } from './discovery.js';
+import type { KeyStdin } from './key-input.js';
 type Flags = Record<string, string | boolean>;
 export interface UsageIO {
     out: (line: string) => void;
     err: (line: string) => void;
     env?: NodeJS.ProcessEnv;
+    /** Where `connect` reads a key from (`--key -`, a pipe, or a hidden prompt). Defaults to `process.stdin`. */
+    stdin?: KeyStdin;
 }
 /** launchd label prefix for the usage reporter — distinct from the agent daemon's. */
 export declare const USAGE_LAUNCHD_PREFIX = "ai.prohost.usage";