@prohost/cli 0.9.0 → 0.10.1

package/CHANGELOG.md

@@ -4,6 +4,69 @@ Versions follow [semver](https://semver.org/). Publishing is automated: merging
 a version bump to `main` triggers `.github/workflows/npm-publish-cli.yml`, which
 builds via `prepack`, runs the suite, publishes, and tags `cli-v<version>`.
 
+## 0.10.1
+
+Safer key handling for `prohost usage connect`, and no credential ever goes to
+a plain-http API base.
+
+- **`usage connect` reads the key without exposing it.** It prompts with echo
+  off at a terminal, reads piped stdin (`pbpaste | prohost usage connect --key -`),
+  or takes `$PROHOST_API_KEY`. `--key <value>` still works but prints a warning:
+  it leaves the key in shell history and the process list. A connected machine
+  (or one with a paired agent) is not prompted again.
+- **`--base-url` must be `https://`.** `usage connect --base-url` and
+  `agent pair --base-url` reject anything else before a key is stored or a
+  pairing code is spent; `http://` is allowed only for `localhost`, `127.0.0.1`
+  and `[::1]`. `usage start`, `install-daemon` and every reporter tick refuse to
+  send a key to a stored base URL that fails the same check, and `usage status`
+  flags it. A pairing whose server reports a plain-http `mcp_url` or plain-ws
+  `ws_url` keeps the requested base, `<base>/mcp` and the default stream URL
+  instead, and `agent pair --url` / `listen --url` must be `wss://` (`ws://`
+  only on loopback).
+- **`agent run` and `agent install-daemon` refuse insecure stored credentials.**
+  An `agent.json` whose API base, MCP URL or stream URL would carry the key in
+  plaintext (paired over http by an older CLI) is refused with a re-pair hint,
+  before anything is sent.
+
+## 0.10.0
+
+Every Claude Code and Codex login on a machine can report its remaining
+capacity and token use to ProhostAI, without pairing an agent.
+
+- **`prohost usage connect [--key <key>]`** stores an API key with the
+  `usage:write` scope in `$PROHOST_HOME/usage.json` (`0600`, never printed). A
+  machine that already paired an agent can skip `--key`; its credential is
+  accepted.
+- **Discovery.** `connect`, `usage discover [--dry-run]` and every `usage start`
+  register the config directories already on the machine — `~/.claude*`,
+  `~/.codex*`, `$CLAUDE_CONFIG_DIR`, `$CODEX_HOME` — in the machine-wide account
+  registry, labelled from the directory name (`~/.claude-work` → `work`). Only
+  directory names and non-secret markers are looked at.
+- **`prohost usage start`** reports every 5 minutes (`POST /v1/usage/reports`,
+  source `cli`): each login's windows from the same idle probes `agent run`
+  uses, asked at most every 15 minutes per login, three at a time.
+- **Token totals** from the CLIs' own session logs, summed per local day,
+  login, model and project folder name (`POST /v1/usage/token-totals`). Claude
+  Code responses are counted once however often their lines repeat; Codex usage
+  is the growth of each session's running total, with cached input split out.
+  The first run looks back 30 days, then reads only appended lines. No prompt
+  text is read into the totals or sent.
+  Totals for a login are sent only once a capacity report for it has been
+  accepted (`acceptedAccountKeys` when the server names them; otherwise any
+  non-zero `accepted`), so a first run or a newly found login reports first.
+  Skipped rows follow the server's `skipped[].reason`: `not_owned`,
+  `other_source` and `out_of_range` are dropped (logged once), `throttled` is
+  retried next pass, `not_reported` waits for the next accepted report. Rows
+  skipped without a reason are retried at most three times.
+- **Fails soft.** A 401/403/404 (routes not deployed, feature off, key without
+  the scope) is logged once and retried every 30 minutes; network errors back
+  off exponentially. A tick never throws.
+- **`prohost usage install-daemon` / `uninstall-daemon`** keep it running under
+  launchd with its own label (`ai.prohost.usage.*`), next to any agent daemon.
+  **`prohost usage status`** shows what was last sent and local totals.
+- `prohost agent account remove` on a login registered from an existing
+  directory forgets it and leaves the directory in place.
+
 ## 0.9.0
 
 A quick question no longer waits behind a long job in another thread.

package/README.md

@@ -1,12 +1,15 @@
 # `@prohost/cli`
 
-The [ProhostAI](https://www.prohost.ai) command-line tool. Two things it does:
+The [ProhostAI](https://www.prohost.ai) command-line tool. Three things it does:
 
 - **`prohost agent`** — run your own local agent as a ProhostAI teammate. Someone
   @-mentions it in the app, it runs on your machine, and its answer is posted
   back into the conversation.
 - **`prohost listen`** — stream your account's webhooks to a local HTTP endpoint
   while you develop against them (like `stripe listen`).
+- **`prohost usage`** — show your workspace how much Claude Code and Codex
+  capacity every login on this machine has left, and how many tokens each one
+  used, without pairing an agent.
 
 You need a ProhostAI account and **Node.js 18 or newer**. Nothing to install —
 `npx` fetches it on demand:
@@ -679,7 +682,7 @@ decision to make.
 | `--code` | `$PROHOST_PAIRING_CODE` | The one-time pairing code. |
 | `--account` | the home's current account, else `default` | Which Claude Code / Codex login this agent runs on (see Accounts). |
 | `--webhook-url` | none | Also push events to this HTTPS endpoint. Omit for stream-only, which is the normal laptop setup. |
-| `--base-url` | `https://connect.prohost.ai` | Public API base. |
+| `--base-url` | `https://connect.prohost.ai` | Public API base. Must be `https://`; `http://` only for `localhost`, `127.0.0.1` and `[::1]`. `agent run` refuses an `agent.json` whose API, MCP or stream URL is plain http/ws off loopback. |
 
 ### About `--allow-unverified`
 
@@ -728,6 +731,78 @@ through ProhostAI's own approval path, not around it via an API key.
 
 ---
 
+## AI usage reporting
+
+`prohost usage` reports, for every Claude Code and Codex login on this machine,
+how much of its subscription is left (the 5-hour and weekly windows, with their
+reset times) and how many tokens it used per day, model and project folder.
+ProhostAI shows it in the workspace's Usage Monitor app. No agent pairing needed.
+
+```bash
+# 1. In ProhostAI: Settings → API keys → create a key with the usage:write scope,
+#    then paste it at the prompt (input is hidden)…
+npx @prohost/cli usage connect
+#    …or pipe it in, so it never lands in your shell history:
+pbpaste | npx @prohost/cli usage connect --key -
+#    (A machine with a paired agent can skip the key: its credential is accepted.)
+
+# 2. Report now, then every 5 minutes, in the foreground…
+npx @prohost/cli usage start
+
+# …or keep it running across reboots (macOS launchd; prints a systemd unit on Linux).
+npx @prohost/cli usage install-daemon
+
+npx @prohost/cli usage status    # logins, last report, local token totals
+```
+
+**Which logins.** `connect`, `discover` and every `start` register the config
+directories already on this machine: `~/.claude`, `~/.codex` (as `default`) and
+any `~/.claude-<name>` / `~/.codex-<name>` (as `<name>` — `~/.claude-work` is
+`work`), plus `$CLAUDE_CONFIG_DIR` and `$CODEX_HOME`. They join the same
+machine-wide registry `prohost agent account` uses (`~/.prohost-accounts`), so a
+login added there is reported too. `prohost usage discover --dry-run` shows what
+would be registered without writing anything. Removing a discovered login with
+`prohost agent account remove` leaves its directory alone.
+
+**Capacity.** Each login is asked at most every 15 minutes, three at a time,
+through the unmodified CLI with that login's directory — `claude`'s `get_usage`
+control request and `codex app-server`'s `account/rateLimits/read`. Neither
+spends a model turn. Sign-in state comes from `claude auth status` /
+`codex login status`. `prohost` never opens a credential file or keychain item.
+
+**Tokens.** Read from the session logs the CLIs already write —
+`<config dir>/projects/**/*.jsonl` for Claude Code, `sessions/**/rollout-*.jsonl`
+for Codex — and summed per local day, login, model and project, where the
+project is the **name** of the working directory (`backend-service`, never its
+path). Only usage counters are read: no prompt, reply, tool call or file content
+is kept or sent. The first run looks back 30 days; after that only what was
+appended is read, using a cursor in `$PROHOST_HOME/usage/`. A day that changes
+is re-sent whole, and the server replaces it.
+Totals for a login go only after the server has accepted a capacity report
+for it (the server ignores totals for logins it hasn't seen), so each pass
+reports first. When the server says why it skipped a login's rows, the reason
+decides: another user's or another source's login, or a day out of range, is
+dropped (logged once); `throttled` is retried next pass; `not_reported` waits
+for the next accepted report. Unexplained skips are retried at most three
+times, so a login the server never takes is never resent forever and never
+holds up the others.
+
+**If the server says no.** Before the feature is enabled for your workspace
+(or with a key that lacks `usage:write`) the server answers 403/404. The reporter
+logs that once, waits 30 minutes, and tries again — it never exits over it.
+Network errors are retried with backoff. Logs go to `$PROHOST_HOME/usage.log`
+under the daemon.
+
+| Command | What it does |
+| --- | --- |
+| `usage connect [--key -] [--base-url <url>]` | Store the key (`$PROHOST_HOME/usage.json`, `0600`), then discover logins. The key comes from `--key -` (stdin, or a hidden prompt at a terminal), piped stdin, `$PROHOST_API_KEY`, or a hidden prompt. `--key <value>` still works but warns: it leaves the key in shell history and the process list. `--base-url` must be `https://` (`http://` only for `localhost`, `127.0.0.1`, `[::1]`). |
+| `usage discover [--dry-run]` | Register logins found on this machine. |
+| `usage start [--once] [--machine <name>]` | Report every 5 minutes; `--once` runs one pass and exits. |
+| `usage status` | Connection, daemon, last report and upload, and each login's local totals. |
+| `usage install-daemon [--machine <name>]` / `uninstall-daemon` | Keep `usage start` running (its own launchd job, separate from the agent's). |
+
+---
+
 ## Local webhook forwarding
 
 ```bash

package/dist/agent/accounts.d.ts

@@ -81,9 +81,25 @@ export declare function addAccount(options: {
     runtime: AccountRuntime;
     billing?: AccountBilling;
 }, env?: NodeJS.ProcessEnv): AccountRecord;
+/**
+ * Register a config directory that already exists — a login the operator made
+ * outside this CLI (`~/.claude-work`, a `$CODEX_HOME`). Nothing in it is read
+ * or written; signing in stays the agent CLI's own business. A directory that
+ * is already registered (under any label) is not registered twice.
+ */
+export declare function registerAccountDir(options: {
+    label: string;
+    runtime: AccountRuntime;
+    dir: string;
+    billing?: AccountBilling;
+}, env?: NodeJS.ProcessEnv): AccountRecord;
+/** Whether removing this account deletes its directory (only ones this CLI created). */
+export declare function ownsAccountDir(record: AccountRecord, env?: NodeJS.ProcessEnv): boolean;
 /**
  * Forget an account and delete its config directory (the login inside it goes
- * with it). The implicit default can't be removed — it is the CLI's own login.
+ * with it) — but only a directory this CLI created; a registered existing one
+ * is left where it is. The implicit default can't be removed — it is the CLI's
+ * own login.
  */
 export declare function removeAccount(label: string, runtime: AccountRuntime, env?: NodeJS.ProcessEnv): AccountRecord;
 export declare function runtimeName(runtime: AccountRuntime): string;

package/dist/agent/accounts.js

@@ -236,9 +236,50 @@ function addAccountLocked(label, runtime, billing, env) {
     saveAccounts([...loadAccounts(env), record], env);
     return record;
 }
+/**
+ * Register a config directory that already exists — a login the operator made
+ * outside this CLI (`~/.claude-work`, a `$CODEX_HOME`). Nothing in it is read
+ * or written; signing in stays the agent CLI's own business. A directory that
+ * is already registered (under any label) is not registered twice.
+ */
+export function registerAccountDir(options, env = process.env) {
+    const { label, runtime } = options;
+    if (!isValidLabel(label) || label === DEFAULT_ACCOUNT_LABEL) {
+        throw new AccountError(`"${label}" is not a usable label for an existing login directory.`);
+    }
+    const dir = path.resolve(options.dir);
+    return withRegistryLock(env, () => {
+        const accounts = loadAccounts(env);
+        const same = accounts.find((a) => a.runtime === runtime && a.dir !== null && path.resolve(a.dir) === dir);
+        if (same)
+            return same;
+        if (findAccount(label, runtime, env)) {
+            throw new AccountError(`A ${runtimeName(runtime)} account named "${label}" already exists on this machine.`);
+        }
+        if (accounts.filter((a) => a.label !== DEFAULT_ACCOUNT_LABEL).length >= MAX_REPORTED_ACCOUNTS - 2) {
+            throw new AccountError(`This machine already has ${MAX_REPORTED_ACCOUNTS - 2} accounts, the most ProhostAI can show. Remove one first.`);
+        }
+        const record = {
+            key: randomUUID(),
+            label,
+            runtime,
+            billing: options.billing ?? 'subscription',
+            dir,
+            created_at: new Date().toISOString(),
+        };
+        saveAccounts([...accounts, record], env);
+        return record;
+    });
+}
+/** Whether removing this account deletes its directory (only ones this CLI created). */
+export function ownsAccountDir(record, env = process.env) {
+    return !!record.dir && record.dir.startsWith(path.join(accountsRoot(env), 'accounts') + path.sep);
+}
 /**
  * Forget an account and delete its config directory (the login inside it goes
- * with it). The implicit default can't be removed — it is the CLI's own login.
+ * with it) — but only a directory this CLI created; a registered existing one
+ * is left where it is. The implicit default can't be removed — it is the CLI's
+ * own login.
  */
 export function removeAccount(label, runtime, env = process.env) {
     if (label === DEFAULT_ACCOUNT_LABEL) {
@@ -253,7 +294,7 @@ export function removeAccount(label, runtime, env = process.env) {
         return found;
     });
     // Only ever a directory this module created under the root.
-    if (record.dir && record.dir.startsWith(path.join(accountsRoot(env), 'accounts') + path.sep)) {
+    if (ownsAccountDir(record, env) && record.dir) {
         rmSync(record.dir, { recursive: true, force: true });
     }
     return record;

package/dist/agent/agent_commands.js

@@ -4,7 +4,7 @@
  * `accounts.ts`, `list.ts` and `workspace.ts`.
  */
 import process from 'node:process';
-import { AccountError, addAccount, checkAuth, loadAccounts, parseAccountRuntime, removeAccount, runtimeName, signInCommand, waitForSignIn, } from './accounts.js';
+import { AccountError, addAccount, checkAuth, loadAccounts, ownsAccountDir, parseAccountRuntime, removeAccount, runtimeName, signInCommand, waitForSignIn, } from './accounts.js';
 import { ensureWorkspace } from './credentials.js';
 import { findAgentHomes, renderAgentList } from './list.js';
 import { WorkspaceInitError, initDeveloperWorkspace } from './workspace.js';
@@ -118,8 +118,9 @@ export async function accountCommand(args, flags, io = defaultIO) {
                 'Move them to another account first, or pass --force.');
             return 1;
         }
+        let removed;
         try {
-            removeAccount(label, target?.runtime ?? runtime ?? 'claude_code', env);
+            removed = removeAccount(label, target?.runtime ?? runtime ?? 'claude_code', env);
         }
         catch (err) {
             if (err instanceof AccountError) {
@@ -128,7 +129,9 @@ export async function accountCommand(args, flags, io = defaultIO) {
             }
             throw err;
         }
-        io.out(`✓ Removed "${label}" and its login directory.`);
+        io.out(ownsAccountDir(removed, env)
+            ? `✓ Removed "${label}" and its login directory.`
+            : `✓ Removed "${label}". Its login directory${removed.dir ? ` (${removed.dir})` : ''} was left in place.`);
         return 0;
     }
     io.err('Expected: prohost agent account add|list|remove');

package/dist/agent/api.d.ts

@@ -68,6 +68,12 @@ export declare function describeFailure(result: ApiResult): string;
  * cached, and the next replay receives its response.
  */
 export declare function isIdempotencyInFlight(result: ApiResult): boolean;
+/**
+ * POST a JSON body with the API key. Never throws: every failure comes back as
+ * an {@link ApiResult}. Exported for the `prohost usage` reporter, which owns
+ * its own paths.
+ */
+export declare function postJson(options: ApiOptions, path: string, body: unknown, idempotencyKey?: string, captureBody?: boolean, timeoutMs?: number): Promise<ApiResult>;
 /**
  * Post the agent's reply into the conversation that triggered the run.
  *

package/dist/agent/api.js

@@ -52,7 +52,12 @@ export function describeFailure(result) {
 export function isIdempotencyInFlight(result) {
     return result.status === 409 && (result.error ?? '').includes('idempotency_key_in_flight');
 }
-async function post(options, path, body, idempotencyKey, captureBody = false, timeoutMs = DEFAULT_TIMEOUT_MS) {
+/**
+ * POST a JSON body with the API key. Never throws: every failure comes back as
+ * an {@link ApiResult}. Exported for the `prohost usage` reporter, which owns
+ * its own paths.
+ */
+export async function postJson(options, path, body, idempotencyKey, captureBody = false, timeoutMs = DEFAULT_TIMEOUT_MS) {
     const fetchImpl = options.fetchImpl ?? fetch;
     const controller = new AbortController();
     const deadlineMs = options.timeoutMs ?? timeoutMs;
@@ -126,7 +131,7 @@ export async function postReply(options, path, bodyKey, message, runId, extra) {
     // thing in this request that must survive.
     // Byte-identical on every attempt: the server hashes the body against the
     // key, so a replay must serialise exactly as the original did.
-    return post(options, path, { ...extra, [bodyKey]: message }, `prohost-cli-run-${runId}`, false, SEND_TIMEOUT_MS);
+    return postJson(options, path, { ...extra, [bodyKey]: message }, `prohost-cli-run-${runId}`, false, SEND_TIMEOUT_MS);
 }
 function booleanField(body, key) {
     if (!body)
@@ -154,7 +159,7 @@ function booleanField(body, key) {
  */
 export async function heartbeatRun(options, path, progress) {
     const trimmed = progress?.trim();
-    const result = await post(options, path, trimmed ? { progress: trimmed.slice(0, MAX_PROGRESS_CHARS) } : {}, undefined, true);
+    const result = await postJson(options, path, trimmed ? { progress: trimmed.slice(0, MAX_PROGRESS_CHARS) } : {}, undefined, true);
     if (result.ok)
         return { kind: 'alive', cancelRequested: booleanField(result.body, 'cancel_requested') };
     if (result.status === 404)
@@ -180,7 +185,7 @@ export async function completeRun(options, path, outcome, model) {
         : { status: RUN_STATUS_FAILED, error: outcome.error.slice(0, MAX_ERROR_CHARS) };
     if (model)
         body.model = model.slice(0, MAX_MODEL_CHARS);
-    const result = await post(options, path, body, undefined, false, SEND_TIMEOUT_MS);
+    const result = await postJson(options, path, body, undefined, false, SEND_TIMEOUT_MS);
     if (result.status === 409)
         return { ...result, ok: true };
     return result;
@@ -195,5 +200,5 @@ export async function completeRun(options, path, outcome, model) {
  * over-fills one gets it clipped rather than rejected whole.
  */
 export async function postToolEvents(options, path, events) {
-    return post(options, path, { events: events.slice(0, MAX_TOOL_EVENTS_PER_BATCH) });
+    return postJson(options, path, { events: events.slice(0, MAX_TOOL_EVENTS_PER_BATCH) });
 }

package/dist/agent/base-url.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Which URLs an API key or pairing code may be sent to.
+ *
+ * `--base-url` points the CLI at another ProhostAI deployment, and every
+ * request to it carries a secret — the pairing code on redeem, the API key on
+ * every call after, on the MCP endpoint, and in the stream's auth frame. So
+ * each of those URLs must be encrypted (`https://`, or `wss://` for the
+ * stream); plain `http://` / `ws://` is allowed only for this machine's
+ * loopback (`localhost`, `127.0.0.1`, `[::1]`), which is what local
+ * development uses.
+ */
+declare const SCHEMES: {
+    readonly http: {
+        readonly secure: "https:";
+        readonly plain: "http:";
+    };
+    readonly ws: {
+        readonly secure: "wss:";
+        readonly plain: "ws:";
+    };
+};
+/**
+ * Why a credential may not be sent to `value`, or `undefined` when it may.
+ * `kind` is `http` for API and MCP URLs, `ws` for the event stream. A whole
+ * sentence, so callers can prefix it with what was being checked.
+ */
+export declare function endpointProblem(value: string, kind?: keyof typeof SCHEMES): string | undefined;
+/** Why `value` cannot be an API base URL (see {@link endpointProblem}). */
+export declare function baseUrlProblem(value: string): string | undefined;
+/** True when an API key may be sent to `value`. */
+export declare function isAllowedBaseUrl(value: string): boolean;
+/**
+ * Why stored agent credentials must not be used, or `undefined` when every URL
+ * the key would go to is safe: the API base, the MCP URL, and `streamUrl` —
+ * the stream URL `agent run` would actually connect to. An `agent.json`
+ * paired over plain http by an older CLI is caught here, before anything is
+ * sent.
+ */
+export declare function storedCredentialsProblem(credentials: {
+    base_url?: string;
+    mcp_url?: string;
+}, streamUrl: string): string | undefined;
+export {};

package/dist/agent/base-url.js

@@ -0,0 +1,72 @@
+/**
+ * Which URLs an API key or pairing code may be sent to.
+ *
+ * `--base-url` points the CLI at another ProhostAI deployment, and every
+ * request to it carries a secret — the pairing code on redeem, the API key on
+ * every call after, on the MCP endpoint, and in the stream's auth frame. So
+ * each of those URLs must be encrypted (`https://`, or `wss://` for the
+ * stream); plain `http://` / `ws://` is allowed only for this machine's
+ * loopback (`localhost`, `127.0.0.1`, `[::1]`), which is what local
+ * development uses.
+ */
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]']);
+const SCHEMES = {
+    http: { secure: 'https:', plain: 'http:' },
+    ws: { secure: 'wss:', plain: 'ws:' },
+};
+/**
+ * Why a credential may not be sent to `value`, or `undefined` when it may.
+ * `kind` is `http` for API and MCP URLs, `ws` for the event stream. A whole
+ * sentence, so callers can prefix it with what was being checked.
+ */
+export function endpointProblem(value, kind = 'http') {
+    const { secure, plain } = SCHEMES[kind];
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        // Not echoed: an unparseable value can still hold a secret.
+        return `It is not a full URL such as ${secure}//connect.prohost.ai.`;
+    }
+    if (parsed.protocol === secure)
+        return undefined;
+    if (parsed.protocol === plain && LOOPBACK_HOSTS.has(parsed.hostname))
+        return undefined;
+    if (parsed.protocol === plain) {
+        return (`${parsed.origin} is not ${secure}//, so the credential would travel in plaintext. ` +
+            `Plain ${plain}// is allowed only for localhost, 127.0.0.1 and [::1].`);
+    }
+    return `${parsed.protocol} URLs are not supported here; use ${secure}//.`;
+}
+/** Why `value` cannot be an API base URL (see {@link endpointProblem}). */
+export function baseUrlProblem(value) {
+    return endpointProblem(value, 'http');
+}
+/** True when an API key may be sent to `value`. */
+export function isAllowedBaseUrl(value) {
+    return baseUrlProblem(value) === undefined;
+}
+/**
+ * Why stored agent credentials must not be used, or `undefined` when every URL
+ * the key would go to is safe: the API base, the MCP URL, and `streamUrl` —
+ * the stream URL `agent run` would actually connect to. An `agent.json`
+ * paired over plain http by an older CLI is caught here, before anything is
+ * sent.
+ */
+export function storedCredentialsProblem(credentials, streamUrl) {
+    const checks = [
+        ['API base URL', credentials.base_url, 'http'],
+        ['MCP URL', credentials.mcp_url, 'http'],
+        ['stream URL', streamUrl, 'ws'],
+    ];
+    for (const [name, url, kind] of checks) {
+        if (!url)
+            continue;
+        const problem = endpointProblem(url, kind);
+        // The URL itself is not echoed: a stored one can carry userinfo or a token.
+        if (problem)
+            return `The stored ${name} is unusable. ${problem}`;
+    }
+    return undefined;
+}

package/dist/agent/command.js

@@ -12,13 +12,15 @@ import { fileURLToPath } from 'node:url';
 import { agentLogPath, buildSystemdUnit, harnessArguments, installLaunchdDaemon, launchdLabel, uninstallLaunchdDaemon, } from './daemon.js';
 import { accountCommand, listCommand, workspaceCommand } from './agent_commands.js';
 import { AccountError, loadAccounts, setAgentAccount } from './accounts.js';
+import { storedCredentialsProblem } from './base-url.js';
 import { acquireRunLock } from './lock.js';
 import { PairError, runPair } from './pair.js';
-import { CredentialsMissingError, ensureWorkspace, loadCredentials, prohostHome, tryLoadCredentials, } from './credentials.js';
+import { CredentialsMissingError, ensureWorkspace, loadCredentials, prohostHome, streamUrlFor, tryLoadCredentials, } from './credentials.js';
 import { DEFAULT_EXEC_TIMEOUT_MS, DEFAULT_IDLE_TIMEOUT_MS, runAgentHarness } from './run.js';
 import { MAX_CONCURRENCY } from './scheduler.js';
 import { ReposFlagError, isCheckout, parseReposFlag } from './worktrees.js';
 import { announceUpgradeIfAvailable } from '../upgrade.js';
+import { DEFAULT_WS_URL } from '../listen.js';
 function flagString(flags, name) {
     const value = flags[name];
     return typeof value === 'string' ? value : undefined;
@@ -227,10 +229,16 @@ export async function runAgent(subcommand, flags, printHelp, args = []) {
     printHelp();
     return 1;
 }
-/** Load credentials, reporting the "you haven't paired" case as an exit code. */
-function loadOrExplain() {
+/**
+ * Load credentials, reporting the "you haven't paired" case as an exit code —
+ * and refusing credentials whose API, MCP or stream URL (`streamOverride`
+ * when given) would carry the key in plaintext, such as an `agent.json`
+ * paired over http by a CLI older than 0.10.1.
+ */
+function loadOrExplain(streamOverride) {
+    let credentials;
     try {
-        return loadCredentials();
+        credentials = loadCredentials();
     }
     catch (err) {
         if (err instanceof CredentialsMissingError) {
@@ -239,6 +247,13 @@ function loadOrExplain() {
         }
         throw err;
     }
+    const problem = storedCredentialsProblem(credentials, streamOverride ?? streamUrlFor(credentials, DEFAULT_WS_URL));
+    if (problem) {
+        process.stderr.write(`✗ Refusing to send the API key: ${problem} Re-pair with an https:// --base-url ` +
+            '(prohost agent pair --code <code>).\n');
+        return null;
+    }
+    return credentials;
 }
 async function installDaemonCommand(flags) {
     const exec = flagString(flags, 'exec');
@@ -246,7 +261,7 @@ async function installDaemonCommand(flags) {
         process.stderr.write("Missing required flag: --exec. Example: prohost agent install-daemon --exec 'claude -p'\n");
         return 1;
     }
-    const credentials = loadOrExplain();
+    const credentials = loadOrExplain(flagString(flags, 'url'));
     if (!credentials)
         return 1;
     if (!applyAccountFlag(flags))
@@ -380,7 +395,7 @@ async function runCommand(flags) {
         process.stderr.write("Missing required flag: --exec. Example: prohost agent run --exec 'claude -p'\n");
         return 1;
     }
-    const credentials = loadOrExplain();
+    const credentials = loadOrExplain(flagString(flags, 'url') ?? process.env.PROHOST_WS_URL);
     if (!credentials)
         return 1;
     const parsedTimeout = parseTimeoutSeconds(flags);

package/dist/agent/credentials.d.ts

@@ -69,6 +69,15 @@ export declare const CREDENTIALS_VERSION = 2;
  * @param fallback Used when neither the stored URL nor ``base_url`` is usable.
  */
 export declare function streamUrlFor(credentials: AgentCredentials, fallback: string): string;
+/**
+ * Turn an API base URL into the websocket URL on the same host.
+ *
+ * Mirrors the server's derivation (`shared/agents/connections.py`
+ * ``pairing_endpoints``): only plain ``http`` maps to ``ws``, so a local dev
+ * base keeps working and nothing else can downgrade a socket that carries an
+ * API key. Returns ``undefined`` for anything not parseable as a URL.
+ */
+export declare function wsUrlFromBaseUrl(baseUrl: string | undefined): string | undefined;
 /** Directory holding CLI state. Overridable with ``$PROHOST_HOME`` for tests. */
 export declare function prohostHome(env?: NodeJS.ProcessEnv): string;
 /** Absolute path of the credential file. */

package/dist/agent/credentials.js

@@ -47,7 +47,7 @@ export function streamUrlFor(credentials, fallback) {
  * base keeps working and nothing else can downgrade a socket that carries an
  * API key. Returns ``undefined`` for anything not parseable as a URL.
  */
-function wsUrlFromBaseUrl(baseUrl) {
+export function wsUrlFromBaseUrl(baseUrl) {
     if (!baseUrl)
         return undefined;
     let parsed;