uplink-cli 0.2.1 → 0.2.3

package/AGENTS.md

@@ -112,9 +112,12 @@ Notes:
 ## Custom domains
 
 Registrar inventory is CLI. Attach/verify is under `host domains`.  
-The bare `uplink domains` search TUI is **optional** and not bundled with npm — use the JSON commands below.
+The bare `uplink domains` command opens Find a domain. Agents should use JSON:
 
 ```bash
+uplink domains search acme --json
+uplink domains check example.com --json
+uplink domains list --json
 uplink domains providers connect godaddy --token-env GODADDY_PAT --json
 uplink domains providers connect cloudflare --token-env CF_API_TOKEN --json
 uplink domains providers connect hostinger --token-env HOSTINGER_API_TOKEN --json
@@ -123,9 +126,6 @@ uplink domains providers connect namecheap --token-env NAMECHEAP_API_KEY --user-
 uplink domains providers list --json
 uplink domains providers disconnect godaddy --json
 
-uplink domains list --json
-uplink domains check example.com --json
-
 echo "$TOKEN" | uplink --token-stdin host domains add --id app_xxx --hostname example.com --json
 echo "$TOKEN" | uplink --token-stdin host domains verify --id app_xxx --hostname example.com --json
 echo "$TOKEN" | uplink --token-stdin host domains list --id app_xxx --json
@@ -150,7 +150,7 @@ echo "$TOKEN" | uplink --token-stdin db delete --id db_xxx --yes --json
 | URL 502 / not connected | Local process on `--port` not running, or client died — re-run `tunnel create` or check `tunnel list` |
 | Auth errors | Missing/invalid `AGENTCLOUD_TOKEN`; use `--token-stdin` |
 | `ALIAS_NOT_ENABLED` | Account does not have permanent aliases |
-| Domain search TUI missing | Expected on npm — use `domains list` / `check` / `host domains *` |
+| Domain search TUI missing | Not a TTY — use `domains search NAME --json` |
 | `HOST_APP_LIMIT_REACHED` | Free plan is 1 hosted app — delete one or the account needs hosting granted |
 | `HOST_STORAGE_LIMIT_REACHED` | Upload exceeds the 100 MB free hosting budget |
 | `HOST_DOMAIN_NOT_ENABLED` | Custom domains are paid — `*.host.uplink.spot` still works |

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.2.3 — 2026-08-30
+
+New **`uplink upgrade`** (Uplink Pro subscription — $9/mo or `--yearly` $90/yr via Stripe Checkout) and **`uplink billing`** (Stripe billing portal for cancel/card changes). Pro unlocks unlimited hosted apps within 1 GB of storage, always-on for your 5 most-active apps, custom domains, and permanent aliases.
+
+Fix global CLI crash on every command (`host list`, `login`, …): `domains.ts` was statically importing Ink, so tsx tried to load `yoga-layout` as CommonJS (`Top-level await is currently not supported with the "cjs" output format`). Interactive Find a domain now runs as a child ESM process, same as the menu.
+
+## 0.2.2 — 2026-08-29
+
+Built-in **Find a domain** in the CLI (no Domainking install). Type a label to check common TLDs via DNS/RDAP. `uplink domains` opens it; agents use `uplink domains search acme --json`. Domainking remains a separate app.
+
 ## 0.2.1 — 2026-08-29
 
 Ship `tsconfig.json` in the npm tarball so the menu's JSX compiles with `react-jsx`. 0.2.0 global installs crashed with `React is not defined` because tsx had no config and used the classic `React.createElement` transform.

package/README.md

@@ -101,7 +101,7 @@ export TUNNEL_DOMAIN=x.uplink.spot
 - URL not live — ensure something is listening on the port and the client started (`tunnel list` → `connected`)
 - Auth errors — verify `AGENTCLOUD_TOKEN` or `~/.uplink/credentials`; prefer `--token-stdin` for agents
 - Relay errors — `TUNNEL_CTRL=tunnel.uplink.spot:7071`
-- Domain search TUI — not bundled on npm; use `domains list` / `check` / `host domains *`
+- Domain search — `uplink domains` or `uplink domains search acme --json` (public DNS/RDAP)
 
 ## Docs
 - Agents: [AGENTS.md](./AGENTS.md)

package/cli/src/index.ts

@@ -10,6 +10,7 @@ import { signupCommand } from "./subcommands/signup";
 import { systemCommand } from "./subcommands/system";
 import { hostCommand } from "./subcommands/host";
 import { domainsCommand } from "./subcommands/domains";
+import { upgradeCommand, billingCommand } from "./subcommands/upgrade";
 import { readFileSync } from "fs";
 import { join } from "path";
 import { ensureApiBase, parseTokenEnv } from "./utils/api-base";
@@ -39,6 +40,8 @@ program.addCommand(systemCommand);
 program.addCommand(menuCommand);
 program.addCommand(hostCommand);
 program.addCommand(domainsCommand);
+program.addCommand(upgradeCommand);
+program.addCommand(billingCommand);
 
 // Global pre-action hook to apply shared options
 let cachedTokenStdin: string | null = null;

package/cli/src/subcommands/dev.ts

@@ -39,19 +39,15 @@ export const devCommand = new Command("dev")
 
       const clientPath = resolveTunnelClientPath();
       const ctrlHost = process.env.TUNNEL_CTRL ?? "tunnel.uplink.spot:7071";
-      const args = [
-        clientPath,
-        "--token",
-        result.token,
-        "--port",
-        String(port),
-        "--ctrl",
-        ctrlHost,
-      ];
+      // Token goes through the environment, never argv (see tunnel-clients.ts).
+      const args = [clientPath, "--port", String(port), "--ctrl", ctrlHost];
       if (!opts.json) {
-        console.log(`Starting tunnel client: node ${args.join(" ")}`);
+        console.log(`Starting tunnel client on port ${port} via ${ctrlHost}`);
       }
-      const child = spawn("node", args, { stdio: "inherit" });
+      const child = spawn("node", args, {
+        stdio: "inherit",
+        env: { ...process.env, TUNNEL_TOKEN: result.token },
+      });
 
       const shutdown = () => {
         try {

package/cli/src/subcommands/domains.ts

@@ -1,6 +1,7 @@
 import { Command } from "commander";
-import { launchDomainking } from "../utils/launchDomainking";
+import { join } from "path";
 import { handleError, printJson } from "../utils/machine";
+import { runEsmEntry } from "../utils/run-esm";
 import {
   adapters,
   getAdapter,
@@ -18,6 +19,15 @@ import {
   checkDomainAvailability,
   formatPublicAvailability,
 } from "../utils/domain-availability";
+import { searchDomains } from "../utils/domain-search";
+
+function runDomainSearchTui(): void {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    console.log("Domain search needs a terminal. Agents: uplink domains search myapp --json");
+    return;
+  }
+  runEsmEntry(join(__dirname, "../tui/domain-search.mts"));
+}
 
 // DreamHost last: it can only confirm ownership, not quote availability.
 const CHECK_ORDER: ProviderId[] = ["godaddy", "cloudflare", "hostinger", "namecheap", "dreamhost"];
@@ -133,12 +143,11 @@ export const domainsCommand = new Command("domains").description(
 
 domainsCommand.addHelpText(
   "after",
-  "\nWith no subcommand, opens the domain search TUI.\n"
+  "\nWith no subcommand, opens Find a domain (type a name; common TLDs are checked via DNS/RDAP).\n"
 );
 
 domainsCommand.action(() => {
-  const message = launchDomainking();
-  if (message) console.log(message);
+  runDomainSearchTui();
 });
 
 domainsCommand
@@ -213,6 +222,40 @@ domainsCommand
     }
   });
 
+domainsCommand
+  .command("search")
+  .description("Search a label across common TLDs, or check one exact domain")
+  .argument("[name]", "Bare label (acme) or full domain (acme.io)")
+  .option("--json", "Output JSON", false)
+  .action(async (name: string | undefined, opts: { json?: boolean }) => {
+    try {
+      if (!name) {
+        if (opts.json) throw new Error("Pass a name: uplink domains search acme --json");
+        runDomainSearchTui();
+        return;
+      }
+      const results = await searchDomains(name);
+      if (opts.json) {
+        printJson({
+          query: name,
+          results: results.map((item) => ({
+            domain: item.domain,
+            provider: "public",
+            status: item.status,
+            buyable: null,
+            detail: item.detail,
+          })),
+        });
+        return;
+      }
+      for (const item of results) {
+        console.log(`${item.domain.padEnd(28)} ${item.status}`);
+      }
+    } catch (error) {
+      handleError(error, { json: opts.json });
+    }
+  });
+
 const providers = domainsCommand.command("providers").description("Connect registrar accounts");
 
 providers

package/cli/src/subcommands/host.ts

@@ -233,11 +233,19 @@ const DEFAULT_TARBALL_EXCLUDES = [
   "npm-debug.log*",
   "yarn-debug.log*",
   "yarn-error.log*",
-  // Environment files (should use --env-file or uplink.host.json)
+  // Environment files (should use --env-file or uplink.host.json). Secrets must
+  // never be baked into the uploaded artifact/image layers — env is delivered
+  // separately via the app config API. The wizard creates .env.production, so it
+  // is critical that it is excluded here.
   ".env",
   ".env.local",
   ".env.development",
   ".env.development.local",
+  ".env.production",
+  ".env.production.local",
+  ".env.test",
+  ".env.test.local",
+  ".env.*.local",
   // Misc
   "*.pid",
   "*.seed",
@@ -334,6 +342,19 @@ function makeTarball(sourceDir: string): { tarPath: string; sizeBytes: number; s
   return { tarPath: tmp, sizeBytes: st.size, sha256 };
 }
 
+// Only send the account bearer to a URL that shares the resolved API origin.
+// The upload/complete URLs come from the server response; a compromised or
+// spoofed API could otherwise point them at an attacker host and exfiltrate the
+// token. Presigned storage URLs (different origin) must authenticate solely via
+// their signed headers.
+function isApiOriginUrl(target: string): boolean {
+  try {
+    return new URL(target).origin === new URL(getResolvedApiBase()).origin;
+  } catch {
+    return false;
+  }
+}
+
 async function uploadArtifact(
   uploadUrl: string,
   tarPath: string,
@@ -341,14 +362,21 @@ async function uploadArtifact(
 ): Promise<any> {
   const hasSignedHeaders = uploadHeaders && Object.keys(uploadHeaders).length > 0;
   const token = getApiToken();
+  const sameOrigin = isApiOriginUrl(uploadUrl);
   if (!hasSignedHeaders && !token) throw new Error("Missing AGENTCLOUD_TOKEN");
+  if (!hasSignedHeaders && token && !sameOrigin) {
+    throw new Error(
+      `Refusing to send credentials to non-API upload host (${new URL(uploadUrl).host}). ` +
+        `Expected signed upload headers from the API.`
+    );
+  }
 
   const headers: Record<string, string> = { ...(uploadHeaders || {}) };
   if (!headers["Content-Type"]) headers["Content-Type"] = "application/octet-stream";
   if (!headers["Content-Length"]) {
     headers["Content-Length"] = String(statSync(tarPath).size);
   }
-  if (!hasSignedHeaders && token) headers.Authorization = `Bearer ${token}`;
+  if (!hasSignedHeaders && token && sameOrigin) headers.Authorization = `Bearer ${token}`;
 
   const res = await fetch(uploadUrl, {
     method: "PUT",
@@ -369,6 +397,11 @@ async function completeArtifactUpload(completeUrl?: string): Promise<void> {
   if (!completeUrl) return;
   const token = getApiToken();
   if (!token) throw new Error("Missing AGENTCLOUD_TOKEN");
+  if (!isApiOriginUrl(completeUrl)) {
+    throw new Error(
+      `Refusing to send credentials to non-API complete host (${new URL(completeUrl).host}).`
+    );
+  }
 
   const res = await fetch(completeUrl, {
     method: "POST",

package/cli/src/subcommands/menu/effects/token-config.ts

@@ -1,6 +1,6 @@
 import { homedir } from "os";
 import { join } from "path";
-import { existsSync, readFileSync, statSync, writeFileSync } from "fs";
+import { chmodSync, existsSync, readFileSync, statSync, writeFileSync } from "fs";
 
 export type DetectedShell = { shellName: "zsh" | "bash" | ""; configFile: string | null };
 
@@ -53,11 +53,16 @@ export function upsertShellToken(configFile: string, token: string): { wrote: bo
   const configContent = existsSync(configFile) ? readFileSync(configFile, "utf-8") : "";
   const lines = configContent.split("\n");
 
+  // Single-quote the value so shell metacharacters in a token can't be
+  // interpreted (escape any embedded single quote the POSIX way).
+  const quotedToken = `'${token.replace(/'/g, "'\\''")}'`;
+  const exportLine = `export AGENTCLOUD_TOKEN=${quotedToken}`;
+
   let replaced = false;
   const updatedLines = lines.map((line) => {
     if (line.match(/^\s*export\s+AGENTCLOUD_TOKEN=/)) {
       replaced = true;
-      return `export AGENTCLOUD_TOKEN=${token}`;
+      return exportLine;
     }
     return line;
   });
@@ -65,11 +70,17 @@ export function upsertShellToken(configFile: string, token: string): { wrote: bo
   if (!replaced) {
     updatedLines.push("");
     updatedLines.push("# Uplink API Token (added automatically)");
-    updatedLines.push(`export AGENTCLOUD_TOKEN=${token}`);
+    updatedLines.push(exportLine);
   }
 
-  writeFileSync(configFile, updatedLines.join("\n"), { flag: "w", mode: 0o644 });
+  // The file holds a secret; write it 0600 so other local users can't read it.
+  writeFileSync(configFile, updatedLines.join("\n"), { flag: "w", mode: 0o600 });
+  try {
+    chmodSync(configFile, 0o600);
+  } catch {
+    /* best-effort tightening if the file pre-existed with wider mode */
+  }
   const verifyContent = readFileSync(configFile, "utf-8");
-  return { wrote: true, verifyOk: verifyContent.includes(`export AGENTCLOUD_TOKEN=${token}`) };
+  return { wrote: true, verifyOk: verifyContent.includes(exportLine) };
 }
 

package/cli/src/subcommands/menu/effects/tunnel-clients.ts

@@ -1,5 +1,6 @@
 import { execSync, spawn } from "child_process";
-import { existsSync } from "fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "fs";
+import { homedir } from "os";
 import path from "path";
 import { resolveProjectRoot } from "../../../utils/project-root";
 
@@ -14,6 +15,48 @@ export function resolveTunnelClientPath(): string {
   return clientPath;
 }
 
+// The tunnel token must not appear on the child's argv (it would be readable via
+// `ps` by any local user, who could then hijack the tunnel). We pass it through
+// the environment instead and keep a 0600 registry mapping pid -> {port, token}
+// so `list`/`stop` can still correlate local clients to their API tunnels.
+function registryDir(): string {
+  return path.join(homedir(), ".uplink", "tunnels");
+}
+
+function registryPath(pid: number): string {
+  return path.join(registryDir(), `${pid}.json`);
+}
+
+function writeTunnelRegistry(pid: number, entry: { port: number; token: string }): void {
+  try {
+    mkdirSync(registryDir(), { recursive: true, mode: 0o700 });
+    writeFileSync(registryPath(pid), JSON.stringify(entry), { mode: 0o600 });
+  } catch {
+    /* registry is best-effort; token stays out of argv regardless */
+  }
+}
+
+function readTunnelRegistry(pid: number): { port: number; token: string } | null {
+  try {
+    const raw = readFileSync(registryPath(pid), "utf-8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed?.token === "string" && typeof parsed?.port === "number") {
+      return { port: parsed.port, token: parsed.token };
+    }
+  } catch {
+    /* missing/corrupt entry */
+  }
+  return null;
+}
+
+function removeTunnelRegistry(pid: number): void {
+  try {
+    rmSync(registryPath(pid), { force: true });
+  } catch {
+    /* ignore */
+  }
+}
+
 /** Start the local tunnel client in the background (detached). */
 export function startTunnelClient(opts: {
   token: string;
@@ -25,17 +68,19 @@ export function startTunnelClient(opts: {
   const ctrl = opts.ctrl || process.env.TUNNEL_CTRL || "tunnel.uplink.spot:7071";
   const clientProcess = spawn(
     "node",
-    [clientPath, "--token", opts.token, "--port", String(opts.port), "--ctrl", ctrl],
+    [clientPath, "--port", String(opts.port), "--ctrl", ctrl],
     {
       stdio: "ignore",
       detached: true,
       cwd: projectRoot,
+      env: { ...process.env, TUNNEL_TOKEN: opts.token },
     }
   );
   clientProcess.unref();
   if (!clientProcess.pid) {
     throw new Error("Failed to start tunnel client process");
   }
+  writeTunnelRegistry(clientProcess.pid, { port: opts.port, token: opts.token });
   return { pid: clientProcess.pid, clientPath };
 }
 
@@ -51,20 +96,34 @@ export function findTunnelClients(): TunnelClient[] {
       .filter((line) => line.includes("scripts/tunnel/client-improved.js"));
 
     const clients: TunnelClient[] = [];
+    const livePids = new Set<number>();
 
     for (const line of lines) {
-      // Parse process line: PID COMMAND (from ps -o pid=,command=)
+      // Parse process line: PID COMMAND (from ps -o pid=,command=). The token is
+      // no longer on argv, so we only read pid + port here and recover the token
+      // from the 0600 registry written at start time.
       const pidMatch = line.match(/^\s*(\d+)/);
-      const tokenMatch = line.match(/--token\s+(\S+)/);
       const portMatch = line.match(/--port\s+(\d+)/);
+      if (!pidMatch || !portMatch) continue;
+
+      const pid = parseInt(pidMatch[1], 10);
+      livePids.add(pid);
+      const registry = readTunnelRegistry(pid);
+      clients.push({
+        pid,
+        port: parseInt(portMatch[1], 10),
+        token: registry?.token ?? "",
+      });
+    }
 
-      if (pidMatch && tokenMatch && portMatch) {
-        clients.push({
-          pid: parseInt(pidMatch[1], 10),
-          port: parseInt(portMatch[1], 10),
-          token: tokenMatch[1],
-        });
+    // Garbage-collect registry entries for clients that are no longer running.
+    try {
+      for (const file of readdirSync(registryDir())) {
+        const pid = parseInt(file.replace(/\.json$/, ""), 10);
+        if (Number.isFinite(pid) && !livePids.has(pid)) removeTunnelRegistry(pid);
       }
+    } catch {
+      /* registry dir may not exist yet */
     }
 
     return clients;
@@ -74,6 +133,7 @@ export function findTunnelClients(): TunnelClient[] {
 }
 
 export function killTunnelClient(pid: number): boolean {
+  removeTunnelRegistry(pid);
   try {
     process.kill(pid, "SIGTERM");
   } catch {

package/cli/src/subcommands/menu/menus/domain-check.ts

@@ -1,34 +1,14 @@
-import { launchDomainking, resolveDomainkingEntry } from "../../../utils/launchDomainking";
-import { runCliCapture } from "./hosting";
+import { runDomainSearch } from "../../../tui/DomainSearch";
 
 type Deps = {
   promptLine: (question: string) => Promise<string>;
   restoreRawMode: () => void;
 };
 
-/**
- * Shared "find a domain" action: the Domainking search TUI when it is
- * available, otherwise an inline prompt against `uplink domains check`
- * (which works without a registrar via public DNS/RDAP).
- */
+/** Built-in Find a domain TUI (DNS + RDAP). Domainking remains a separate app. */
 export function buildFindDomainAction(deps: Deps): () => Promise<string> {
   return async () => {
-    if (resolveDomainkingEntry()) {
-      deps.restoreRawMode();
-      return launchDomainking();
-    }
-
-    const domain = (await deps.promptLine("Domain to check (e.g. example.com, or back): "))
-      .trim()
-      .toLowerCase();
     deps.restoreRawMode();
-    if (!domain || domain === "back") return "";
-    if (!domain.includes(".")) return "Pass a full domain like example.com";
-
-    try {
-      return runCliCapture(["domains", "check", domain]) || `${domain}: no result.`;
-    } catch (error) {
-      return error instanceof Error ? error.message : String(error);
-    }
+    return runDomainSearch();
   };
 }

package/cli/src/subcommands/menu/menus/domains.ts

@@ -187,6 +187,7 @@ export function buildDomainsMenu(deps: Deps): MenuChoice {
             "CLI (agents):",
             "  uplink domains providers connect godaddy --token-env GODADDY_PAT --json",
             "  uplink domains list --json",
+            "  uplink domains search acme --json",
             "  uplink domains check example.com --json",
             "  uplink host domains add --id <app> --hostname example.com --json",
           ].join("\n");

package/cli/src/subcommands/menu/render.ts

@@ -1,6 +1,7 @@
 import { clearScreen } from "./io";
 import { colorBold, colorDim, colorGreen, colorRed } from "./colors";
 import { DEFAULT_MENU_MESSAGE, type MenuChoice } from "./types";
+import { sanitizeForTerminal } from "../../utils/sanitize";
 
 export type RenderArgs = {
   banner: string;
@@ -100,8 +101,9 @@ export function renderMenu(args: RenderArgs) {
     console.log(colorDim("Working..."));
   } else if (message && message !== DEFAULT_MENU_MESSAGE) {
     console.log();
-    // Format multi-line messages nicely
-    const lines = message.split("\n");
+    // Format multi-line messages nicely (strip any control/ANSI sequences that
+    // may have come from server- or registrar-controlled data).
+    const lines = sanitizeForTerminal(message).split("\n");
     lines.forEach((line) => {
       // Color success/error indicators
       const styledLine = line

package/cli/src/subcommands/menu.ts

@@ -1,23 +1,6 @@
 import { Command } from "commander";
-import { spawnSync } from "child_process";
 import { join } from "path";
-
-function projectRoot(): string {
-  return join(__dirname, "../../..");
-}
-
-function resolveTsx(): string {
-  const root = projectRoot();
-  try {
-    return require.resolve("tsx/dist/cli.cjs", { paths: [root] });
-  } catch {
-    try {
-      return require.resolve("tsx/cli", { paths: [root] });
-    } catch {
-      return "tsx";
-    }
-  }
-}
+import { runEsmEntry } from "../utils/run-esm";
 
 /**
  * Ink 6 is ESM-only (yoga-layout uses top-level await). The CLI package is
@@ -30,12 +13,5 @@ export const menuCommand = new Command("menu")
       console.error("Uplink menu needs an interactive terminal. Use `uplink --help` for commands.");
       process.exit(1);
     }
-    const entry = join(__dirname, "../tui/index.mts");
-    const result = spawnSync(resolveTsx(), [entry], {
-      stdio: "inherit",
-      cwd: projectRoot(),
-      env: process.env,
-    });
-    if (result.error) throw result.error;
-    process.exit(result.status ?? 0);
+    runEsmEntry(join(__dirname, "../tui/index.mts"));
   });

package/cli/src/subcommands/upgrade.ts

@@ -0,0 +1,62 @@
+import { Command } from "commander";
+import { spawn } from "child_process";
+import { apiRequest } from "../http";
+import { handleError, printJson } from "../utils/machine";
+
+function openInBrowser(url: string): void {
+  const [cmd, args] =
+    process.platform === "darwin"
+      ? ["open", [url]]
+      : process.platform === "win32"
+        ? ["cmd", ["/c", "start", "", url]]
+        : ["xdg-open", [url]];
+  try {
+    spawn(cmd, args, { detached: true, stdio: "ignore" }).unref();
+  } catch {
+    // Non-fatal: the URL is printed either way.
+  }
+}
+
+export const upgradeCommand = new Command("upgrade")
+  .description("Upgrade to Uplink Pro — unlimited apps in 1 GB, 5 always-on, custom domains, aliases")
+  .option("--yearly", "Yearly billing (2 months free)", false)
+  .option("--json", "Output JSON (prints the checkout URL, does not open a browser)", false)
+  .action(async (opts) => {
+    try {
+      const interval = opts.yearly ? "year" : "month";
+      const result = await apiRequest("POST", "/v1/billing/checkout", { interval });
+      if (opts.json) {
+        printJson({ url: result.url, interval: result.interval });
+        return;
+      }
+      console.log("");
+      console.log("Uplink Pro — complete your upgrade in the browser:");
+      console.log("");
+      console.log(`  ${result.url}`);
+      console.log("");
+      openInBrowser(result.url);
+    } catch (error) {
+      handleError(error, { json: opts.json });
+    }
+  });
+
+export const billingCommand = new Command("billing")
+  .description("Manage your subscription (opens the Stripe billing portal)")
+  .option("--json", "Output JSON (prints the portal URL, does not open a browser)", false)
+  .action(async (opts) => {
+    try {
+      const result = await apiRequest("POST", "/v1/billing/portal");
+      if (opts.json) {
+        printJson({ url: result.url });
+        return;
+      }
+      console.log("");
+      console.log("Manage your subscription here:");
+      console.log("");
+      console.log(`  ${result.url}`);
+      console.log("");
+      openInBrowser(result.url);
+    } catch (error) {
+      handleError(error, { json: opts.json });
+    }
+  });

package/cli/src/tui/App.tsx

@@ -3,7 +3,9 @@ import { useState } from "react";
 import type { MenuChoice } from "../subcommands/menu/types";
 import { HomeStatus } from "./HomeStatus";
 import { AppInspector } from "./AppInspector";
+import { Wordmark } from "./brand";
 import { cleanLabel } from "./format";
+import { sanitizeForTerminal } from "../utils/sanitize";
 
 export type TunnelLine = { url: string; port: number };
 
@@ -139,18 +141,14 @@ export function MenuApp({
 
   return (
     <Box flexDirection="column" paddingX={1} paddingY={1}>
+      <Wordmark />
       {atRoot ? (
         <HomeStatus status={status} />
-      ) : (
-        <Box flexDirection="column">
-          <Text dimColor>UPLINK</Text>
-          {crumb ? (
-            <Box marginTop={1}>
-              <Text dimColor>{crumb}</Text>
-            </Box>
-          ) : null}
+      ) : crumb ? (
+        <Box marginTop={1}>
+          <Text dimColor>{crumb}</Text>
         </Box>
-      )}
+      ) : null}
 
       <Box flexDirection="column" marginTop={atRoot ? 1 : 1}>
         {current.map((choice, i) => {
@@ -178,7 +176,7 @@ export function MenuApp({
 
       {notice ? (
         <Box flexDirection="column" marginTop={1}>
-          {notice.split("\n").map((line, i) => (
+          {sanitizeForTerminal(notice).split("\n").map((line, i) => (
             <Text key={i} color={noticeColor(line)} dimColor={!noticeColor(line)}>
               {line || " "}
             </Text>

package/cli/src/tui/DomainSearch.tsx

@@ -0,0 +1,115 @@
+import { Box, Text, useApp, useInput, render } from "ink";
+import { Wordmark } from "./brand";
+import TextInput from "ink-text-input";
+import { useEffect, useRef, useState } from "react";
+import type { PublicAvailability } from "../utils/domain-availability";
+import { expandDomainQuery } from "../utils/domain-search";
+import { checkDomainAvailability } from "../utils/domain-availability";
+import { prepareStdinForPrompt } from "../subcommands/menu/io";
+
+type Row = PublicAvailability | { domain: string; status: "checking" };
+
+const DEBOUNCE_MS = 400;
+
+function useLiveChecks(raw: string): Row[] {
+  const [rows, setRows] = useState<Row[]>([]);
+  const generation = useRef(0);
+
+  useEffect(() => {
+    const gen = ++generation.current;
+    const domains = expandDomainQuery(raw);
+    if (domains.length === 0) {
+      setRows([]);
+      return;
+    }
+    setRows(domains.map((domain) => ({ domain, status: "checking" as const })));
+    const timer = setTimeout(() => {
+      for (const domain of domains) {
+        void checkDomainAvailability(domain).then((result) => {
+          if (generation.current !== gen) return;
+          setRows((prev) => prev.map((row) => (row.domain === domain ? result : row)));
+        });
+      }
+    }, DEBOUNCE_MS);
+    return () => clearTimeout(timer);
+  }, [raw]);
+
+  return rows;
+}
+
+function statusColor(status: Row["status"]): string | undefined {
+  if (status === "available") return "green";
+  if (status === "taken") return undefined;
+  if (status === "unknown") return "yellow";
+  return undefined;
+}
+
+function DomainSearchApp() {
+  const { exit } = useApp();
+  const [query, setQuery] = useState("");
+  const [showTaken, setShowTaken] = useState(false);
+  const rows = useLiveChecks(query);
+  const pending = rows.some((row) => row.status === "checking");
+  const available = rows.filter((row) => row.status === "available");
+  const taken = rows.filter((row) => row.status === "taken");
+  const rest = rows.filter((row) => row.status !== "taken");
+
+  useInput((_input, key) => {
+    if (key.escape) exit();
+    if (key.tab) setShowTaken((prev) => !prev);
+  });
+
+  return (
+    <Box flexDirection="column" paddingX={1} paddingY={1}>
+      <Wordmark />
+      <Box marginTop={1}>
+        <Text>Find a domain</Text>
+      </Box>
+      <Box marginTop={1}>
+        <Text dimColor>search › </Text>
+        <TextInput value={query} onChange={setQuery} placeholder="acme   or   acme.io" />
+      </Box>
+      {rest.length > 0 && (
+        <Box flexDirection="column" marginTop={1}>
+          {rest.map((row) => (
+            <Text key={row.domain} color={statusColor(row.status)} dimColor={row.status === "checking"}>
+              {row.status === "checking" ? "·" : row.status === "available" ? "✓" : "?"} {row.domain}
+            </Text>
+          ))}
+        </Box>
+      )}
+      {taken.length > 0 && (
+        <Box flexDirection="column" marginTop={1}>
+          {showTaken ? (
+            taken.map((row) => (
+              <Text key={row.domain} dimColor>
+                × {row.domain}
+              </Text>
+            ))
+          ) : (
+            <Text dimColor>
+              {taken.length} taken · tab to show
+            </Text>
+          )}
+        </Box>
+      )}
+      <Box marginTop={1}>
+        <Text dimColor>
+          {rows.length > 0 && !pending ? `${available.length} of ${rows.length} free · ` : ""}
+          tab taken · esc back · DNS + RDAP, no registrar required
+        </Text>
+      </Box>
+    </Box>
+  );
+}
+
+export async function runDomainSearch(): Promise<string> {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    return "Domain search needs a terminal. Agents: uplink domains search myapp --json";
+  }
+  const instance = render(<DomainSearchApp />);
+  await instance.waitUntilExit();
+  instance.unmount();
+  prepareStdinForPrompt();
+  return "";
+}

package/cli/src/tui/HomeStatus.tsx

@@ -1,6 +1,5 @@
 import { Box, Text } from "ink";
 import type { MenuStatus } from "./App";
-import { Wordmark } from "./brand";
 import { formatBytes } from "./format";
 
 const LABEL_WIDTH = 12;
@@ -64,7 +63,6 @@ export function HomeStatus({ status }: { status: MenuStatus }) {
 
   return (
     <Box flexDirection="column">
-      <Wordmark />
       <Box marginTop={1}>
         <Text color={status.connected ? "green" : "yellow"}>
           ● {status.connected ? "connected" : "offline"}

package/cli/src/tui/brand.tsx

@@ -1,12 +1,15 @@
 import { Box, Text } from "ink";
 
+/** Same wordmark as uplink.spot (`pre.wordmark` in index.html). */
 const WORDMARK = [
   " _   _ ___ _    ___ _  _ _  __",
   "| | | | _ \\ |  |_ _| \\| | |/ /",
-  "| |_| |  _/ |__ | || .` | ' < ",
-  " \\___/|_| |____|___|_|\\_|_|\\_\\",
+  "| |_| |  _/ |__ | || .` | ' <",
+  " \\___/|_| |____|___|_|\\__|_|\\_\\",
 ];
 
+export const WORDMARK_TEXT = WORDMARK.join("\n");
+
 export function Wordmark() {
   return (
     <Box flexDirection="column">

package/cli/src/tui/domain-search.mts

@@ -0,0 +1,10 @@
+import { runDomainSearch } from "./DomainSearch.tsx";
+
+runDomainSearch()
+  .then((message) => {
+    if (message) console.log(message);
+  })
+  .catch((error) => {
+    console.error(error instanceof Error ? error.message : error);
+    process.exit(1);
+  });

package/cli/src/tui/session.mts

@@ -20,6 +20,7 @@ import {
 } from "../subcommands/menu/menus";
 import { buildFindDomainAction } from "../subcommands/menu/menus/domain-check";
 import { ports, smoke, tunnelClients } from "../subcommands/menu/effects";
+import { WORDMARK_TEXT } from "./brand";
 import { runInkMenu } from "./runMenu";
 import { fetchMenuSnapshot } from "./snapshot";
 import { isEmail, normalizeEmail, persistLogin, requestLoginCode, verifyLoginCode } from "../utils/login-flow";
@@ -38,7 +39,8 @@ async function continueWithEmail(): Promise<string | undefined> {
   clearScreen();
   try {
     process.stdout.write("\n");
-    process.stdout.write(colorWhite("UPLINK") + colorDim("  Continue with email\n\n"));
+    process.stdout.write(colorWhite(WORDMARK_TEXT) + "\n");
+    process.stdout.write(colorDim("Continue with email\n\n"));
     const email = normalizeEmail(await promptLine("Email: "));
     if (!isEmail(email)) return "Invalid email.";
 
@@ -200,7 +202,7 @@ export async function startMenuSession(): Promise<void> {
 
     if (accountType === "guest") {
       mainMenu.push({
-        label: "Check domain availability",
+        label: "Find a domain",
         action: buildFindDomainAction({ promptLine, restoreRawMode }),
       });
       mainMenu.push({

package/cli/src/utils/api-base.ts

@@ -28,6 +28,12 @@ export function normalizeApiBase(input: string | undefined | null): string | nul
   try {
     const url = new URL(value);
     if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+    // The bearer token is sent to this origin. Never allow plaintext HTTP for a
+    // remote host — only loopback, where there's no on-path attacker.
+    const host = url.hostname;
+    const isLoopback =
+      host === "localhost" || host === "127.0.0.1" || host === "0.0.0.0" || host === "::1";
+    if (url.protocol === "http:" && !isLoopback) return null;
     return url.origin;
   } catch {
     return null;

package/cli/src/utils/domain-search.ts

@@ -0,0 +1,57 @@
+import { checkDomainAvailability, type PublicAvailability } from "./domain-availability";
+
+export const DEFAULT_TLDS = [
+  "com",
+  "net",
+  "org",
+  "io",
+  "co",
+  "ai",
+  "dev",
+  "app",
+  "sh",
+  "xyz",
+  "me",
+  "gg",
+  "tech",
+  "cloud",
+];
+
+const SEARCH_CONCURRENCY = 5;
+
+export function normalizeDomainQuery(raw: string): string {
+  return raw
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9.-]/g, "");
+}
+
+/** Bare label fans out across default TLDs. A dotted query is one exact name. */
+export function expandDomainQuery(raw: string): string[] {
+  const query = normalizeDomainQuery(raw);
+  if (!query) return [];
+  if (query.includes(".")) {
+    const [label, ...rest] = query.split(".");
+    const tld = rest.join(".");
+    return label && tld ? [`${label}.${tld}`] : [];
+  }
+  return DEFAULT_TLDS.map((tld) => `${query}.${tld}`);
+}
+
+export async function searchDomains(raw: string): Promise<PublicAvailability[]> {
+  const domains = expandDomainQuery(raw);
+  const results = new Map<string, PublicAvailability>();
+  let index = 0;
+
+  async function worker() {
+    while (index < domains.length) {
+      const domain = domains[index++];
+      results.set(domain, await checkDomainAvailability(domain));
+    }
+  }
+
+  await Promise.all(
+    Array.from({ length: Math.min(SEARCH_CONCURRENCY, domains.length) }, () => worker())
+  );
+  return domains.map((domain) => results.get(domain)!);
+}

package/cli/src/utils/run-esm.ts

@@ -0,0 +1,38 @@
+import { spawnSync } from "child_process";
+import { existsSync } from "fs";
+import { join } from "path";
+
+export function cliPackageRoot(): string {
+  return join(__dirname, "../../..");
+}
+
+export function resolveTsx(): string {
+  const root = cliPackageRoot();
+  try {
+    return require.resolve("tsx/dist/cli.cjs", { paths: [root] });
+  } catch {
+    try {
+      return require.resolve("tsx/cli", { paths: [root] });
+    } catch {
+      return "tsx";
+    }
+  }
+}
+
+/**
+ * Ink 6 is ESM-only (yoga-layout uses top-level await). The CLI package is
+ * CommonJS, so Ink screens must run as a child ESM process rather than being
+ * imported from commander commands.
+ */
+export function runEsmEntry(entry: string): never {
+  const root = cliPackageRoot();
+  const tsconfigPath = join(root, "tsconfig.json");
+  const tsxArgs = existsSync(tsconfigPath) ? ["--tsconfig", tsconfigPath, entry] : [entry];
+  const result = spawnSync(resolveTsx(), tsxArgs, {
+    stdio: "inherit",
+    cwd: root,
+    env: process.env,
+  });
+  if (result.error) throw result.error;
+  process.exit(result.status ?? 0);
+}

package/cli/src/utils/sanitize.ts

@@ -0,0 +1,9 @@
+// Strip C0/C1 control characters (including ANSI escape sequences) from strings
+// that originate from the server or a registrar before printing them to the
+// terminal. Without this, an attacker-controlled app name, domain, or error body
+// could inject escape sequences to rewrite the terminal, spoof prompts, or hide
+// output. Newlines and tabs are preserved so multi-line messages still render.
+export function sanitizeForTerminal(input: string): string {
+  // eslint-disable-next-line no-control-regex
+  return String(input).replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f-\x9f]/g, "");
+}

package/docs/AGENTS.md

@@ -112,9 +112,12 @@ Notes:
 ## Custom domains
 
 Registrar inventory is CLI. Attach/verify is under `host domains`.  
-The bare `uplink domains` search TUI is **optional** and not bundled with npm — use the JSON commands below.
+The bare `uplink domains` command opens Find a domain. Agents should use JSON:
 
 ```bash
+uplink domains search acme --json
+uplink domains check example.com --json
+uplink domains list --json
 uplink domains providers connect godaddy --token-env GODADDY_PAT --json
 uplink domains providers connect cloudflare --token-env CF_API_TOKEN --json
 uplink domains providers connect hostinger --token-env HOSTINGER_API_TOKEN --json
@@ -123,9 +126,6 @@ uplink domains providers connect namecheap --token-env NAMECHEAP_API_KEY --user-
 uplink domains providers list --json
 uplink domains providers disconnect godaddy --json
 
-uplink domains list --json
-uplink domains check example.com --json
-
 echo "$TOKEN" | uplink --token-stdin host domains add --id app_xxx --hostname example.com --json
 echo "$TOKEN" | uplink --token-stdin host domains verify --id app_xxx --hostname example.com --json
 echo "$TOKEN" | uplink --token-stdin host domains list --id app_xxx --json
@@ -150,7 +150,7 @@ echo "$TOKEN" | uplink --token-stdin db delete --id db_xxx --yes --json
 | URL 502 / not connected | Local process on `--port` not running, or client died — re-run `tunnel create` or check `tunnel list` |
 | Auth errors | Missing/invalid `AGENTCLOUD_TOKEN`; use `--token-stdin` |
 | `ALIAS_NOT_ENABLED` | Account does not have permanent aliases |
-| Domain search TUI missing | Expected on npm — use `domains list` / `check` / `host domains *` |
+| Domain search TUI missing | Not a TTY — use `domains search NAME --json` |
 | `HOST_APP_LIMIT_REACHED` | Free plan is 1 hosted app — delete one or the account needs hosting granted |
 | `HOST_STORAGE_LIMIT_REACHED` | Upload exceeds the 100 MB free hosting budget |
 | `HOST_DOMAIN_NOT_ENABLED` | Custom domains are paid — `*.host.uplink.spot` still works |

package/docs/MENU_STRUCTURE.md

@@ -29,7 +29,7 @@ UPLINK
 ● connected
 
 Share                     → same full Share menu as verified users (no Aliases)
-Check domain availability → Domainking TUI if bundled, else inline `domains check` (public DNS/RDAP)
+Check domain availability → built-in Find a domain (DNS/RDAP across common TLDs)
 Continue with email       → preserve guest tunnel; unlock Hosting + Domains
 About
 Exit
@@ -76,15 +76,15 @@ CLI equivalents: `uplink host setup|deploy|list|status|logs|delete|analyze|prefl
 Domains
 ├── My domains              → uplink domains list
 ├── Connect registrar       → providers connect (token via env)
-├── Check availability      → domains check
+├── Find a domain           → built-in search TUI (also `uplink domains` / `domains search`)
 ├── Attach to app           → host domains add
 ├── Verify                  → host domains verify
 ├── List attached           → host domains list
 ├── Detach                  → host domains remove
-└── Search (optional TUI)   → Domainking if DOMAINKING_ENTRY / sibling repo exists
+└── Help
 ```
 
-Bare `uplink domains` opens the search TUI when available; otherwise it prints agent-friendly command hints.
+Bare `uplink domains` opens Find a domain. Agents use `domains search NAME --json` and `domains check example.com --json`.
 
 ---
 
@@ -106,4 +106,3 @@ CLI: `uplink admin status|tunnels|databases|tokens …`
 | `AGENTCLOUD_API_BASE` | API host | `https://api.uplink.spot` |
 | `TUNNEL_CTRL` | Relay | `tunnel.uplink.spot:7071` |
 | `TUNNEL_DOMAIN` | Tunnel DNS suffix | `x.uplink.spot` |
-| `DOMAINKING_ENTRY` | Optional search TUI entry | — |

package/docs/PRODUCT.md

@@ -18,7 +18,7 @@ Humans use `uplink` (keyboard menu). Agents use subcommands with `--json` and `-
 
 | Kind | How you get it | Can do | Cannot do |
 |------|----------------|--------|-----------|
-| **Guest** | Automatic on `tunnel create` or menu open | 1 tunnel (24h), public `domains check` | Hosting, databases, aliases, custom domains |
+| **Guest** | Automatic on `tunnel create` or menu open | 1 tunnel (24h), public domain search/check | Hosting, databases, aliases, custom domains |
 | **Verified** | `uplink login --email` then OTP | Guest plus hosting / DBs / registrars | Plan-gated extras (aliases, custom domains) |
 | **Admin** | Operator token in the control plane | Everything + Usage / System Status / Manage Tokens | — |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uplink-cli",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Software for agents — share localhost, host apps, and attach domains from the terminal. JSON-first CLI for Cursor, Claude, Codex, and Windsurf.",
   "keywords": [
     "ai-agents",

package/scripts/tunnel/client-improved.js

@@ -29,9 +29,13 @@ function parseArgs() {
   return out;
 }
 
-const { token, port, ctrl, maxSize } = parseArgs();
+const parsed = parseArgs();
+// Prefer the token from the environment so it never appears on argv (which is
+// world-readable via `ps`). The --token flag is kept only for backwards compat.
+const token = process.env.TUNNEL_TOKEN || parsed.token;
+const { port, ctrl, maxSize } = parsed;
 if (!token || !port || !ctrl) {
-  console.error("Usage: node scripts/tunnel/client-improved.js --token <token> --port <port> --ctrl <host:port> [--max-size <bytes>]");
+  console.error("Usage: TUNNEL_TOKEN=<token> node scripts/tunnel/client-improved.js --port <port> --ctrl <host:port> [--max-size <bytes>]");
   process.exit(1);
 }
 

package/cli/src/utils/launchDomainking.ts

@@ -1,64 +0,0 @@
-import { spawnSync } from "child_process";
-import { existsSync } from "fs";
-import { homedir } from "os";
-import { join } from "path";
-
-function projectRoot(): string {
-  return join(__dirname, "../..");
-}
-
-function resolveTsx(): string {
-  const root = projectRoot();
-  try {
-    return require.resolve("tsx/dist/cli.cjs", { paths: [root] });
-  } catch {
-    try {
-      return require.resolve("tsx/cli", { paths: [root] });
-    } catch {
-      return "tsx";
-    }
-  }
-}
-
-/** Domainking stays its own package; we spawn it, we do not import it. */
-export function resolveDomainkingEntry(): string | null {
-  if (process.env.DOMAINKING_ENTRY && existsSync(process.env.DOMAINKING_ENTRY)) {
-    return process.env.DOMAINKING_ENTRY;
-  }
-  const candidates = [
-    join(homedir(), "domainking", "src", "index.tsx"),
-    join(projectRoot(), "..", "domainking", "src", "index.tsx"),
-    join(projectRoot(), "..", "..", "domainking", "src", "index.tsx"),
-  ];
-  return candidates.find((path) => existsSync(path)) ?? null;
-}
-
-export function launchDomainking(): string {
-  const entry = resolveDomainkingEntry();
-  if (!entry) {
-    return [
-      "Domain search TUI is not bundled with uplink-cli.",
-      "",
-      "Agent-friendly commands (no TUI needed):",
-      "  uplink domains list --json",
-      "  uplink domains check example.com --json",
-      "  uplink host domains add --id app_xxx --hostname example.com --json",
-      "  uplink host domains verify --id app_xxx --hostname example.com --json",
-      "",
-      "Optional: set DOMAINKING_ENTRY to a Domainking src/index.tsx for the search UI.",
-    ].join("\n");
-  }
-
-  const result = spawnSync(resolveTsx(), [entry], {
-    stdio: "inherit",
-    cwd: join(entry, "..", ".."),
-    env: process.env,
-  });
-  if (result.error) {
-    throw result.error;
-  }
-  if (result.status && result.status !== 0) {
-    return "Domain search exited.";
-  }
-  return "Back from domain search. Attach a hostname with Domains › Attach to app.";
-}