refactor: rename allowedHosts to hostnames (#413)

* refactor: rename allowedHosts to hostnames for DNS rebinding config

The old name confused users who thought it was related to CORS.
"hostnames" communicates that you're declaring the daemon's own
hostnames, not granting access to external parties.

Backward compatible: old config files (daemon.allowedHosts), env var
(PASEO_ALLOWED_HOSTS), CLI flag (--allowed-hosts), and Nix option
(allowedHosts) all still work as deprecated aliases.

* fix(nix): update npmDepsHash to match current package-lock.json

packages/cli/src/commands/onboard.ts

@@ -1,5 +1,5 @@
 import { cancel, confirm, intro, isCancel, log, note, outro, spinner } from "@clack/prompts";
-import { Command } from "commander";
+import { Command, Option } from "commander";
 import { writeFileSync } from "node:fs";
 import path from "node:path";
 import {
@@ -24,6 +24,10 @@ interface OnboardOptions extends DaemonStartOptions {
   voice?: "ask" | "enable" | "disable";
 }
 
+type RawOnboardOptions = OnboardOptions & {
+  allowedHosts?: string;
+};
+
 type OnboardPersistedConfig = PersistedConfig & {
   features?: PersistedConfig["features"] & {
     dictation?: PersistedConfig["features"] extends { dictation?: infer T }
@@ -64,7 +68,7 @@ function parseTimeoutMs(raw: string | undefined): number {
   return Math.ceil(seconds * 1000);
 }
 
-function toCliOverrides(options: DaemonStartOptions): CliConfigOverrides {
+function toCliOverrides(options: OnboardOptions): CliConfigOverrides {
   const cliOverrides: CliConfigOverrides = {};
 
   if (options.listen) {
@@ -77,9 +81,9 @@ function toCliOverrides(options: DaemonStartOptions): CliConfigOverrides {
     cliOverrides.relayEnabled = false;
   }
 
-  if (options.allowedHosts) {
-    const raw = options.allowedHosts.trim();
-    cliOverrides.allowedHosts =
+  if (options.hostnames) {
+    const raw = options.hostnames.trim();
+    cliOverrides.hostnames =
       raw.toLowerCase() === "true"
         ? true
         : raw
@@ -297,13 +301,17 @@ export function onboardCommand(): Command {
     .option("--no-relay", "Disable relay connection")
     .option("--no-mcp", "Disable the Agent MCP HTTP endpoint")
     .option(
-      "--allowed-hosts <hosts>",
-      'Comma-separated Host allowlist values (example: "localhost,.example.com" or "true")',
+      "--hostnames <hosts>",
+      'Daemon hostnames (comma-separated, e.g. "myhost,.example.com" or "true" for any)',
     )
+    .addOption(new Option("--allowed-hosts <hosts>").hideHelp())
     .option("--timeout <seconds>", "Max time to wait for daemon readiness (default: 600)")
     .option("--voice <mode>", "Voice setup mode: ask, enable, disable", "ask")
-    .action(async (options: OnboardOptions) => {
-      await runOnboard(options);
+    .action(async (options: RawOnboardOptions) => {
+      await runOnboard({
+        ...options,
+        hostnames: options.hostnames ?? options.allowedHosts,
+      });
     });
 }