feat(cli): make API surface routing safe by default

[KurosawaGeeker]

Problem

The CLI exposes a global --hostname override that can silently bypass the API-surface routing derived from the selected target. This makes it easy to send a command to the wrong Mosoo endpoint.

For example, running a public-thread-api command with:

mosoo --target custom \
  --base-url https://try.mosoo.ai \
  --hostname https://try.mosoo.ai/api \
  public-thread-api files upload ...

produces requests under:

https://try.mosoo.ai/api/agents/.../files

The Public Thread API should use /api/v1, so the request should have been:

https://try.mosoo.ai/api/v1/agents/.../files

The command succeeds far enough to look like a runtime or credential failure, while the actual problem is an incorrect surface path.

Proposal

Make the normal CLI workflow accept only the service root through --base-url and derive the API surface path internally for every CLI command:

• console and console-rest -> /api
• public-thread-api -> /api/v1

Keep environment selection in --target:

• --target local
• --target cloud
• --target custom --base-url https://try.mosoo.ai

Remove --hostname from the user-facing global CLI flags, help text, and examples. If non-standard deployments require per-surface overrides, keep that configuration internal or target-scoped and validate it against the selected surface. The CLI should never silently allow public-thread-api to use a host ending in /api.

Add regression tests covering all built-in targets and the custom target, including an explicit failure for a mismatched surface path.

Alternatives considered

• Keep --hostname as a general-purpose override and document that users must manually append /api or /api/v1. This preserves flexibility but is not sufficiently safe for normal usage.
• Add only a warning for mismatched paths. This still allows a request to be sent to the wrong endpoint and should not be the default safety mechanism.

Compatibility and migration

This is a CLI UX and routing-safety change. Existing commands that use --target and --base-url should continue to work, with safer automatic surface resolution. Scripts that pass --hostname will need to move the root host to --base-url or target configuration.

Contribution

I can provide product feedback.

Checklist

• I searched existing issues before opening this request.
• I described the problem before the proposed solution.
• I kept this request focused on one improvement.