Resolve security review findings (#60)

* limit file permissions to owner-only read

* restrict api command to https & profile host

* update image in README

* anonymize hostname telemetry when not known

* CHANGELOG entries

* fix hostname handling- validate and strip scheme

* bump go-tfe to v2.0.0-beta1

* Update BUG FIXES-20260616-150538.yaml

* review feedback

* normalize hostnames from env

* Update README.md

* add debug clarity about which credential is used

* Update profile.go

* fix URL parse error, credential fallback, more log

* rely on go-tfe to not send tokens to unallowed host

* correct help text for --quiet

* accept any response, not just application/vnd.api+json

* ensure we don't send tokens to unconfigured hosts

* Update README.md

* add prediction for agents during harness install

* modify CHANGELOG entries

* adds support for IP address hostnames

* reorder imports

* bump go-tfe to v2.0.0

Author: brandonc

.changes/unreleased/BUG FIXES-20260616-150538.yaml

@@ -0,0 +1,3 @@
+kind: BUG FIXES
+body: Profile configuration files are now created with read/write permissions for owner only.
+time: 2026-06-16T15:05:38.766655-06:00

.changes/unreleased/BUG FIXES-20260616-150604.yaml

@@ -0,0 +1,3 @@
+kind: BUG FIXES
+body: Hostname telemetry is anonymized when configured with a Terraform Enterprise host.
+time: 2026-06-16T15:06:04.201058-06:00

.changes/unreleased/ENHANCEMENTS-20260618-111524.yaml

@@ -1,3 +1,3 @@
 kind: ENHANCEMENTS
-body: The `tfctl harness install amp` command now supports installing the `tfctl` skill into the directories that Amp looks for.
+body: The `harness install` command supports shell autocompletion for supported coding agents and support for the Amp coding agent has been added.
 time: 2026-06-18T11:15:24.079775-04:00

.changes/unreleased/ENHANCEMENTS-20260618-145700.yaml

@@ -0,0 +1,3 @@
+kind: ENHANCEMENTS
+body: Adds debug logging for token configuration sources.
+time: 2026-06-18T14:57:00.037019-06:00

.changes/unreleased/ENHANCEMENTS-20260618-145810.yaml

@@ -0,0 +1,3 @@
+kind: ENHANCEMENTS
+body: Hostnames are normalized before storage within profiles.
+time: 2026-06-18T14:58:10.514394-06:00

.changes/unreleased/ENHANCEMENTS-20260618-145905.yaml

@@ -0,0 +1,3 @@
+kind: ENHANCEMENTS
+body: The `api` command now accepts arbitrary URLs, such as Archivist, but does not send tokens to any host except the configured API host.
+time: 2026-06-18T14:59:05.436321-06:00

README.md

@@ -6,7 +6,7 @@ Comprehensive, official CLI access to the HCP Terraform / Terraform Enterprise p
 
 The `tfctl` CLI  provides high-level commands for common workflows, such as managing runs, variables, and workspaces, and direct API access for advanced automation. It supports multiple configuration profiles, allowing you to switch between different HCP Terraform organizations and Terraform Enterprise instances. It also integrates with AI coding agents to facilitate agent-assisted management of Terraform workflows.
 
-![tfctl](assets/hero.gif "tfctl")
+![tfctl](assets/demo.gif "tfctl demo")
 
 ## Installation
 You can install the CLI, command completion utility, and agent skill separately.  
@@ -41,6 +41,7 @@ You can uninstall shell completion with the `tfctl --autocomplete-uninstall` com
 
 The `tfctl` CLI ships with an agent skill that gives AI coding agents access to HCP Terraform through the `tfctl` command, but discourages non-human delete operations. You can install it using the `tfctl harness install` command or NPX. Replace `<agent>` with one of the following supported AI agents:
 
+- `amp`
 - `antigravity`
 - `bob` 
 - `claude`
@@ -89,9 +90,9 @@ Verify that the login is successful before leaving the token page in your browse
 
 If the CLI does not find a token configured for the active profile, it checks your Terraform configuration for a matching token. Refer to [Terraform tokens](#terraform-tokens) for more information.
 
-### Set organization
+### Set default organization
 
-Run the `tfctl profile set default_organization` command to set the organization. Replace `<name>` with your HCP Terraform or Terraform Enterprise organization name.
+Run the `tfctl profile set default_organization` command to set the default organization. Replace `<name>` with your HCP Terraform or Terraform Enterprise organization name.
 
 ```bash
 $ tfctl profile set default_organization <name>
@@ -172,7 +173,7 @@ If you have not configured a particular option for the active profile, `tfctl` c
 
 `TFCTL_HOSTNAME`: The Terraform Enterprise or HCP Terraform hostname to use. Defaults to `app.terraform.io`.
 
-`TFCTL_TOKEN`: An HCP Terraform API token to use in conjunction with the default profile.
+`TFCTL_TOKEN`: An HCP Terraform API token to use in conjunction with the default profile. This variable is not used in conjunction with any other profile.
 
 `TFCTL_TOKEN_<profile>`: An HCP Terraform API token to use in conjunction with the named profile.
 
@@ -218,7 +219,7 @@ Use the `--help` flag to print out detailed usage instructions. For example, `tf
   - Data type: String
   - Optional parameter.
 
-- `--quiet`: Minimizes output and disables interactive prompting.
+- `--quiet`: Minimizes output to stdout.
   - Data type: Boolean flag
   - Defaults to `false`.