@hivefloor/cli 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Validate-QA
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,77 @@
-# Temporary Holding Version
+# @hivefloor/cli
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Connect your coding agents to [Hivefloor](https://hivefloor.worldofz.info): one floor that shows every agent on your machines (Claude Code, Codex, Cursor, Gemini CLI, Grok CLI), what each is working on, who is waiting for you, and what they cost in tokens. Agents also get task tools (claim, update, complete) over MCP.
+
+The package installs one command, `hivefloor`. Node.js 22 or later.
+
+## Quick start
+
+```bash
+npx @hivefloor/cli connect
+```
+
+It prints a short code and opens your browser to approve this computer on Hivefloor (sign in there; the CLI never sees your password). Then it sets up the hooks and the background service. Your running agents show up on the Floor within a minute.
+
+Install once instead of using `npx`:
+
+```bash
+npm i -g @hivefloor/cli
+hivefloor connect
+```
+
+Headless box with no browser: run `connect --no-open`, then open the printed link on any device where you are signed in.
+
+## Commands
+
+```
+hivefloor <command> [options]
+npx @hivefloor/cli <command> [options]   (no install)
+
+  connect      Connect this computer once: every agent on it shows up (Claude profiles, Codex, ...)
+                 --host URL   --name NAME   --no-open   --no-service   --yes
+                 --agent | --tool claude|codex|cursor|gemini|grok|other   connect one agent for one repo (MCP and tasks) instead
+  disconnect   Remove everything connect added, the machine on the server included (--tool <name> for one agent tool)
+  status       This machine and its service; the per-repo agent, its projects and live sessions
+  service      run: the background service (started by your OS; you rarely run it by hand)
+  link         Link this repo to another project (--project ID | --new NAME [--path PREFIX])
+  token        Print the stored token for shell use (--reveal to print to a terminal)
+  mcp          Stdio MCP server that proxies to Hivefloor (for tools without HTTP header support)
+  hook         <tool> <event>: the hook runner the tools call (reads JSON on stdin)
+  help         Show this help
+  --version    Print the version
+```
+
+The default server is `https://hivefloor.worldofz.info`; use `--host` or the `HIVEFLOOR_URL` environment variable for another one.
+
+## What `connect` changes on your computer
+
+- `~/.config/hivefloor/` (`%APPDATA%\hivefloor\` on Windows): `machine.json` with the machine token (mode 0600, user-only ACL on Windows), a copy of this CLI that the hooks and the service run, and a small event spool and service log.
+- Hooks in each Claude Code profile's `settings.json` and, if Codex is present, in its `hooks.json` and `config.toml`. Every entry is marked as Hivefloor's.
+- A user-level background service: a launchd agent on macOS, a systemd user unit on Linux, a Scheduled Task on Windows. Skip it with `--no-service`.
+
+`hivefloor disconnect` removes all of it and tells the server to delete the machine. Nothing is installed with administrator rights.
+
+## Privacy: what is sent to the server
+
+Only to the Hivefloor server you connect to (the default host or `--host`), over HTTPS, with the machine token. There is no telemetry and no third-party service.
+
+- **Connecting:** the machine name (your hostname unless you pass `--name`), OS and CLI version.
+- **Hook events** (when an agent starts or ends a session, you submit a prompt, the agent stops, waits for you, or starts or stops a subagent): the tool, the event name, the session id, the model name, the git remote, branch and subfolder of the working directory, and for a stop or subagent event the first line of the agent's last message, with secrets masked and cut to 140 characters. A subagent's type and its short description (140 characters) are sent too. Your prompt text, file contents, tool inputs and outputs, and full transcripts are not sent.
+- **Heartbeat** (about every 30 seconds): OS, CLI version, memory total and use, load average, and token and cost counters per agent profile. The counters are numbers read from the `usage` fields of your local Claude Code and Codex session files from the last 24 hours; message text is never read into what is sent.
+- **Discovery** (about every minute): for each agent tool found running, its name, a profile key (for example `default` or `work`), a label such as `Claude Max (work)` (from the plan name in the profile's credentials file; no email, no token), the model, and how many agent processes are alive. No command lines, paths or prompts.
+- **`link`, `--agent` mode and `mcp`:** the same repo details as above, and your tool's MCP calls to the server's `/mcp` endpoint.
+
+The machine token stays on your computer (the file above, or the OS keychain in `--agent` mode) and is sent only to the host it was issued for.
+
+## Troubleshooting
+
+- `hivefloor status` shows the machine, whether the service is alive and the last heartbeat.
+- The service log is in the config directory above (`service.log`).
+- The hooks never print and always exit 0, so they cannot break your agent.
+
+## Links
+
+- Source and issues: https://github.com/Validate-QA/hivefloor
+- Docs: https://hivefloor.worldofz.info
+
+MIT License.

package/dist/chunk-2IMJECYD.js

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+
+// src/tools.ts
+import fs from "fs";
+import path from "path";
+var REAL_TOOLS = ["claude", "codex", "cursor", "gemini", "grok"];
+var TOOL_LABEL = {
+  claude: "Claude Code",
+  codex: "Codex",
+  cursor: "Cursor",
+  gemini: "Gemini CLI",
+  grok: "Grok CLI",
+  other: "Other"
+};
+var BINARIES = {
+  claude: ["claude"],
+  codex: ["codex"],
+  cursor: ["cursor-agent", "agent"],
+  gemini: ["gemini"],
+  grok: ["grok"]
+};
+function isTool(s) {
+  return s === "other" || REAL_TOOLS.includes(s);
+}
+function findBin(name, env) {
+  const exts = process.platform === "win32" ? ["", ".exe", ".cmd", ".bat"] : [""];
+  for (const dir of (env.PATH ?? "").split(path.delimiter)) {
+    if (!dir) continue;
+    for (const ext of exts) {
+      const p = path.join(dir, name + ext);
+      try {
+        if (fs.statSync(p).isFile()) {
+          fs.accessSync(p, fs.constants.X_OK);
+          return p;
+        }
+      } catch {
+      }
+    }
+  }
+  return void 0;
+}
+function detectTools(env) {
+  const found = [];
+  for (const tool of REAL_TOOLS) {
+    for (const name of BINARIES[tool]) {
+      const bin = findBin(name, env);
+      if (bin) {
+        found.push({ tool, bin });
+        break;
+      }
+    }
+  }
+  return found;
+}
+function toolFromEnv(env) {
+  if (env.GROK_SESSION_ID) return "grok";
+  if (env.CLAUDECODE || env.CLAUDE_CODE_ENTRYPOINT) return "claude";
+  if (env.CODEX_SANDBOX || env.CODEX_SESSION_ID || env.CODEX_THREAD_ID || env.CODEX_CI) return "codex";
+  if (env.CURSOR_AGENT || env.CURSOR_TRACE_ID || env.CURSOR_SESSION_ID) return "cursor";
+  if (env.GEMINI_CLI || env.GEMINI_SESSION_ID) return "gemini";
+  return void 0;
+}
+
+export {
+  REAL_TOOLS,
+  TOOL_LABEL,
+  isTool,
+  findBin,
+  detectTools,
+  toolFromEnv
+};

package/dist/chunk-3IMV5EHP.js

@@ -0,0 +1,94 @@
+#!/usr/bin/env node
+import {
+  atomicWrite,
+  configDir,
+  isRecord,
+  machineFile,
+  readText,
+  serviceStateFile
+} from "./chunk-WNDUGQDX.js";
+
+// src/machine.ts
+import fs from "fs";
+import os from "os";
+function readMachine() {
+  const text = readText(machineFile());
+  if (!text) return void 0;
+  try {
+    const j = JSON.parse(text);
+    if (!isRecord(j) || typeof j.token !== "string" || typeof j.host !== "string" || !isRecord(j.machine)) return void 0;
+    const inst = isRecord(j.installed) ? j.installed : {};
+    return {
+      version: 1,
+      host: j.host,
+      machine: { id: String(j.machine.id ?? ""), name: String(j.machine.name ?? "") },
+      token: j.token,
+      connected_at: typeof j.connected_at === "string" ? j.connected_at : "",
+      ...j.revoked === true ? { revoked: true } : {},
+      installed: {
+        claude_dirs: Array.isArray(inst.claude_dirs) ? inst.claude_dirs.filter((x) => typeof x === "string") : [],
+        ...typeof inst.codex_dir === "string" ? { codex_dir: inst.codex_dir } : {},
+        ...isRecord(inst.service) && typeof inst.service.file === "string" && (inst.service.kind === "launchd" || inst.service.kind === "systemd" || inst.service.kind === "windows") ? { service: { kind: inst.service.kind, file: inst.service.file } } : {}
+      }
+    };
+  } catch {
+    return void 0;
+  }
+}
+function writeMachine(m) {
+  const dir = configDir();
+  fs.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs.chmodSync(dir, 448);
+  try {
+    if (fs.lstatSync(machineFile()).isSymbolicLink()) {
+      throw new Error(`${machineFile()} is a symbolic link; the machine token is not written through links. Remove the link and run connect again.`);
+    }
+  } catch (e) {
+    if (e.code !== "ENOENT") throw e;
+  }
+  atomicWrite(machineFile(), JSON.stringify(m, null, 2) + "\n", 384);
+}
+var removeMachineFile = () => fs.rmSync(machineFile(), { force: true });
+async function secureWindowsMachine(run, username = os.userInfo().username) {
+  if (!username) {
+    removeMachineFile();
+    throw new Error("could not determine the Windows user; the machine token was not kept");
+  }
+  const dir = configDir();
+  const d = await run("icacls", [dir, "/inheritance:r", "/grant:r", `${username}:(OI)(CI)F`]);
+  if (d.code === 0) {
+    const f = await run("icacls", [machineFile(), "/inheritance:r", "/grant:r", `${username}:F`]);
+    if (f.code === 0) return;
+  }
+  removeMachineFile();
+  throw new Error("could not restrict the Hivefloor config to your Windows user with icacls; the machine token was not kept");
+}
+var SERVICE_ALIVE_MS = 9e4;
+function readServiceState() {
+  const text = readText(serviceStateFile());
+  if (!text) return void 0;
+  try {
+    const j = JSON.parse(text);
+    if (isRecord(j) && typeof j.beat === "number" && typeof j.pid === "number") return j;
+  } catch {
+  }
+  return void 0;
+}
+function writeServiceState(s) {
+  atomicWrite(serviceStateFile(), JSON.stringify(s) + "\n", 384);
+}
+var serviceAlive = (nowMs) => {
+  const s = readServiceState();
+  return s !== void 0 && nowMs - s.beat < SERVICE_ALIVE_MS;
+};
+
+export {
+  readMachine,
+  writeMachine,
+  removeMachineFile,
+  secureWindowsMachine,
+  SERVICE_ALIVE_MS,
+  readServiceState,
+  writeServiceState,
+  serviceAlive
+};

package/dist/chunk-4A5WOW2D.js

@@ -0,0 +1,356 @@
+#!/usr/bin/env node
+import {
+  atomicWrite,
+  atomicWriteUtf16,
+  configDir,
+  credentialsFile,
+  home,
+  isRecord,
+  readText,
+  removeFile
+} from "./chunk-WNDUGQDX.js";
+import {
+  cliNpxCommand,
+  runCmd
+} from "./chunk-RE2EQZWL.js";
+
+// src/service/units.ts
+import os from "os";
+import path from "path";
+var LAUNCHD_LABEL = "dev.hivefloor.machine";
+var SYSTEMD_UNIT = "hivefloor.service";
+var SCHTASKS_TASK = "Hivefloor Machine";
+var xml = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+var sdEscape = (s) => s.replace(/(["\\$])/g, "\\$1").replace(/%/g, "%%");
+var sdQuote = (s) => /^[\w@+=:,./-]+$/.test(s) ? s : `"${sdEscape(s)}"`;
+function launchdPlist(plan) {
+  const bin = path.dirname(plan.node);
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${LAUNCHD_LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${xml(plan.node)}</string>
+    <string>${xml(plan.script)}</string>
+    <string>service</string>
+    <string>run</string>
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <dict>
+    <key>SuccessfulExit</key>
+    <false/>
+  </dict>
+  <key>ThrottleInterval</key>
+  <integer>30</integer>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>PATH</key>
+    <string>${xml(`${bin}:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin`)}</string>
+  </dict>
+  <key>StandardOutPath</key>
+  <string>/dev/null</string>
+  <key>StandardErrorPath</key>
+  <string>/dev/null</string>
+</dict>
+</plist>
+`;
+}
+function systemdUnit(plan) {
+  return `[Unit]
+Description=Hivefloor machine service
+After=network-online.target
+
+[Service]
+ExecStart=${sdQuote(plan.node)} ${sdQuote(plan.script)} service run
+Restart=on-failure
+RestartSec=30
+Environment="PATH=${sdEscape(`${path.dirname(plan.node)}:/usr/local/bin:/usr/bin:/bin`)}"
+
+[Install]
+WantedBy=default.target
+`;
+}
+var winQuote = (s) => /\s/.test(s) ? `"${s}"` : s;
+function windowsTaskExec(plan) {
+  return {
+    command: path.win32.normalize(plan.node),
+    arguments: `${winQuote(path.win32.normalize(plan.script))} service run`
+  };
+}
+function windowsUser(env = process.env) {
+  const name = env.USERNAME || os.userInfo().username;
+  return env.USERDOMAIN ? `${env.USERDOMAIN}\\${name}` : name;
+}
+function windowsTaskXml(plan, user) {
+  const ex = windowsTaskExec(plan);
+  return `<?xml version="1.0" encoding="UTF-16"?>
+<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
+  <RegistrationInfo>
+    <Description>Hivefloor machine service</Description>
+  </RegistrationInfo>
+  <Triggers>
+    <LogonTrigger>
+      <Enabled>true</Enabled>
+      <UserId>${xml(user)}</UserId>
+    </LogonTrigger>
+  </Triggers>
+  <Principals>
+    <Principal id="Author">
+      <UserId>${xml(user)}</UserId>
+      <LogonType>InteractiveToken</LogonType>
+      <RunLevel>LeastPrivilege</RunLevel>
+    </Principal>
+  </Principals>
+  <Settings>
+    <AllowStartOnDemand>true</AllowStartOnDemand>
+    <RestartOnFailure>
+      <Interval>PT1M</Interval>
+      <Count>255</Count>
+    </RestartOnFailure>
+    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>
+    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
+    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
+    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
+    <Enabled>true</Enabled>
+  </Settings>
+  <Actions Context="Author">
+    <Exec>
+      <Command>${xml(ex.command)}</Command>
+      <Arguments>${xml(ex.arguments)}</Arguments>
+    </Exec>
+  </Actions>
+</Task>
+`;
+}
+var launchdFile = () => path.join(home(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
+var systemdFile = () => path.join(home(), ".config", "systemd", "user", SYSTEMD_UNIT);
+var windowsTaskFile = () => path.join(configDir(), "service-task.xml");
+async function installService(platform, run, plan, uid, env = process.env) {
+  const res = { lines: [], warnings: [] };
+  if (platform === "darwin") {
+    const file = launchdFile();
+    atomicWrite(file, launchdPlist(plan), 420);
+    const domain = `gui/${uid ?? 501}`;
+    await run("launchctl", ["bootout", `${domain}/${LAUNCHD_LABEL}`]);
+    const r = await run("launchctl", ["bootstrap", domain, file]);
+    res.installed = { kind: "launchd", file };
+    if (r.code === 0) res.lines.push(`Service: launchd agent ${LAUNCHD_LABEL} (${file})`);
+    else res.warnings.push(`the service unit was written to ${file} but launchctl could not start it; log out and in, or run: ${cliNpxCommand("service run")}`);
+    return res;
+  }
+  if (platform === "linux") {
+    const file = systemdFile();
+    atomicWrite(file, systemdUnit(plan), 420);
+    res.installed = { kind: "systemd", file };
+    await run("systemctl", ["--user", "daemon-reload"]);
+    const r = await run("systemctl", ["--user", "enable", "--now", SYSTEMD_UNIT]);
+    if (r.code === 0) res.lines.push(`Service: systemd user unit ${SYSTEMD_UNIT} (${file})`);
+    else res.warnings.push(`the service unit was written to ${file} but systemd could not start it (no user session?); run: ${cliNpxCommand("service run")}`);
+    const lg = await run("loginctl", ["show-user", process.env.USER ?? "", "-p", "Linger"]);
+    if (lg.code === 0 && /Linger=no/.test(lg.stdout)) res.warnings.push("to keep reporting while you are logged out, run once: loginctl enable-linger");
+    return res;
+  }
+  if (platform === "win32") {
+    const file = windowsTaskFile();
+    atomicWriteUtf16(file, windowsTaskXml(plan, windowsUser(env)), 384);
+    const create = await run("schtasks", ["/Create", "/TN", SCHTASKS_TASK, "/XML", file, "/F"]);
+    removeFile(file);
+    if (create.code !== 0) {
+      res.warnings.push(`schtasks could not create the Scheduled Task: hooks post directly, and the machine shows offline; run connect again, or start it by hand with: ${cliNpxCommand("service run")}`);
+      return res;
+    }
+    res.installed = { kind: "windows", file: SCHTASKS_TASK };
+    const r = await run("schtasks", ["/Run", "/TN", SCHTASKS_TASK]);
+    if (r.code === 0) res.lines.push(`Service: Scheduled Task "${SCHTASKS_TASK}" (starts when you log in)`);
+    else res.warnings.push(`the Scheduled Task was created but schtasks could not start it; start it by hand with: schtasks /Run /TN "${SCHTASKS_TASK}"`);
+    return res;
+  }
+  res.warnings.push("no background service on this system yet: hooks post directly, and the machine shows offline");
+  return res;
+}
+function parseCsvRow(line) {
+  const out = [];
+  let field = "";
+  let quoted = false;
+  for (let i = 0; i < line.length; i++) {
+    const c = line[i];
+    if (quoted) {
+      if (c !== '"') field += c;
+      else if (line[i + 1] === '"') {
+        field += '"';
+        i++;
+      } else quoted = false;
+    } else if (c === '"') quoted = true;
+    else if (c === ",") {
+      out.push(field);
+      field = "";
+    } else field += c;
+  }
+  out.push(field);
+  return out;
+}
+async function windowsServiceStatus(run) {
+  const r = await run("schtasks", ["/Query", "/TN", SCHTASKS_TASK, "/FO", "CSV", "/NH"]);
+  if (r.code !== 0) return "missing";
+  const row = r.stdout.split(/\r?\n/).find((l) => l.trim() !== "");
+  if (!row) return "missing";
+  const status = (parseCsvRow(row)[2] ?? "").trim();
+  return /^running$/i.test(status) ? "running" : "installed";
+}
+async function uninstallService(svc, run, uid) {
+  if (svc.kind === "launchd") await run("launchctl", ["bootout", `gui/${uid ?? 501}/${LAUNCHD_LABEL}`]);
+  else if (svc.kind === "systemd") {
+    await run("systemctl", ["--user", "disable", "--now", SYSTEMD_UNIT]);
+  } else {
+    await run("schtasks", ["/End", "/TN", SCHTASKS_TASK]);
+    await run("schtasks", ["/Delete", "/TN", SCHTASKS_TASK, "/F"]);
+  }
+  if (svc.kind !== "windows") removeFile(svc.file);
+  if (svc.kind === "systemd") await run("systemctl", ["--user", "daemon-reload"]);
+}
+
+// src/credentials.ts
+import fs from "fs";
+var SERVICE = "hivefloor";
+var realKeyring = async () => {
+  if (process.env.HIVEFLOOR_KEYRING === "0") return void 0;
+  try {
+    return await import("@napi-rs/keyring");
+  } catch {
+    return void 0;
+  }
+};
+var loadKeyring = realKeyring;
+var account = (host, tool) => `${host}#${tool}`;
+function readCredentials() {
+  const text = readText(credentialsFile());
+  const empty = { version: 1, hosts: {} };
+  if (!text) return empty;
+  try {
+    const j = JSON.parse(text);
+    if (isRecord(j) && isRecord(j.hosts)) return { version: 1, default_host: typeof j.default_host === "string" ? j.default_host : void 0, hosts: j.hosts };
+  } catch {
+  }
+  return empty;
+}
+function prepareConfigDir() {
+  const dir = configDir();
+  fs.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs.chmodSync(dir, 448);
+  return dir;
+}
+function writeCredentials(c) {
+  prepareConfigDir();
+  const file = credentialsFile();
+  try {
+    if (fs.lstatSync(file).isSymbolicLink()) {
+      throw new Error(`${file} is a symbolic link; the token is not written through links. Remove the link and run connect again.`);
+    }
+  } catch (e) {
+    if (e.code !== "ENOENT") throw e;
+  }
+  atomicWrite(file, JSON.stringify(c, null, 2) + "\n", 384);
+}
+async function secureWindowsCredentials(run, username) {
+  if (!username) throw new Error("could not determine the Windows user; the token was not kept");
+  const dir = prepareConfigDir();
+  const d = await run("icacls", [dir, "/inheritance:r", "/grant:r", `${username}:(OI)(CI)F`]);
+  if (d.code !== 0) throw new Error("could not restrict the Hivefloor config to your Windows user with icacls; the token was not kept");
+}
+async function saveToken(host, tool, token, meta = {}, opts = {}) {
+  const creds = readCredentials();
+  const h = creds.hosts[host] ??= { tools: {} };
+  let storage = "file";
+  const kr = await loadKeyring();
+  if (kr) {
+    try {
+      const entry = new kr.Entry(SERVICE, account(host, tool));
+      entry.setPassword(token);
+      if (entry.getPassword() === token) storage = "keychain";
+    } catch {
+      storage = "file";
+    }
+  }
+  if (storage === "file" && (opts.platform ?? process.platform) === "win32") {
+    await secureWindowsCredentials(opts.run ?? runCmd, opts.username ?? windowsUser(process.env));
+  }
+  h.tools[tool] = { ...storage === "keychain" ? { keychain: true } : { token }, ...meta, saved_at: (/* @__PURE__ */ new Date()).toISOString() };
+  h.last_tool = tool;
+  creds.default_host = host;
+  writeCredentials(creds);
+  return storage;
+}
+function pickTool(h, tool) {
+  if (tool && h.tools[tool]) return tool;
+  if (h.last_tool && h.tools[h.last_tool]) return h.last_tool;
+  return Object.keys(h.tools)[0];
+}
+async function loadToken(host, tool) {
+  const h = readCredentials().hosts[host];
+  if (!h) return void 0;
+  const t = pickTool(h, tool);
+  const c = t ? h.tools[t] : void 0;
+  if (!t || !c) return void 0;
+  if (c.token) return { token: c.token, tool: t };
+  if (c.keychain) {
+    const kr = await loadKeyring();
+    if (!kr) return void 0;
+    try {
+      const v = new kr.Entry(SERVICE, account(host, t)).getPassword();
+      if (v) return { token: v, tool: t };
+    } catch {
+    }
+  }
+  return void 0;
+}
+function defaultHost() {
+  const c = readCredentials();
+  return c.default_host && c.hosts[c.default_host] ? c.default_host : Object.keys(c.hosts)[0];
+}
+async function deleteCredentials(host, tool) {
+  const creds = readCredentials();
+  const kr = await loadKeyring();
+  let n = 0;
+  for (const [h, hc] of Object.entries(creds.hosts)) {
+    if (host && h !== host) continue;
+    for (const [t, c] of Object.entries(hc.tools)) {
+      if (tool && t !== tool) continue;
+      if (c.keychain && kr) {
+        try {
+          const e = new kr.Entry(SERVICE, account(h, t));
+          if (e.deletePassword) e.deletePassword();
+          else e.deleteCredential?.();
+        } catch {
+        }
+      }
+      delete hc.tools[t];
+      n += 1;
+    }
+    if (hc.last_tool && !hc.tools[hc.last_tool]) hc.last_tool = Object.keys(hc.tools)[0];
+    if (Object.keys(hc.tools).length === 0) delete creds.hosts[h];
+  }
+  if (creds.default_host && !creds.hosts[creds.default_host]) creds.default_host = Object.keys(creds.hosts)[0];
+  if (n > 0) {
+    if (Object.keys(creds.hosts).length === 0) fs.rmSync(credentialsFile(), { force: true });
+    else writeCredentials(creds);
+  }
+  return n;
+}
+
+export {
+  SCHTASKS_TASK,
+  windowsUser,
+  installService,
+  windowsServiceStatus,
+  uninstallService,
+  readCredentials,
+  saveToken,
+  loadToken,
+  defaultHost,
+  deleteCredentials
+};