@hivefloor/cli 0.1.3 → 0.1.5

package/dist/{chunk-NLZXB26Y.js → chunk-6XVIEX75.js}

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 import {
-  findBin
-} from "./chunk-2IMJECYD.js";
+  ApiError
+} from "./chunk-VX7SCIF2.js";
 import {
   atomicWrite,
   backupOnce,
   dropBackupIfSame,
+  findBin,
   home,
   isRecord,
   manifestFile,
@@ -13,11 +14,14 @@ import {
   readText,
   removeFile,
   serializeJson
-} from "./chunk-VNCQFFQO.js";
+} from "./chunk-TPMFQUAW.js";
 import {
-  cliNpxCommand,
-  runCmd
-} from "./chunk-TH4ANHSG.js";
+  runCmd,
+  sameOrigin
+} from "./chunk-SOXRITAW.js";
+import {
+  cliNpxCommand
+} from "./chunk-4DRHR7LR.js";
 
 // src/manifest.ts
 function readManifest() {
@@ -53,6 +57,19 @@ var wasCreated = (file) => readManifest().created.includes(file);
 var forgetCreated = (file) => updateManifest((m) => {
   m.created = m.created.filter((f) => f !== file);
 });
+function toolReadsEnvToken(name, entry, shellExportsToken) {
+  if (!entry) return false;
+  if (typeof entry.envToken === "boolean") return entry.envToken;
+  return name === "codex" || shellExportsToken;
+}
+function envTokenSharedWith(host, tool, shellExportsToken) {
+  const manifest = readManifest();
+  return Object.entries(manifest.tools).every(([name, entry]) => {
+    if (name === tool) return true;
+    if (!toolReadsEnvToken(name, entry, shellExportsToken)) return true;
+    return typeof entry?.host === "string" && entry.host.length > 0 && sameOrigin(entry.host, host);
+  });
+}
 
 // src/shellrc.ts
 import fs from "fs";
@@ -68,11 +85,12 @@ function rcFileFor(env) {
   }
   return void 0;
 }
+function isRcLine(line) {
+  const t = line.trim();
+  return !t.startsWith("#") && t.includes("HIVEFLOOR_TOKEN") && t.includes("hivefloor token") && t.endsWith(RC_MARK);
+}
 function hasRcLine(file) {
-  return (readText(file) ?? "").split("\n").some((l) => {
-    const t = l.trim();
-    return !t.startsWith("#") && t.includes("HIVEFLOOR_TOKEN") && t.includes("hivefloor token") && t.endsWith(RC_MARK);
-  });
+  return (readText(file) ?? "").split("\n").some(isRcLine);
 }
 function addRcLine(file) {
   if (hasRcLine(file)) return false;
@@ -87,7 +105,7 @@ function removeRcLine(file) {
   const cur = readText(file);
   if (cur === void 0) return false;
   const lines = cur.split("\n");
-  const kept = lines.filter((l) => l.trim() !== RC_LINE);
+  const kept = lines.filter((l) => !isRcLine(l));
   if (kept.length === lines.length) return false;
   const next = kept.join("\n");
   if (next.trim() === "" && wasCreated(file)) {
@@ -99,19 +117,18 @@ function removeRcLine(file) {
   return true;
 }
 
-// src/writers/claude.ts
-import path2 from "path";
-
 // src/writers/common.ts
 import fs2 from "fs";
 var emptyReport = () => ({ lines: [], warnings: [] });
 var CLI_COPY_RE = /hivefloor[/\\]cli[/\\]index\.js$/;
+var MACHINE_CMD_RE = /hivefloor[/\\]+cli[/\\]+index\.js"?\s+hook\s/;
 function isMachineHook(h) {
   if (!isRecord(h)) return false;
   const cmd = h.command;
   if (typeof cmd !== "string") return false;
   if (Array.isArray(h.args) && h.args[1] === "hook" && typeof h.args[0] === "string" && CLI_COPY_RE.test(h.args[0])) return true;
-  return /hivefloor[/\\]cli[/\\]index\.js"?\s+hook\s/.test(cmd);
+  if (MACHINE_CMD_RE.test(cmd)) return true;
+  return typeof h.commandWindows === "string" && MACHINE_CMD_RE.test(h.commandWindows);
 }
 function isAgentHook(h) {
   if (!isRecord(h) || isMachineHook(h)) return false;
@@ -197,6 +214,7 @@ function dropBackupWithEntry(file, name) {
 }
 
 // src/writers/claude.ts
+import path2 from "path";
 var CLAUDE_EVENTS = ["SessionStart", "SessionEnd", "UserPromptSubmit", "Stop", "Notification", "SubagentStart", "SubagentStop"];
 var claudeJson = () => path2.join(home(), ".claude.json");
 var claudeSettings = () => path2.join(home(), ".claude", "settings.json");
@@ -214,13 +232,16 @@ async function installClaude(i) {
   const report = emptyReport();
   const auth = i.useEnvToken ? "Bearer ${HIVEFLOOR_TOKEN}" : `Bearer ${i.token}`;
   let mcp = "file";
-  const bin = i.noCli || !i.useEnvToken ? void 0 : findBin("claude", i.ctx.env);
-  if (bin) {
+  const priorCli = !i.useEnvToken && readManifest().tools.claude?.mcp === "cli";
+  const bin = i.noCli ? void 0 : findBin("claude", i.ctx.env);
+  if (bin && (i.useEnvToken || priorCli)) {
     await runCmd(bin, ["mcp", "remove", MCP_NAME, "-s", "user"], { env: i.ctx.env });
-    const r = await runCmd(bin, ["mcp", "add", "--transport", "http", MCP_NAME, i.mcpUrl, "--header", `Authorization: ${auth}`, "-s", "user"], { env: i.ctx.env });
-    if (r.code === 0) {
-      mcp = "cli";
-      report.lines.push(`Claude Code MCP: claude mcp add (user scope) -> ${i.mcpUrl}`);
+    if (i.useEnvToken) {
+      const r = await runCmd(bin, ["mcp", "add", "--transport", "http", MCP_NAME, i.mcpUrl, "--header", `Authorization: ${auth}`, "-s", "user"], { env: i.ctx.env });
+      if (r.code === 0) {
+        mcp = "cli";
+        report.lines.push(`Claude Code MCP: claude mcp add (user scope) -> ${i.mcpUrl}`);
+      }
     }
   }
   if (mcp === "file") {
@@ -237,10 +258,12 @@ async function installClaude(i) {
     report.lines.push(`Claude Code MCP: ${claudeJson()} (mcpServers.${MCP_NAME})`);
   }
   i.onMcpRegistered?.(mcp);
-  if (i.skipHooks) report.lines.push("Claude Code hooks: the machine connection already forwards them");
-  else {
-    editJson(claudeSettings(), (d) => (addHooks(d, "nested", claudeHookSpecs()), true));
-    report.lines.push(`Claude Code hooks: ${claudeSettings()} (${CLAUDE_EVENTS.join(", ")})`);
+  if (!i.mcpOnly) {
+    if (i.skipHooks) report.lines.push("Claude Code hooks: the machine connection already forwards them");
+    else {
+      editJson(claudeSettings(), (d) => (addHooks(d, "nested", claudeHookSpecs()), true));
+      report.lines.push(`Claude Code hooks: ${claudeSettings()} (${CLAUDE_EVENTS.join(", ")})`);
+    }
   }
   return { report, mcp };
 }
@@ -312,6 +335,60 @@ function hasTable(content, table) {
   const re = new RegExp(`^\\s*\\[\\s*${table.replace(/\./g, "\\s*\\.\\s*")}\\s*\\]`, "m");
   return re.test(stripped);
 }
+var tableName = (header) => /^\s*\[\s*([^\]]+?)\s*\]/.exec(header)?.[1]?.replace(/\s+/g, "");
+function isNamedTable(name, table) {
+  const want = table.replace(/\s+/g, "");
+  return name === want || name.startsWith(`${want}.`);
+}
+function removeOutsideTable(content, table) {
+  const lines = content.split("\n");
+  const out = [];
+  const pending = [];
+  let inFence = false;
+  let skipping = false;
+  const dropPending = () => {
+    pending.length = 0;
+  };
+  const flushPending = () => {
+    out.push(...pending);
+    dropPending();
+  };
+  for (const line of lines) {
+    const bare = line.replace(/\r$/, "");
+    if (!inFence && /^# hivefloor:begin /.test(bare)) {
+      if (skipping) dropPending();
+      inFence = true;
+    }
+    if (inFence) {
+      out.push(line);
+      if (/^# hivefloor:end /.test(bare)) inFence = false;
+      continue;
+    }
+    const name = tableName(bare);
+    if (name !== void 0) {
+      if (isNamedTable(name, table)) {
+        skipping = true;
+        dropPending();
+        continue;
+      }
+      if (skipping) flushPending();
+      skipping = false;
+      out.push(line);
+      continue;
+    }
+    if (skipping) {
+      if (bare.trim() === "" || /^\s*#/.test(bare)) pending.push(line);
+      else dropPending();
+      continue;
+    }
+    out.push(line);
+  }
+  if (skipping && pending.some((l) => /^\s*#/.test(l.replace(/\r$/, "")))) flushPending();
+  return out.join("\n");
+}
+function hasOutsideTable(content, table) {
+  return removeOutsideTable(content, table) !== content;
+}
 var FEATURE_TAG = "# hivefloor";
 function enableFeatureHooks(content) {
   const lines = content.split("\n");
@@ -364,44 +441,98 @@ function editToml(fn, opts = {}) {
   }
   if (before === void 0) addCreated(file);
   else if (!wasCreated(file)) backupOnce(file);
-  atomicWrite(file, next);
+  atomicWrite(file, next, opts.mode);
   if (opts.drop) dropBackupIfSame(file);
   return true;
 }
+var CODEX_TABLE = `mcp_servers.${MCP_NAME}`;
+function codexEnvBlock(mcpUrl) {
+  return `[mcp_servers.${MCP_NAME}]
+url = ${tomlString(mcpUrl)}
+bearer_token_env_var = "HIVEFLOOR_TOKEN"`;
+}
+function codexLiteralBlock(mcpUrl, token) {
+  return `[mcp_servers.${MCP_NAME}]
+url = ${tomlString(mcpUrl)}
+http_headers = { Authorization = ${tomlString(`Bearer ${token}`)} }`;
+}
+async function writeCodexLiteral(i) {
+  const prior = readManifest().tools.codex;
+  const ownedCli = prior?.mcp === "cli";
+  if (ownedCli && !i.noCli) {
+    const bin = findBin("codex", i.ctx.env);
+    if (bin) await runCmd(bin, ["mcp", "remove", MCP_NAME], { env: i.ctx.env });
+  }
+  const body = codexLiteralBlock(i.mcpUrl, i.token);
+  let blocked = false;
+  const wrote = editToml(
+    (c) => {
+      if (hasTable(c, CODEX_TABLE) && !ownedCli) {
+        blocked = true;
+        return c;
+      }
+      return setBlock(ownedCli ? removeOutsideTable(c, CODEX_TABLE) : c, "mcp", body);
+    },
+    { mode: 384 }
+  );
+  const file = codexConfig();
+  if (blocked || !wrote && !(readText(file) ?? "").includes(body)) return false;
+  secureFile(file);
+  return true;
+}
 async function installCodex(i) {
   const report = emptyReport();
   let mcp = "file";
-  const bin = i.noCli ? void 0 : findBin("codex", i.ctx.env);
-  if (bin) {
-    await runCmd(bin, ["mcp", "remove", MCP_NAME], { env: i.ctx.env });
-    const r = await runCmd(bin, ["mcp", "add", MCP_NAME, "--url", i.mcpUrl, "--bearer-token-env-var", "HIVEFLOOR_TOKEN"], { env: i.ctx.env });
-    if (r.code === 0) {
-      mcp = "cli";
-      report.lines.push(`Codex MCP: codex mcp add -> ${i.mcpUrl}`);
+  if (i.useEnvToken) {
+    const bin = i.noCli ? void 0 : findBin("codex", i.ctx.env);
+    if (bin) {
+      await runCmd(bin, ["mcp", "remove", MCP_NAME], { env: i.ctx.env });
+      const r = await runCmd(bin, ["mcp", "add", MCP_NAME, "--url", i.mcpUrl, "--bearer-token-env-var", "HIVEFLOOR_TOKEN"], { env: i.ctx.env });
+      if (r.code === 0) {
+        mcp = "cli";
+        report.lines.push(`Codex MCP: codex mcp add -> ${i.mcpUrl}`);
+      }
     }
-  }
-  if (mcp === "file") {
-    editToml((c) => {
-      if (hasTable(c, `mcp_servers.${MCP_NAME}`)) {
-        report.warnings.push(`${codexConfig()} already defines [mcp_servers.${MCP_NAME}]; left as it is`);
-        return c;
+    if (mcp === "file") {
+      let wrote = false;
+      editToml((c) => {
+        if (hasTable(c, CODEX_TABLE)) {
+          report.warnings.push(`${codexConfig()} already defines [mcp_servers.${MCP_NAME}]; left as it is`);
+          return c;
+        }
+        wrote = true;
+        return setBlock(c, "mcp", codexEnvBlock(i.mcpUrl));
+      });
+      if (wrote) report.lines.push(`Codex MCP: ${codexConfig()} ([mcp_servers.${MCP_NAME}])`);
+    }
+  } else {
+    const wrote = await writeCodexLiteral(i);
+    if (!wrote) {
+      const file = codexConfig();
+      if (i.requireStoredToken) {
+        throw new ApiError(
+          0,
+          "codex_config",
+          `${file} already defines [mcp_servers.hivefloor], and Codex cannot store this host's token apart from HIVEFLOOR_TOKEN. Remove that table and run connect again.`
+        );
       }
-      return setBlock(c, "mcp", `[mcp_servers.${MCP_NAME}]
-url = ${tomlString(i.mcpUrl)}
-bearer_token_env_var = "HIVEFLOOR_TOKEN"`);
-    });
-    report.lines.push(`Codex MCP: ${codexConfig()} ([mcp_servers.${MCP_NAME}])`);
+      report.warnings.push(`${file} already defines [mcp_servers.${MCP_NAME}]; left as it is`);
+      report.warnings.push('Codex reads the token from HIVEFLOOR_TOKEN: add export HIVEFLOOR_TOKEN="$(hivefloor token)" to your shell rc.');
+    } else {
+      report.lines.push(`Codex MCP: ${codexConfig()} ([mcp_servers.${MCP_NAME}], token stored in the file)`);
+    }
   }
   i.onMcpRegistered?.(mcp);
-  if (i.skipHooks) report.lines.push("Codex hooks: the machine connection already forwards them");
-  else {
-    editJson(codexHooks(), (d) => (addHooks(d, "nested", codexHookSpecs()), true));
-    report.lines.push(`Codex hooks: ${codexHooks()} (${CODEX_EVENTS.join(", ")})`);
-    editToml(enableFeatureHooks);
-    report.lines.push(`Codex: features.hooks = true in ${codexConfig()}`);
-    report.warnings.push("Codex asks you to trust new hooks: run codex, open /hooks and approve the Hivefloor hooks once.");
-  }
-  if (!i.useEnvToken) report.warnings.push('Codex reads the token from HIVEFLOOR_TOKEN: add export HIVEFLOOR_TOKEN="$(hivefloor token)" to your shell rc.');
+  if (!i.mcpOnly) {
+    if (i.skipHooks) report.lines.push("Codex hooks: the machine connection already forwards them");
+    else {
+      editJson(codexHooks(), (d) => (addHooks(d, "nested", codexHookSpecs()), true));
+      report.lines.push(`Codex hooks: ${codexHooks()} (${CODEX_EVENTS.join(", ")})`);
+      editToml(enableFeatureHooks);
+      report.lines.push(`Codex: features.hooks = true in ${codexConfig()}`);
+      report.warnings.push("Codex asks you to trust new hooks: run codex, open /hooks and approve the Hivefloor hooks once.");
+    }
+  }
   return { report, mcp };
 }
 async function removeCodex(ctx, viaCli, keepHooks = false) {
@@ -443,12 +574,14 @@ async function installCursor(i) {
   );
   report.lines.push(`Cursor MCP: ${cursorMcp()} (mcpServers.${MCP_NAME})`);
   i.onMcpRegistered?.("file");
-  editJson(cursorHooks(), (d) => {
-    if (d.version === void 0) d.version = 1;
-    addHooks(d, "flat", cursorHookSpecs());
-    return true;
-  });
-  report.lines.push(`Cursor hooks: ${cursorHooks()} (${CURSOR_EVENTS.join(", ")})`);
+  if (!i.mcpOnly) {
+    editJson(cursorHooks(), (d) => {
+      if (d.version === void 0) d.version = 1;
+      addHooks(d, "flat", cursorHookSpecs());
+      return true;
+    });
+    report.lines.push(`Cursor hooks: ${cursorHooks()} (${CURSOR_EVENTS.join(", ")})`);
+  }
   return { report, mcp: "file" };
 }
 async function removeCursor() {
@@ -483,13 +616,16 @@ async function installGemini(i) {
   const report = emptyReport();
   const auth = i.useEnvToken ? "Bearer $HIVEFLOOR_TOKEN" : `Bearer ${i.token}`;
   let mcp = "file";
-  const bin = i.noCli || !i.useEnvToken ? void 0 : findBin("gemini", i.ctx.env);
-  if (bin) {
+  const priorCli = !i.useEnvToken && readManifest().tools.gemini?.mcp === "cli";
+  const bin = i.noCli ? void 0 : findBin("gemini", i.ctx.env);
+  if (bin && (i.useEnvToken || priorCli)) {
     await runCmd(bin, ["mcp", "remove", MCP_NAME, "-s", "user"], { env: i.ctx.env });
-    const r = await runCmd(bin, ["mcp", "add", MCP_NAME, i.mcpUrl, "-t", "http", "-s", "user", "-H", `Authorization: ${auth}`], { env: i.ctx.env });
-    if (r.code === 0) {
-      mcp = "cli";
-      report.lines.push(`Gemini MCP: gemini mcp add (user scope) -> ${i.mcpUrl}`);
+    if (i.useEnvToken) {
+      const r = await runCmd(bin, ["mcp", "add", MCP_NAME, i.mcpUrl, "-t", "http", "-s", "user", "-H", `Authorization: ${auth}`], { env: i.ctx.env });
+      if (r.code === 0) {
+        mcp = "cli";
+        report.lines.push(`Gemini MCP: gemini mcp add (user scope) -> ${i.mcpUrl}`);
+      }
     }
   }
   if (mcp === "file") {
@@ -506,8 +642,10 @@ async function installGemini(i) {
     report.lines.push(`Gemini MCP: ${geminiSettings()} (mcpServers.${MCP_NAME})`);
   }
   i.onMcpRegistered?.(mcp);
-  editJson(geminiSettings(), (d) => (addHooks(d, "nested", geminiHookSpecs()), true), i.useEnvToken ? {} : { mode: 384 });
-  report.lines.push(`Gemini hooks: ${geminiSettings()} (${GEMINI_EVENTS.join(", ")})`);
+  if (!i.mcpOnly) {
+    editJson(geminiSettings(), (d) => (addHooks(d, "nested", geminiHookSpecs()), true), i.useEnvToken ? {} : { mode: 384 });
+    report.lines.push(`Gemini hooks: ${geminiSettings()} (${GEMINI_EVENTS.join(", ")})`);
+  }
   return { report, mcp };
 }
 async function removeGemini(ctx, viaCli, viaFile = false) {
@@ -535,29 +673,110 @@ async function removeGemini(ctx, viaCli, viaFile = false) {
 }
 
 // src/writers/grok.ts
+import path6 from "path";
+var grokConfig = () => path6.join(home(), ".grok", "config.toml");
+var HOOKS_LINE = "Grok hooks: none needed (Grok reads the Claude Code hooks in ~/.claude/settings.json; connect Claude Code too for live sessions)";
+function editGrokToml(fn, opts = {}) {
+  const file = grokConfig();
+  const before = readText(file);
+  const next = fn(before ?? "");
+  if (next === (before ?? "")) return false;
+  if (opts.drop && wasCreated(file) && next.trim() === "") {
+    removeFile(file);
+    forgetCreated(file);
+    return true;
+  }
+  if (before === void 0) addCreated(file);
+  else if (!wasCreated(file)) backupOnce(file);
+  atomicWrite(file, next, opts.mode);
+  if (opts.drop) dropBackupIfSame(file);
+  return true;
+}
+function grokMcpBlock(mcpUrl, auth) {
+  return `[mcp_servers.${MCP_NAME}]
+url = ${tomlString(mcpUrl)}
+enabled = true
+
+[mcp_servers.${MCP_NAME}.headers]
+Authorization = ${tomlString(auth)}`;
+}
+var GROK_TABLE = `mcp_servers.${MCP_NAME}`;
+var ENV_AUTH = "Bearer ${HIVEFLOOR_TOKEN}";
+function outsideHasRawAuthorization(content) {
+  const stripped = content.replace(/# hivefloor:begin[\s\S]*?# hivefloor:end [^\n]*(?:\n|$)/g, "");
+  let inTable = false;
+  for (const line of stripped.split("\n")) {
+    const bare = line.replace(/\r$/, "");
+    const header = /^\s*\[\s*([^\]]+?)\s*\]/.exec(bare);
+    if (header) {
+      const name = header[1].replace(/\s+/g, "");
+      inTable = name === GROK_TABLE || name.startsWith(`${GROK_TABLE}.`);
+      continue;
+    }
+    if (!inTable) continue;
+    const auth = /Authorization\s*=\s*["']([^"']*)["']/.exec(bare);
+    if (auth && auth[1] !== ENV_AUTH) return true;
+  }
+  return false;
+}
+async function dropOutsideServer(env, bin) {
+  const file = grokConfig();
+  const bak = `${file}.hivefloor.bak`;
+  const before = readText(file);
+  const beforeBak = readText(bak);
+  const staleLive = before !== void 0 && hasOutsideTable(before, GROK_TABLE);
+  const staleBak = beforeBak !== void 0 && hasOutsideTable(beforeBak, GROK_TABLE);
+  if (!staleLive && !staleBak) return false;
+  if (bin && staleLive) await runCmd(bin, ["mcp", "remove", MCP_NAME, "-s", "user"], { env });
+  for (const f of [file, bak]) {
+    const cur = readText(f);
+    if (cur === void 0 || !hasOutsideTable(cur, GROK_TABLE)) continue;
+    const next = removeOutsideTable(cur, GROK_TABLE);
+    if (next.trim() === "") removeFile(f);
+    else atomicWrite(f, next);
+  }
+  const left = readText(file);
+  if (left !== void 0 && left.trim() === "") removeFile(file);
+  return true;
+}
 async function installGrok(i) {
   const report = emptyReport();
-  const auth = i.useEnvToken ? "Bearer ${HIVEFLOOR_TOKEN}" : `Bearer ${i.token}`;
+  const auth = i.useEnvToken ? ENV_AUTH : `Bearer ${i.token}`;
   const bin = i.noCli ? void 0 : findBin("grok", i.ctx.env);
-  if (bin) {
+  const liveBefore = readText(grokConfig());
+  const bakBefore = readText(`${grokConfig()}.hivefloor.bak`);
+  const hadRaw = [liveBefore, bakBefore].some((t) => t !== void 0 && outsideHasRawAuthorization(t));
+  const removed = await dropOutsideServer(i.ctx.env, bin);
+  if (removed && hadRaw) report.warnings.push(`${grokConfig()} had [${GROK_TABLE}] outside our block; removed it so an older token does not stay on disk`);
+  if (bin && i.useEnvToken) {
     await runCmd(bin, ["mcp", "remove", MCP_NAME, "-s", "user"], { env: i.ctx.env });
     const r = await runCmd(bin, ["mcp", "add", "--transport", "http", MCP_NAME, i.mcpUrl, "-s", "user", "--header", `Authorization: ${auth}`], { env: i.ctx.env });
     if (r.code === 0) {
       report.lines.push(`Grok MCP: grok mcp add (user scope) -> ${i.mcpUrl}`);
-      report.lines.push("Grok hooks: none needed (Grok reads the Claude Code hooks in ~/.claude/settings.json; connect Claude Code too for live sessions)");
+      if (!i.mcpOnly) report.lines.push(HOOKS_LINE);
       i.onMcpRegistered?.("cli");
       return { report, mcp: "cli" };
     }
   }
+  const file = grokConfig();
+  const changed = editGrokToml((c) => setBlock(c, "mcp", grokMcpBlock(i.mcpUrl, auth)), i.useEnvToken ? {} : { mode: 384 });
+  if (!i.useEnvToken && (changed || (readText(file) ?? "").includes(i.token))) secureFile(file);
+  if (changed || hasBlock(readText(file) ?? "", "mcp")) {
+    report.lines.push(`Grok MCP: ${file} ([${GROK_TABLE}])`);
+    if (!i.mcpOnly) report.lines.push(HOOKS_LINE);
+    i.onMcpRegistered?.("file");
+    return { report, mcp: "file" };
+  }
   report.warnings.push(`Could not run the grok CLI. Add the server by hand: grok mcp add --transport http ${MCP_NAME} ${i.mcpUrl} -s user --header "Authorization: Bearer <token from ${cliNpxCommand("token --reveal")}>"`);
   return { report, mcp: "manual" };
 }
-async function removeGrok(ctx, viaCli) {
+async function removeGrok(ctx, viaCli, viaFile = false) {
   const report = emptyReport();
   if (viaCli) {
     const bin = findBin("grok", ctx.env);
     if (bin && (await runCmd(bin, ["mcp", "remove", MCP_NAME, "-s", "user"], { env: ctx.env })).code === 0) report.lines.push("Grok MCP: grok mcp remove");
   }
+  if (viaFile && editGrokToml((c) => removeBlock(c, "mcp"), { drop: true })) report.lines.push(`Grok MCP: removed from ${grokConfig()}`);
   return report;
 }
 
@@ -567,11 +786,14 @@ export {
   addCreated,
   wasCreated,
   forgetCreated,
+  toolReadsEnvToken,
+  envTokenSharedWith,
   RC_LINE,
   rcFileFor,
   hasRcLine,
   addRcLine,
   removeRcLine,
+  emptyReport,
   addHooks,
   removeHooks,
   editJson,

package/dist/{chunk-KHHSRIMU.js → chunk-C627OKTW.js}

@@ -3,10 +3,10 @@
 // package.json
 var package_default = {
   name: "@hivefloor/cli",
-  version: "0.1.3",
+  version: "0.1.5",
   description: "Connect your coding agents (Claude Code, Codex, Cursor, Gemini, Grok) to Hivefloor: live presence, task coordination and usage on one floor.",
   author: {
-    name: "Errr0rr404",
+    name: "Zan",
     url: "https://github.com/Errr0rr404"
   },
   keywords: [

package/dist/chunk-H6NYMF2D.js

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+import {
+  TOKEN_FP_HEX,
+  defaultHost,
+  hostKey,
+  loadToken,
+  readCredentials,
+  tokenFingerprint
+} from "./chunk-6MDJB3BV.js";
+import {
+  flagStr
+} from "./chunk-TKMIV7BG.js";
+import {
+  isTool
+} from "./chunk-TPMFQUAW.js";
+import {
+  hostFromEnv,
+  hostFromFlag,
+  sameOrigin
+} from "./chunk-SOXRITAW.js";
+
+// src/session.ts
+function envTokenForHost(env, host) {
+  const token = env.HIVEFLOOR_TOKEN;
+  if (!token) return void 0;
+  const creds = readCredentials();
+  const key = hostKey(creds, host);
+  if (!key) {
+    if (Object.keys(creds.hosts).length > 0) return void 0;
+    return sameOrigin(hostFromEnv(env), host) ? token : void 0;
+  }
+  const fp = creds.hosts[key]?.token_fp;
+  if (typeof fp !== "string" || fp.length !== TOKEN_FP_HEX || !/^[0-9a-f]+$/.test(fp)) return void 0;
+  return tokenFingerprint(token) === fp ? token : void 0;
+}
+async function resolveSession(ctx, p) {
+  const flagHost = flagStr(p, "host");
+  const host = flagHost ? hostFromFlag(ctx, flagHost) : ctx.env.HIVEFLOOR_URL ? hostFromEnv(ctx.env) : defaultHost() ?? hostFromEnv(ctx.env);
+  const toolFlag = flagStr(p, "tool");
+  const t = await loadToken(host, toolFlag && isTool(toolFlag) ? toolFlag : void 0);
+  if (t) return { host, token: t.token, tool: t.tool };
+  const envToken = envTokenForHost(ctx.env, host);
+  if (envToken) return { host, token: envToken, tool: toolFlag ?? "other" };
+  return void 0;
+}
+
+export {
+  envTokenForHost,
+  resolveSession
+};

package/dist/{chunk-T7TG6WA4.js → chunk-IJRHCDIG.js}

@@ -6,7 +6,7 @@ import {
   machineFile,
   readText,
   serviceStateFile
-} from "./chunk-VNCQFFQO.js";
+} from "./chunk-TPMFQUAW.js";
 
 // src/machine.ts
 import fs from "fs";