@hivefloor/cli 0.1.3 → 0.1.5

package/dist/{chunk-3YOTXIFP.js → chunk-IWIDKNWC.js}

@@ -1,10 +1,12 @@
 #!/usr/bin/env node
 import {
   deviceLogin
-} from "./chunk-HT5KXWXM.js";
+} from "./chunk-3N5JYP5O.js";
 import {
   RC_LINE,
   addRcLine,
+  emptyReport,
+  envTokenSharedWith,
   hasRcLine,
   installClaude,
   installCodex,
@@ -12,46 +14,52 @@ import {
   installGemini,
   installGrok,
   rcFileFor,
+  readManifest,
+  toolReadsEnvToken,
   updateManifest
-} from "./chunk-NLZXB26Y.js";
+} from "./chunk-6XVIEX75.js";
 import {
   detectRepo
-} from "./chunk-YRNMECUF.js";
+} from "./chunk-RYGL6XU4.js";
 import {
-  REAL_TOOLS,
-  TOOL_LABEL,
-  detectTools,
-  findBin,
-  isTool,
-  toolFromEnv
-} from "./chunk-2IMJECYD.js";
+  defaultHost,
+  loadToken,
+  saveToken
+} from "./chunk-6MDJB3BV.js";
 import {
   checkUnknownFlags,
   flagStr
 } from "./chunk-TKMIV7BG.js";
-import {
-  saveToken
-} from "./chunk-DQV6FAJU.js";
 import {
   VERSION
-} from "./chunk-KHHSRIMU.js";
+} from "./chunk-C627OKTW.js";
 import {
   readMachine
-} from "./chunk-T7TG6WA4.js";
+} from "./chunk-IJRHCDIG.js";
 import {
   ApiError
-} from "./chunk-PY74LT2W.js";
+} from "./chunk-VX7SCIF2.js";
 import {
-  ConfigError
-} from "./chunk-VNCQFFQO.js";
+  ConfigError,
+  REAL_TOOLS,
+  TOOL_LABEL,
+  detectTools,
+  findBin,
+  isTool,
+  toolFromEnv
+} from "./chunk-TPMFQUAW.js";
 import {
-  CLI_BIN_NAME,
-  CLI_INSTALL_COMMAND,
-  cliNpxCommand,
   hostFromEnv,
+  hostFromFlag,
   machineName,
-  normalizeHost
-} from "./chunk-TH4ANHSG.js";
+  normalizeHost,
+  sameOrigin
+} from "./chunk-SOXRITAW.js";
+import {
+  CLI_BIN_NAME,
+  CLI_INSTALL_COMMAND,
+  cliNpxCommand
+} from "./chunk-4DRHR7LR.js";
 
 // src/connect.ts
 var INSTALLERS = {
@@ -61,9 +69,59 @@ var INSTALLERS = {
   gemini: installGemini,
   grok: installGrok
 };
+async function freezeForeignEnvTools(ctx, host, tool, noCli) {
+  const report = emptyReport();
+  const manifest = readManifest();
+  for (const [name, entry] of Object.entries(manifest.tools)) {
+    const real = REAL_TOOLS.find((t) => t === name);
+    if (!real || real === tool || !entry || !toolReadsEnvToken(name, entry, true)) continue;
+    const owner = entry.host;
+    if (typeof owner !== "string" || owner.trim() === "") {
+      throw new ApiError(
+        0,
+        "manifest",
+        `${TOOL_LABEL[real]} reads HIVEFLOOR_TOKEN, but its manifest entry has no host. Reconnect it with ${cliNpxCommand(`connect --tool ${real}`)} so the shell token is not sent to the wrong server.`
+      );
+    }
+    if (sameOrigin(owner, host)) continue;
+    const stored = await loadToken(owner, real);
+    if (!stored) {
+      throw new ApiError(
+        0,
+        "token",
+        `${TOOL_LABEL[real]} on ${owner} reads HIVEFLOOR_TOKEN, which would now be the token for ${host}, and no stored token is left for it. Run ${cliNpxCommand(`connect --host ${owner} --tool ${real}`)} again.`
+      );
+    }
+    const r = await INSTALLERS[real]({
+      ctx,
+      mcpUrl: `${normalizeHost(owner)}/mcp`,
+      token: stored.token,
+      useEnvToken: false,
+      requireStoredToken: true,
+      noCli,
+      mcpOnly: true,
+      onMcpRegistered: (mcp) => {
+        updateManifest((m) => {
+          m.tools[real] = { mcp, host: owner, envToken: false };
+        });
+      }
+    });
+    updateManifest((m) => {
+      m.tools[real] = { mcp: r.mcp, host: owner, envToken: false };
+    });
+    report.lines.push(...r.report.lines);
+    report.warnings.push(...r.report.warnings);
+    report.warnings.push(`${TOOL_LABEL[real]} on ${owner} now stores its own token, so HIVEFLOOR_TOKEN is not sent there.`);
+  }
+  return report;
+}
 function resolveHost(p, ctx) {
   const h = flagStr(p, "host");
-  return h ? normalizeHost(h) : hostFromEnv(ctx.env);
+  return h ? hostFromFlag(ctx, h) : hostFromEnv(ctx.env);
+}
+function shellExportFollowsHost(env, host) {
+  if (!env.HIVEFLOOR_URL) return true;
+  return sameOrigin(env.HIVEFLOOR_URL, host);
 }
 async function chooseTool(ctx, p) {
   const detected = detectTools(ctx.env).map((d) => d.tool);
@@ -95,7 +153,6 @@ async function connectAgent(ctx, p) {
   };
   const canOpen = !p.flags["no-open"] && (process.platform !== "linux" || Boolean(ctx.env.DISPLAY || ctx.env.WAYLAND_DISPLAY));
   const result = await deviceLogin(ctx, { host, request, openBrowser: canOpen });
-  const storage = await saveToken(host, tool, result.token, { agent: result.agent, project: result.project });
   const rc = rcFileFor(ctx.env);
   let rcInstalled = rc !== void 0 && hasRcLine(rc);
   let rcAdded;
@@ -118,34 +175,57 @@ Add it? [y/N] `)).trim());
   const lines = [];
   const warnings = [];
   const mcpUrl = `${host}/mcp`;
+  const exportFollowsHost = shellExportFollowsHost(ctx.env, host);
+  const previousHost = defaultHost();
+  const shared = envTokenSharedWith(host, tool, rcInstalled);
+  const allowEnv = rcInstalled && exportFollowsHost && (previousHost === void 0 || sameOrigin(previousHost, host)) && shared;
+  if (rcInstalled && !shared) {
+    try {
+      const frozen = await freezeForeignEnvTools(ctx, host, tool, Boolean(p.flags["no-cli"]));
+      lines.push(...frozen.lines);
+      warnings.push(...frozen.warnings);
+    } catch (e) {
+      if (e instanceof ConfigError) {
+        throw new ApiError(0, "config", `${e.message} Left the other host's tool config in place and did not finish connecting ${host}.`);
+      }
+      throw e;
+    }
+  }
   if (tool === "other") {
     lines.push(`MCP server: ${mcpUrl} (streamable HTTP), header "Authorization: Bearer <token>" (run: ${cliNpxCommand("token --reveal")})`);
     lines.push("The agent shows up the first time it calls a tool.");
   } else {
+    let mcpRegistered = false;
     try {
       const r = await INSTALLERS[tool]({
         ctx,
         mcpUrl,
         token: result.token,
-        useEnvToken: rcInstalled,
+        useEnvToken: allowEnv,
+        requireStoredToken: rcInstalled && !allowEnv,
         noCli: Boolean(p.flags["no-cli"]),
         skipHooks: ownsHooks,
         onMcpRegistered: (mcp) => {
+          mcpRegistered = true;
           updateManifest((m) => {
-            m.tools[tool] = { mcp, host };
+            m.tools[tool] = { mcp, host, envToken: allowEnv };
           });
         }
       });
       lines.push(...r.report.lines);
       warnings.push(...r.report.warnings);
       updateManifest((m) => {
-        m.tools[tool] = { mcp: r.mcp, host };
+        m.tools[tool] = { mcp: r.mcp, host, envToken: allowEnv };
       });
     } catch (e) {
       if (!(e instanceof ConfigError)) throw e;
+      if (!mcpRegistered) {
+        throw new ApiError(0, "config", `${e.message} Did not finish connecting ${host}; the default host is unchanged.`);
+      }
       warnings.push(e.message);
     }
   }
+  const storage = await saveToken(host, tool, result.token, { agent: result.agent, project: result.project });
   if (rcAdded) lines.push(`Shell: added the token export to ${rcAdded}`);
   if (!findBin(CLI_BIN_NAME, ctx.env) && tool !== "other") warnings.push(`"${CLI_BIN_NAME}" is not on your PATH, so the hooks cannot run it. Install it once: ${CLI_INSTALL_COMMAND}`);
   ctx.out(`
@@ -172,7 +252,7 @@ async function connect(ctx, p) {
     return 2;
   }
   if (p.flags.agent || p.flags.tool !== void 0) return connectAgent(ctx, p);
-  return (await import("./machine-connect-GQJ4SB3D.js")).connectMachine(ctx, p);
+  return (await import("./machine-connect-N52CKQEW.js")).connectMachine(ctx, p);
 }
 
 export {

package/dist/{chunk-E4V47VEV.js → chunk-J36OIJBM.js}

@@ -4,27 +4,35 @@ import {
   isDir,
   isRecord,
   readText
-} from "./chunk-VNCQFFQO.js";
+} from "./chunk-TPMFQUAW.js";
 import {
   PROFILE_KEY_RE
-} from "./chunk-TH4ANHSG.js";
+} from "./chunk-4DRHR7LR.js";
 
 // src/profiles.ts
 import fs from "fs";
 import path from "path";
-function profileKeyOf(tool, dir, homeDir = home()) {
-  const std = tool === "claude" ? path.join(homeDir, ".claude") : path.join(homeDir, ".codex");
-  if (path.resolve(dir) === path.resolve(std)) return "default";
-  let base = path.basename(path.resolve(dir)).toLowerCase().replace(/^\.+/, "");
+function pathFor(platform) {
+  return platform === "win32" ? path.win32 : path;
+}
+function resolvedKey(dir, platform) {
+  const r = pathFor(platform).resolve(dir);
+  return platform === "win32" ? r.toLowerCase() : r;
+}
+function profileKeyOf(tool, dir, homeDir = home(), platform = process.platform) {
+  const p = pathFor(platform);
+  const std = tool === "claude" ? p.join(homeDir, ".claude") : p.join(homeDir, ".codex");
+  if (resolvedKey(dir, platform) === resolvedKey(std, platform)) return "default";
+  let base = p.basename(p.resolve(dir)).toLowerCase().replace(/^\.+/, "");
   base = base.replace(new RegExp(`^${tool}[-_.]?`), "").replace(new RegExp(`[-_.]?${tool}$`), "");
   base = base.replace(/[^a-z0-9._-]+/g, "-").replace(/^[^a-z0-9]+/, "").slice(0, 40);
   return PROFILE_KEY_RE.test(base) ? base : "profile";
 }
-function profileKeys(tool, dirs, homeDir = home()) {
+function profileKeys(tool, dirs, homeDir = home(), platform = process.platform) {
   const out = /* @__PURE__ */ new Map();
   const used = /* @__PURE__ */ new Set();
   for (const d of dirs) {
-    out.set(d, uniqueProfileKey(profileKeyOf(tool, d, homeDir), used));
+    out.set(d, uniqueProfileKey(profileKeyOf(tool, d, homeDir, platform), used));
   }
   return out;
 }
@@ -38,17 +46,27 @@ function uniqueProfileKey(base, used) {
   used.add(k);
   return k;
 }
-var RC_FILES = [".zshrc", ".zprofile", ".zshenv", ".bashrc", ".bash_profile", ".profile", ".config/fish/config.fish"];
+var RC_FILES = [
+  ".zshrc",
+  ".zprofile",
+  ".zshenv",
+  ".bashrc",
+  ".bash_profile",
+  ".profile",
+  ".config/fish/config.fish",
+  ["Documents", "PowerShell", "Microsoft.PowerShell_profile.ps1"],
+  ["Documents", "WindowsPowerShell", "Microsoft.PowerShell_profile.ps1"]
+];
 function claudeDirsFromRc(homeDir = home()) {
   const found = [];
   for (const rel of RC_FILES) {
-    const text = readText0(path.join(homeDir, rel));
+    const text = readText0(Array.isArray(rel) ? path.join(homeDir, ...rel) : path.join(homeDir, rel));
     if (!text) continue;
     for (const line of text.split("\n")) {
       if (/^\s*#/.test(line)) continue;
-      for (const m of line.matchAll(/CLAUDE_CONFIG_DIR(?:=|\s+)(?:"([^"\n]+)"|'([^'\n]+)'|([^\s"'`;&|)]+))/g)) {
+      for (const m of line.matchAll(/CLAUDE_CONFIG_DIR\s*(?:=\s*|\s+)(?:"([^"\n]+)"|'([^'\n]+)'|([^\s"'`;&|)]+))/g)) {
         const raw = (m[1] ?? m[2] ?? m[3] ?? "").trim();
-        const dir = expand(raw, homeDir);
+        const dir = expandHome(raw, homeDir);
         if (dir && isDir(dir)) found.push(dir);
       }
     }
@@ -62,11 +80,10 @@ function readText0(file) {
     return void 0;
   }
 }
-function expand(raw, homeDir) {
-  let s = raw.replace(/^~(?=\/|$)/, homeDir).replace(/\$\{?HOME\}?/g, homeDir);
-  if (/[$`]/.test(s) || !path.isAbsolute(s)) return void 0;
-  s = path.resolve(s);
-  return s;
+function expandHome(raw, homeDir, p = path) {
+  const s = raw.replace(/^~(?=[/\\]|$)/, () => homeDir).replace(/\$\{?HOME\}?/g, () => homeDir);
+  if (/[$`]/.test(s) || !p.isAbsolute(s)) return void 0;
+  return p.resolve(s);
 }
 function claudeSiblingDirs(homeDir = home()) {
   const out = [];
@@ -87,15 +104,16 @@ function claudeSiblingDirs(homeDir = home()) {
   }
   return out;
 }
-function claudeConfigDirs(fromProcesses, homeDir = home()) {
-  const all = [path.join(homeDir, ".claude"), ...fromProcesses, ...claudeDirsFromRc(homeDir), ...claudeSiblingDirs(homeDir)];
+function claudeConfigDirs(fromProcesses, homeDir = home(), platform = process.platform) {
+  const p = pathFor(platform);
+  const all = [p.join(homeDir, ".claude"), ...fromProcesses, ...claudeDirsFromRc(homeDir), ...claudeSiblingDirs(homeDir)];
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   for (const d of all) {
-    const r = path.resolve(d);
-    if (seen.has(r)) continue;
-    seen.add(r);
-    out.push(r);
+    const key = resolvedKey(d, platform);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(p.resolve(d));
   }
   return out;
 }

package/dist/{chunk-O6VSA2JT.js → chunk-MZGGJ6ZS.js}

@@ -5,7 +5,11 @@ import {
   codexConfigDir,
   codexLabel,
   profileKeys
-} from "./chunk-E4V47VEV.js";
+} from "./chunk-J36OIJBM.js";
+import {
+  agentIsCursor,
+  findBin
+} from "./chunk-TPMFQUAW.js";
 
 // src/osinfo.ts
 import os from "os";
@@ -47,7 +51,78 @@ function splitCommandLine(line) {
   if (started) toks.push(cur);
   return toks;
 }
-function fromTokens(pid, toks) {
+var KNOWN_EXE = /* @__PURE__ */ new Set([...Object.keys(BY_EXE), ...RUNNERS, "agent"]);
+function exeTool(tok, pid, env) {
+  const name = exeName(tok);
+  if (name !== "agent") return BY_EXE[name];
+  const file = agentFile(tok, pid, env);
+  return file && agentIsCursor(file, env) ? "cursor" : void 0;
+}
+function agentFile(tok, pid, env) {
+  const bare = !tok.includes("/") && !tok.includes("\\");
+  if (bare && process.platform === "linux" && pid > 0) {
+    try {
+      const link = fs.readlinkSync(`/proc/${pid}/exe`).replace(/ \(deleted\)$/, "");
+      if (link) return link;
+    } catch {
+    }
+  }
+  if (!bare) return tok.replace(/^"|"$/g, "");
+  return findBin("agent", env);
+}
+function psCommandTokens(command) {
+  const trimmed = command.trim();
+  let quotedExe;
+  let body = trimmed;
+  if (trimmed.startsWith('"')) {
+    const end = trimmed.indexOf('"', 1);
+    if (end > 1) {
+      quotedExe = trimmed.slice(1, end);
+      body = trimmed.slice(end + 1).trim();
+    }
+  }
+  const parts = body === "" ? [] : body.split(/\s+/);
+  const exe = quotedExe !== void 0 ? { token: quotedExe, next: 0 } : takeKnown(parts, 0);
+  if (!exe) return quotedExe !== void 0 ? [quotedExe, ...parts] : parts;
+  let rest = parts.slice(exe.next);
+  if (RUNNERS.has(exeName(exe.token)) && rest[0] && !rest[0].startsWith("-")) {
+    const script = takeScript(rest);
+    rest = [script.token, ...rest.slice(script.next)];
+  }
+  return [exe.token, ...rest];
+}
+var unwrap = (token) => token.length >= 2 && token.startsWith('"') && token.endsWith('"') ? token.slice(1, -1) : token;
+function isFile(file) {
+  try {
+    return fs.statSync(file).isFile();
+  } catch {
+    return false;
+  }
+}
+function takeKnown(parts, start) {
+  let token = "";
+  let best;
+  for (let i = start; i < parts.length; i++) {
+    const piece = parts[i];
+    if (i > start && (piece.startsWith("/") || piece.startsWith("\\") || piece.startsWith("-"))) break;
+    token = token ? `${token} ${piece}` : piece;
+    const bare = !token.includes("/") && !token.includes("\\");
+    const cleaned = unwrap(token);
+    if (KNOWN_EXE.has(exeName(cleaned)) || !bare && isFile(cleaned)) best = { token: cleaned, next: i + 1 };
+    if (bare) break;
+  }
+  return best;
+}
+function takeScript(parts) {
+  const first = parts[0];
+  if (/\.(?:js|mjs|cjs|exe|cmd)$/i.test(first.split(/[\\/]/).pop() ?? "")) return { token: first, next: 1 };
+  return takeKnown(parts, 0) ?? { token: first, next: 1 };
+}
+function psEnvValue(text, name) {
+  const m = new RegExp(`(?:^|\\s)${name}=(.*?)(?=\\s+[A-Za-z_][A-Za-z0-9_]*=|\\s*$)`).exec(text);
+  return m?.[1] || void 0;
+}
+function fromTokens(pid, toks, env) {
   const first = exeName(toks[0] ?? "");
   let rest = toks.slice(1);
   let tool;
@@ -55,7 +130,7 @@ function fromTokens(pid, toks) {
     tool = BY_EXE[exeName(toks[1])] ?? dirTool(toks[1]);
     rest = toks.slice(2);
   } else {
-    tool = BY_EXE[first];
+    tool = exeTool(toks[0] ?? "", pid, env);
   }
   if (!tool || pid === process.pid) return void 0;
   if (HELPER_ARGS.has(rest[0] ?? "")) return void 0;
@@ -64,19 +139,19 @@ function fromTokens(pid, toks) {
   const model = eq ? eq.slice(8) : mi >= 0 ? rest[mi + 1] : void 0;
   return { pid, tool, ...model && /^[\w.:\-/[\]]{1,100}$/.test(model) ? { model } : {} };
 }
-function parsePs(text, uid) {
+function parsePs(text, uid, env = process.env) {
   const out = [];
   for (const line of text.split("\n")) {
     const m = /^\s*(\d+)\s+(\d+)\s+\S+\s+(.+)$/.exec(line);
     if (!m) continue;
     const pid = Number(m[1]);
     if (uid !== void 0 && Number(m[2]) !== uid) continue;
-    const p = fromTokens(pid, m[3].trim().split(/\s+/));
+    const p = fromTokens(pid, psCommandTokens(m[3].trim()), env);
     if (p) out.push(p);
   }
   return out;
 }
-function parseWindowsProcesses(text) {
+function parseWindowsProcesses(text, env = process.env) {
   const raw = text.replace(/^\uFEFF/, "").trim();
   if (raw === "" || raw === "null") return [];
   let data;
@@ -91,7 +166,7 @@ function parseWindowsProcesses(text) {
     const p = item;
     const pid = typeof p.ProcessId === "number" ? p.ProcessId : typeof p.ProcessId === "string" ? Number(p.ProcessId) : NaN;
     if (!Number.isInteger(pid) || pid <= 0 || typeof p.CommandLine !== "string" || p.CommandLine.trim() === "") continue;
-    const found = fromTokens(pid, splitCommandLine(p.CommandLine));
+    const found = fromTokens(pid, splitCommandLine(p.CommandLine), env);
     if (found) out.push(found);
   }
   return out;
@@ -107,8 +182,7 @@ function makeEnvReader(platform, run) {
       }
       if (platform === "darwin") {
         const r = await run("ps", ["-E", "-ww", "-p", String(pid), "-o", "command="], { timeoutMs: 5e3 });
-        const m = new RegExp(`(?:^|\\s)${name}=(\\S+)`).exec(r.stdout);
-        return m?.[1];
+        return psEnvValue(r.stdout, name);
       }
     } catch {
     }
@@ -118,7 +192,7 @@ function makeEnvReader(platform, run) {
 var WINDOWS_PROCESS_QUERY = [
   "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8",
   "$me = [Security.Principal.WindowsIdentity]::GetCurrent().Name",
-  "$names = @('claude.exe', 'claude', 'codex.exe', 'codex', 'cursor-agent.exe', 'cursor-agent', 'gemini.exe', 'gemini', 'grok.exe', 'grok', 'node.exe', 'node', 'bun.exe', 'bun', 'deno.exe', 'deno', 'npx.cmd', 'npx')",
+  "$names = @('claude.exe', 'claude', 'codex.exe', 'codex', 'cursor-agent.exe', 'cursor-agent', 'agent.exe', 'agent', 'gemini.exe', 'gemini', 'grok.exe', 'grok', 'node.exe', 'node', 'bun.exe', 'bun', 'deno.exe', 'deno', 'npx.cmd', 'npx')",
   '$rows = @(Get-CimInstance Win32_Process | Where-Object { $names -contains $_.Name.ToLowerInvariant() } | ForEach-Object { $p = $_; $o = Invoke-CimMethod -InputObject $p -MethodName GetOwner; if ($o.ReturnValue -eq 0) { $owner = if ($o.Domain) { "$($o.Domain)\\$($o.User)" } else { $o.User }; if ($owner -ieq $me) { [pscustomobject]@{ ProcessId = $p.ProcessId; CommandLine = $p.CommandLine } } } })',
   "ConvertTo-Json -InputObject $rows -Compress"
 ].join("; ");
@@ -126,14 +200,14 @@ async function scanProcesses(d) {
   if (d.platform === "win32") {
     const r2 = await d.run("powershell", ["-NoProfile", "-NonInteractive", "-Command", WINDOWS_PROCESS_QUERY], { timeoutMs: 1e4 });
     if (r2.code !== 0) return { procs: [] };
-    return { procs: parseWindowsProcesses(r2.stdout) };
+    return { procs: parseWindowsProcesses(r2.stdout, d.env) };
   }
-  const r = await d.run("ps", ["-axo", "pid=,uid=,etime=,command="], { timeoutMs: 1e4 });
+  const r = await d.run("ps", ["-ww", "-axo", "pid=,uid=,etime=,command="], { timeoutMs: 1e4 });
   if (r.code !== 0) return { procs: [] };
   const readEnv = d.readEnv ?? makeEnvReader(d.platform, d.run);
   const procs = [];
   const uid = d.uid ?? (typeof process.getuid === "function" ? process.getuid() : void 0);
-  for (const p of parsePs(r.stdout, uid)) {
+  for (const p of parsePs(r.stdout, uid, d.env)) {
     const dir = p.tool === "claude" ? await readEnv(p.pid, "CLAUDE_CONFIG_DIR") : p.tool === "codex" ? await readEnv(p.pid, "CODEX_HOME") : void 0;
     procs.push({ ...p, ...dir ? { dir } : {} });
   }

package/dist/{chunk-YRNMECUF.js → chunk-RYGL6XU4.js}

@@ -1,9 +1,11 @@
 #!/usr/bin/env node
 import {
-  formatRemote,
-  normalizeRemote,
   runCmd
-} from "./chunk-TH4ANHSG.js";
+} from "./chunk-SOXRITAW.js";
+import {
+  formatRemote,
+  normalizeRemote
+} from "./chunk-4DRHR7LR.js";
 
 // src/git.ts
 function remoteOf(url) {

package/dist/chunk-SOXRITAW.js

@@ -0,0 +1,139 @@
+#!/usr/bin/env node
+
+// src/ctx.ts
+import { execFile } from "child_process";
+import os from "os";
+import readline from "readline";
+import { spawn } from "child_process";
+var DEFAULT_HOST = "https://hivefloor.worldofz.info";
+function defaultCtx() {
+  const ctx = {
+    out: (s) => void process.stdout.write(s),
+    err: (s) => void process.stderr.write(s),
+    env: process.env,
+    cwd: process.cwd(),
+    fetch: (...args) => fetch(...args),
+    sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+    now: () => Date.now(),
+    stdoutIsTTY: Boolean(process.stdout.isTTY),
+    ask: askOnTerminal,
+    open: async (url) => openBrowser(url, ctx.platform ?? process.platform)
+  };
+  return ctx;
+}
+async function askOnTerminal(question) {
+  if (!process.stdin.isTTY) return "";
+  const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    return await new Promise((resolve) => rl.question(question, resolve));
+  } finally {
+    rl.close();
+  }
+}
+function webUrl(url) {
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    throw new Error("not a URL");
+  }
+  if (u.protocol !== "https:" && u.protocol !== "http:") throw new Error(`refusing to open a ${u.protocol} URL`);
+  return u;
+}
+function browserCommand(url, platform = process.platform) {
+  const u = webUrl(url);
+  if (platform === "win32") return { cmd: "rundll32.exe", args: ["url.dll,FileProtocolHandler", u.toString()] };
+  return { cmd: platform === "darwin" ? "open" : "xdg-open", args: [u.toString()] };
+}
+async function openBrowser(url, platform = process.platform) {
+  let target;
+  try {
+    target = browserCommand(url, platform);
+  } catch {
+    return;
+  }
+  await new Promise((resolve) => {
+    try {
+      const child = spawn(target.cmd, target.args, { stdio: "ignore", detached: true });
+      child.on("error", () => resolve());
+      child.unref();
+      setTimeout(resolve, 200);
+    } catch {
+      resolve();
+    }
+  });
+}
+function hostFromEnv(env) {
+  return normalizeHost(env.HIVEFLOOR_URL || DEFAULT_HOST);
+}
+function normalizeHost(input) {
+  const shown = redactUserinfo(input);
+  let h = input.trim();
+  if (!/^https?:\/\//i.test(h)) h = `https://${h}`;
+  let u;
+  try {
+    u = new URL(h);
+  } catch {
+    throw new Error(`"${shown}" is not a valid host. Use a URL such as https://hivefloor.example.com or http://localhost:3000.`);
+  }
+  if (u.hostname === "") throw new Error(`"${shown}" is not a valid host. Use a URL such as https://hivefloor.example.com or http://localhost:3000.`);
+  const bare = u.hostname.replace(/\.+$/, "");
+  if (bare !== "" && bare !== u.hostname) u.hostname = bare;
+  return u.origin;
+}
+function redactUserinfo(raw) {
+  return raw.trim().replace(/^([a-z][a-z0-9+.-]*:\/\/)?[^/?#]*@/i, "$1");
+}
+function hostFromFlag(ctx, raw) {
+  const host = normalizeHost(raw);
+  if (host !== raw.trim()) ctx.err(`hivefloor: using host ${host} (from --host ${redactUserinfo(raw)})
+`);
+  return host;
+}
+function isLoopbackHost(hostname) {
+  const h = hostname.toLowerCase();
+  return h === "localhost" || h === "127.0.0.1" || h === "[::1]" || h === "::1";
+}
+function isSecureUrl(u) {
+  if (u.protocol === "https:") return true;
+  return u.protocol === "http:" && isLoopbackHost(u.hostname);
+}
+function sameOrigin(a, b) {
+  try {
+    return normalizeHost(a) === normalizeHost(b);
+  } catch {
+    return false;
+  }
+}
+function assertTokenTransport(target) {
+  let u;
+  try {
+    u = new URL(target);
+  } catch {
+    throw new Error("not a URL");
+  }
+  if (!isSecureUrl(u)) throw new Error(`https is required (http is only allowed on localhost): ${u.origin}`);
+  return u;
+}
+var machineName = () => os.hostname().split(".")[0] || "machine";
+function runCmd(bin, args, opts = {}) {
+  return new Promise((resolve) => {
+    execFile(bin, args, { cwd: opts.cwd, env: opts.env, timeout: opts.timeoutMs ?? 2e4, maxBuffer: 1 << 20 }, (error, stdout, stderr) => {
+      if (!error) return resolve({ code: 0, stdout: String(stdout), stderr: String(stderr) });
+      const code = typeof error.code === "number" ? error.code : 127;
+      resolve({ code, stdout: String(stdout), stderr: String(stderr) });
+    });
+  });
+}
+
+export {
+  DEFAULT_HOST,
+  defaultCtx,
+  hostFromEnv,
+  normalizeHost,
+  hostFromFlag,
+  sameOrigin,
+  assertTokenTransport,
+  machineName,
+  runCmd
+};