@hivefloor/cli 0.1.4 → 0.1.5

package/dist/{disconnect-MKRHK4CX.js → disconnect-WQMDCUXT.js}

@@ -2,7 +2,7 @@
 import {
   removeCliCopy,
   removeMachineHooks
-} from "./chunk-GT3HFFT4.js";
+} from "./chunk-U6RRUAC2.js";
 import {
   claudeJson,
   geminiSettings,
@@ -14,41 +14,42 @@ import {
   removeGrok,
   removeRcLine,
   updateManifest
-} from "./chunk-QHYZBHXO.js";
+} from "./chunk-6XVIEX75.js";
 import {
-  REAL_TOOLS,
-  TOOL_LABEL,
-  isTool
-} from "./chunk-2IMJECYD.js";
+  KEYCHAIN_SERVICE,
+  deleteCredentials,
+  readCredentials,
+  uninstallService
+} from "./chunk-6MDJB3BV.js";
 import {
   checkUnknownFlags,
   flagStr
 } from "./chunk-TKMIV7BG.js";
-import {
-  deleteCredentials,
-  readCredentials,
-  uninstallService
-} from "./chunk-PDXYOREI.js";
-import "./chunk-UJ4BQFWV.js";
+import "./chunk-J36OIJBM.js";
 import {
   readMachine,
   removeMachineFile
-} from "./chunk-T7TG6WA4.js";
+} from "./chunk-IJRHCDIG.js";
 import {
   apiRequest
-} from "./chunk-PY74LT2W.js";
+} from "./chunk-VX7SCIF2.js";
 import {
   ConfigError,
+  REAL_TOOLS,
+  TOOL_LABEL,
+  isTool,
   machineSpoolFile,
   manifestFile,
   removeFile,
   serviceLogFile,
   serviceStateFile
-} from "./chunk-VNCQFFQO.js";
+} from "./chunk-TPMFQUAW.js";
 import {
-  normalizeHost,
-  runCmd
-} from "./chunk-ZC2DAKB5.js";
+  hostFromFlag,
+  runCmd,
+  sameOrigin
+} from "./chunk-SOXRITAW.js";
+import "./chunk-4DRHR7LR.js";
 import "./chunk-K3NQKI34.js";
 
 // src/disconnect.ts
@@ -68,13 +69,13 @@ async function disconnect(ctx, p) {
     return 2;
   }
   const hostFlag = flagStr(p, "host");
-  const host = hostFlag ? normalizeHost(hostFlag) : void 0;
+  const host = hostFlag ? hostFromFlag(ctx, hostFlag) : void 0;
   const tools = toolFlag ? [toolFlag] : REAL_TOOLS;
   const manifest = readManifest();
   const lines = [];
   const warnings = [];
   const machine = readMachine();
-  if (machine && !toolFlag) {
+  if (machine && !toolFlag && (host === void 0 || sameOrigin(machine.host, host))) {
     if (!machine.revoked) {
       try {
         const r = await apiRequest(ctx, machine.host, "/api/v1/machine/disconnect", { method: "POST", token: machine.token, body: {}, timeoutMs: 8e3 });
@@ -95,14 +96,26 @@ async function disconnect(ctx, p) {
     lines.push("Machine token and state removed");
   }
   const keepHooks = machine !== void 0 && !machine.revoked && toolFlag !== void 0;
-  for (const tool of tools) {
+  const credHosts = Object.keys(readCredentials().hosts);
+  const otherHosts = host === void 0 ? [] : credHosts.filter((h) => h !== host && !sameOrigin(h, host));
+  const disconnectsStoredHost = host !== void 0 && credHosts.some((h) => h === host || sameOrigin(h, host));
+  const lastHost = disconnectsStoredHost && otherHosts.length === 0;
+  const ownedHere = (owner) => host === void 0 || lastHost || typeof owner === "string" && owner.length > 0 && sameOrigin(owner, host);
+  const dropping = tools.filter((tool) => toolFlag !== void 0 || ownedHere(manifest.tools[tool]?.host));
+  const owners = Object.values(manifest.tools).map((e) => e?.host).filter((h) => typeof h === "string" && h.length > 0);
+  const rcOwnedHere = host === void 0 || lastHost || owners.length > 0 && owners.every((o) => sameOrigin(o, host));
+  const mixedOwners = owners.length > 1 && owners.some((o) => !sameOrigin(o, owners[0]));
+  if (host !== void 0 && !rcOwnedHere && mixedOwners && manifest.rc.length > 0) {
+    warnings.push(`shell export kept while tools point at more than one host; "hivefloor token" follows the last host, so it can still be a token for ${host} after this disconnect`);
+  }
+  for (const tool of dropping) {
     const entry = manifest.tools[tool];
     const viaCli = entry?.mcp === "cli";
     const legacyBak = tool === "claude" ? fs.existsSync(claudeJson() + ".hivefloor.bak") : tool === "gemini" ? fs.existsSync(geminiSettings() + ".hivefloor.bak") : false;
     const viaFile = entry ? entry.mcp === "file" : legacyBak;
     let r;
     try {
-      r = tool === "claude" ? await removeClaude(ctx, viaCli, keepHooks, viaFile) : tool === "codex" ? await removeCodex(ctx, viaCli, keepHooks) : tool === "cursor" ? await removeCursor() : tool === "gemini" ? await removeGemini(ctx, viaCli, viaFile) : await removeGrok(ctx, viaCli);
+      r = tool === "claude" ? await removeClaude(ctx, viaCli, keepHooks, viaFile) : tool === "codex" ? await removeCodex(ctx, viaCli, keepHooks) : tool === "cursor" ? await removeCursor() : tool === "gemini" ? await removeGemini(ctx, viaCli, viaFile) : await removeGrok(ctx, viaCli, viaFile);
     } catch (e) {
       if (!(e instanceof ConfigError)) throw e;
       warnings.push(e.message);
@@ -112,21 +125,22 @@ async function disconnect(ctx, p) {
     warnings.push(...r.warnings);
     if (viaCli && r.lines.length === 0) warnings.push(`${TOOL_LABEL[tool]}: could not run its CLI to remove the "hivefloor" MCP server; remove it by hand`);
   }
-  const n = await deleteCredentials(host, toolFlag);
+  const { removed: n, leftover } = await deleteCredentials(host, toolFlag);
   if (n > 0) lines.push(`Removed ${n} stored token${n === 1 ? "" : "s"}`);
+  for (const a of leftover) warnings.push(`keychain entry ${a} (service ${KEYCHAIN_SERVICE}) was not removed; delete it in your OS keychain app`);
   const left = Object.keys(readCredentials().hosts).length > 0;
-  if (!toolFlag || !left) {
+  if ((!toolFlag || !left) && rcOwnedHere) {
     const files = readManifest().rc;
     for (const f of files) if (removeRcLine(f)) lines.push(`Shell: removed the token export from ${f}`);
     updateManifest((m2) => m2.rc = []);
   }
   updateManifest((m2) => {
-    for (const t of tools) delete m2.tools[t];
+    for (const t of dropping) delete m2.tools[t];
   });
   const m = readManifest();
   if (Object.keys(m.tools).length === 0 && m.rc.length === 0) removeFile(manifestFile());
-  if (lines.length === 0) ctx.out("Nothing to remove: no Hivefloor entries found.\n");
-  else {
+  if (lines.length === 0 && warnings.length === 0) ctx.out("Nothing to remove: no Hivefloor entries found.\n");
+  else if (lines.length > 0) {
     ctx.out("Disconnected:\n");
     for (const l of lines) ctx.out(`  ${l}
 `);

package/dist/{hook-KR2HGVAR.js → hook-AYJNRGIY.js}

@@ -4,11 +4,15 @@ import {
 } from "./chunk-JCLWCMEM.js";
 import {
   detectRepo
-} from "./chunk-2BSA7LFD.js";
+} from "./chunk-RYGL6XU4.js";
+import {
+  envTokenForHost
+} from "./chunk-H6NYMF2D.js";
 import {
   defaultHost,
   loadToken
-} from "./chunk-PDXYOREI.js";
+} from "./chunk-6MDJB3BV.js";
+import "./chunk-TKMIV7BG.js";
 import {
   appendToSpool,
   contextEventName,
@@ -18,23 +22,26 @@ import {
   stashNudges,
   takeSpool,
   takeStashed
-} from "./chunk-O2TC3WSS.js";
+} from "./chunk-X6B6R32A.js";
 import {
   readMachine,
   serviceAlive
-} from "./chunk-T7TG6WA4.js";
+} from "./chunk-IJRHCDIG.js";
 import {
   configDir,
   machineSpoolFile
-} from "./chunk-VNCQFFQO.js";
+} from "./chunk-TPMFQUAW.js";
 import {
   DEFAULT_HOST,
+  assertTokenTransport,
+  hostFromEnv
+} from "./chunk-SOXRITAW.js";
+import {
   HOOK_BATCH_MAX,
   PROFILE_KEY_RE,
   SESSION_ACCOUNT_RE,
-  hostFromEnv,
   redact
-} from "./chunk-ZC2DAKB5.js";
+} from "./chunk-4DRHR7LR.js";
 import "./chunk-K3NQKI34.js";
 
 // src/hook.ts
@@ -152,11 +159,18 @@ function isDuplicate(key, nowMs) {
   return dup;
 }
 async function post(deps, host, token, events, timeoutMs, route = "/api/v1/hooks", nudges) {
+  try {
+    assertTokenTransport(host);
+  } catch {
+    return "drop";
+  }
   try {
     const res = await deps.fetch(`${host}${route}`, {
       method: "POST",
       headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
       body: JSON.stringify({ events }),
+      redirect: "error",
+      // a 3xx would send this bearer token to another URL
       signal: AbortSignal.timeout(timeoutMs)
     });
     const text = await res.text().catch(() => "");
@@ -199,7 +213,7 @@ async function runHookInner(args, deps, startedAt) {
   const host = machine ? machine.host : deps.env.HIVEFLOOR_URL ? hostFromEnv(deps.env) : defaultHost() ?? DEFAULT_HOST;
   const grokId = deps.env.GROK_SESSION_ID;
   const tool = grokId ? "grok" : toolArg;
-  const envToken = deps.env.HIVEFLOOR_TOKEN;
+  const envToken = machine ? void 0 : envTokenForHost(deps.env, host);
   const stored = !machine && !envToken ? await loadToken(host, tool) : void 0;
   const token = machine ? machine.token : envToken || stored?.token;
   if (!token) return;

package/dist/index.js

@@ -11,12 +11,12 @@ if (argv[0] === "hook") {
   process.on("unhandledRejection", () => process.exit(0));
   setTimeout(() => process.exit(0), HARD_EXIT_MS).unref();
   try {
-    const { runHookCli } = await import("./hook-KR2HGVAR.js");
+    const { runHookCli } = await import("./hook-AYJNRGIY.js");
     await runHookCli(argv.slice(1));
   } catch {
   }
   process.exit(0);
 } else {
-  const { run } = await import("./cli-P3DYE5IR.js");
+  const { run } = await import("./cli-JCBZICR3.js");
   process.exitCode = await run(argv);
 }

package/dist/{link-HXBMMSG3.js → link-ORT4LID6.js}

@@ -1,38 +1,53 @@
 #!/usr/bin/env node
 import {
   deviceLogin
-} from "./chunk-R5KDI4WI.js";
+} from "./chunk-3N5JYP5O.js";
 import {
   detectRepo
-} from "./chunk-2BSA7LFD.js";
+} from "./chunk-RYGL6XU4.js";
 import {
   resolveSession
-} from "./chunk-7KF7IQJN.js";
+} from "./chunk-H6NYMF2D.js";
 import {
-  isTool
-} from "./chunk-2IMJECYD.js";
+  saveToken
+} from "./chunk-6MDJB3BV.js";
 import {
+  checkUnknownFlags,
   flagStr
 } from "./chunk-TKMIV7BG.js";
-import {
-  saveToken
-} from "./chunk-PDXYOREI.js";
 import {
   VERSION
-} from "./chunk-DNG5CRT3.js";
+} from "./chunk-C627OKTW.js";
 import {
   apiRequest,
   errorOf
-} from "./chunk-PY74LT2W.js";
-import "./chunk-VNCQFFQO.js";
+} from "./chunk-VX7SCIF2.js";
+import {
+  isTool
+} from "./chunk-TPMFQUAW.js";
 import {
-  cliNpxCommand,
   machineName
-} from "./chunk-ZC2DAKB5.js";
+} from "./chunk-SOXRITAW.js";
+import {
+  cliNpxCommand
+} from "./chunk-4DRHR7LR.js";
 import "./chunk-K3NQKI34.js";
 
 // src/link.ts
+var LINK_FLAGS = /* @__PURE__ */ new Set(["project", "new", "path", "tool", "host", "no-open", "help", "h"]);
 async function link(ctx, p) {
+  const unknown = checkUnknownFlags(p, LINK_FLAGS);
+  if (unknown) {
+    ctx.err(`hivefloor: unknown flag "--${unknown}". Run "hivefloor help".
+`);
+    return 2;
+  }
+  const project = flagStr(p, "project");
+  const newName = flagStr(p, "new");
+  if (project && newName) {
+    ctx.err("hivefloor: pass --project or --new, not both.\n");
+    return 2;
+  }
   const repo = await detectRepo(ctx.cwd);
   if (!repo) {
     ctx.err("hivefloor: this directory has no git remote to link.\n");
@@ -44,8 +59,6 @@ async function link(ctx, p) {
 `);
     return 1;
   }
-  const project = flagStr(p, "project");
-  const newName = flagStr(p, "new");
   const prefix = flagStr(p, "path") ?? repo.path;
   if (project || newName) {
     const body = { remote: repo.remote, ...prefix ? { path_prefix: prefix } : {}, ...project ? { project_id: project } : { new_project_name: newName } };
@@ -64,7 +77,7 @@ async function link(ctx, p) {
   const tool = toolFlag && isTool(toolFlag) ? toolFlag : isTool(s.tool) ? s.tool : "other";
   const request = {
     client: { tool, machine: machineName(), os: process.platform, cli_version: VERSION },
-    repo: { remote: repo.remote, ...repo.branch ? { branch: repo.branch } : {}, ...repo.path ? { path: repo.path } : {} }
+    repo: { remote: repo.remote, ...repo.branch ? { branch: repo.branch } : {}, ...prefix ? { path: prefix } : {} }
   };
   const result = await deviceLogin(ctx, { host: s.host, request, openBrowser: !p.flags["no-open"] });
   await saveToken(s.host, tool, result.token, { agent: result.agent, project: result.project });

package/dist/{machine-connect-BYHZRRRB.js → machine-connect-N52CKQEW.js}

@@ -1,53 +1,53 @@
 #!/usr/bin/env node
 import {
   resolveHost
-} from "./chunk-SD65CIIY.js";
+} from "./chunk-IWIDKNWC.js";
 import {
   deviceLogin
-} from "./chunk-R5KDI4WI.js";
+} from "./chunk-3N5JYP5O.js";
 import {
   installCliCopy,
   installMachineHooks
-} from "./chunk-GT3HFFT4.js";
-import "./chunk-QHYZBHXO.js";
-import "./chunk-2BSA7LFD.js";
+} from "./chunk-U6RRUAC2.js";
+import "./chunk-6XVIEX75.js";
+import "./chunk-RYGL6XU4.js";
 import {
-  findBin
-} from "./chunk-2IMJECYD.js";
+  installService,
+  windowsUser
+} from "./chunk-6MDJB3BV.js";
 import {
   flagStr
 } from "./chunk-TKMIV7BG.js";
-import {
-  installService,
-  windowsUser
-} from "./chunk-PDXYOREI.js";
 import {
   claudeDirsOfScan,
   cliVersionOs,
   scanProcesses
-} from "./chunk-W7DROKC7.js";
+} from "./chunk-MZGGJ6ZS.js";
 import {
   VERSION
-} from "./chunk-DNG5CRT3.js";
+} from "./chunk-C627OKTW.js";
 import {
   codexConfigDir
-} from "./chunk-UJ4BQFWV.js";
+} from "./chunk-J36OIJBM.js";
 import {
   readMachine,
   secureWindowsMachine,
   writeMachine
-} from "./chunk-T7TG6WA4.js";
-import "./chunk-PY74LT2W.js";
+} from "./chunk-IJRHCDIG.js";
+import "./chunk-VX7SCIF2.js";
 import {
-  cliEntry
-} from "./chunk-VNCQFFQO.js";
+  cliEntry,
+  findBin
+} from "./chunk-TPMFQUAW.js";
 import {
-  cliNpxCommand,
   machineName,
-  machineTokenSuccessSchema,
   normalizeHost,
   runCmd
-} from "./chunk-ZC2DAKB5.js";
+} from "./chunk-SOXRITAW.js";
+import {
+  cliNpxCommand,
+  machineTokenSuccessSchema
+} from "./chunk-4DRHR7LR.js";
 import "./chunk-K3NQKI34.js";
 
 // src/machine-connect.ts

package/dist/{mcp-N2TMD4GR.js → mcp-2SF6Y73M.js}

@@ -1,25 +1,25 @@
 #!/usr/bin/env node
 import {
   detectRepo
-} from "./chunk-2BSA7LFD.js";
+} from "./chunk-RYGL6XU4.js";
 import {
   resolveSession
-} from "./chunk-7KF7IQJN.js";
-import {
-  toolFromEnv
-} from "./chunk-2IMJECYD.js";
+} from "./chunk-H6NYMF2D.js";
+import "./chunk-6MDJB3BV.js";
 import {
+  checkUnknownFlags,
   flagStr
 } from "./chunk-TKMIV7BG.js";
 import {
-  loadToken
-} from "./chunk-PDXYOREI.js";
-import "./chunk-VNCQFFQO.js";
+  toolFromEnv
+} from "./chunk-TPMFQUAW.js";
+import {
+  assertTokenTransport,
+  sameOrigin
+} from "./chunk-SOXRITAW.js";
 import {
-  cliNpxCommand,
-  isSecureUrl,
-  normalizeHost
-} from "./chunk-ZC2DAKB5.js";
+  cliNpxCommand
+} from "./chunk-4DRHR7LR.js";
 import "./chunk-K3NQKI34.js";
 
 // src/mcp.ts
@@ -42,17 +42,21 @@ async function contextHeaders(ctx, token, toolName) {
 }
 var isRequest = (m) => "method" in m && "id" in m;
 function mcpTargetUrl(flagUrl, host) {
-  if (!flagUrl) return new URL(`${host}/mcp`);
-  let u;
   try {
-    u = new URL(flagUrl);
-  } catch {
-    throw new Error("--url is not a URL");
+    return assertTokenTransport(flagUrl ?? `${host}/mcp`);
+  } catch (e) {
+    if (flagUrl && e.message === "not a URL") throw new Error("--url is not a URL");
+    throw e;
   }
-  if (!isSecureUrl(u)) throw new Error(`--url must be https (http is only allowed on localhost): ${u.origin}`);
-  return u;
 }
+var MCP_FLAGS = /* @__PURE__ */ new Set(["url", "host", "tool", "help", "h"]);
 async function runMcpProxy(ctx, p, io = { stdin: process.stdin, stdout: process.stdout }) {
+  const unknown = checkUnknownFlags(p, MCP_FLAGS);
+  if (unknown) {
+    ctx.err(`hivefloor: unknown flag "--${unknown}". Run "hivefloor help".
+`);
+    return 2;
+  }
   const s = await resolveSession(ctx, p);
   if (!s) {
     ctx.err(`hivefloor: not connected. Run: ${cliNpxCommand("connect")}
@@ -67,19 +71,12 @@ async function runMcpProxy(ctx, p, io = { stdin: process.stdin, stdout: process.
 `);
     return 1;
   }
-  let token = s.token;
-  let tool = s.tool;
-  if (url.origin !== new URL(s.host).origin) {
-    const other = await loadToken(normalizeHost(url.origin));
-    if (!other) {
-      ctx.err(`hivefloor mcp: refusing to send the token of ${s.host} to ${url.origin}; connect to that host first
+  if (!sameOrigin(url.origin, s.host)) {
+    ctx.err(`hivefloor mcp: refusing to send the token of ${s.host} to ${url.origin}; --url must be the same host
 `);
-      return 1;
-    }
-    token = other.token;
-    tool = other.tool;
+    return 1;
   }
-  const headers = await contextHeaders(ctx, token, tool);
+  const headers = await contextHeaders(ctx, s.token, s.tool);
   const upstream = new StreamableHTTPClientTransport(url, { requestInit: { headers } });
   const downstream = new StdioServerTransport(io.stdin, io.stdout);
   return await new Promise((resolve) => {

package/dist/{run-336BSU72.js → run-ZAZ45MKQ.js}

@@ -4,30 +4,30 @@ import {
   releaseSpool,
   stashNudges,
   takeSpool
-} from "./chunk-O2TC3WSS.js";
+} from "./chunk-X6B6R32A.js";
 import {
   buildProfiles,
   cliVersionOs,
   makeEnvReader,
   scanProcesses
-} from "./chunk-W7DROKC7.js";
+} from "./chunk-MZGGJ6ZS.js";
 import {
   VERSION
-} from "./chunk-DNG5CRT3.js";
+} from "./chunk-C627OKTW.js";
 import {
   claudeDirsFromRc,
   profileKeyOf,
   profileKeys,
   uniqueProfileKey
-} from "./chunk-UJ4BQFWV.js";
+} from "./chunk-J36OIJBM.js";
 import {
   readMachine,
   writeMachine,
   writeServiceState
-} from "./chunk-T7TG6WA4.js";
+} from "./chunk-IJRHCDIG.js";
 import {
   apiRequest
-} from "./chunk-PY74LT2W.js";
+} from "./chunk-VX7SCIF2.js";
 import {
   configDir,
   home,
@@ -35,16 +35,19 @@ import {
   isRecord,
   machineSpoolFile,
   serviceLogFile
-} from "./chunk-VNCQFFQO.js";
+} from "./chunk-TPMFQUAW.js";
+import {
+  runCmd
+} from "./chunk-SOXRITAW.js";
 import {
   HOOK_BATCH_MAX,
   MACHINE_HEARTBEAT_SECONDS,
   MACHINE_MIN_INTERVAL_SECONDS,
+  estimateClaudeCostUsd,
   machineHeartbeatResponseSchema,
   parseUsageKey,
-  runCmd,
   usageReadingSchema
-} from "./chunk-ZC2DAKB5.js";
+} from "./chunk-4DRHR7LR.js";
 import "./chunk-K3NQKI34.js";
 
 // src/service/run.ts
@@ -285,7 +288,16 @@ function parseClaudeLine(state, line) {
   state.tokensIn += (input ?? 0) + (cacheCreate ?? 0) + (cacheRead ?? 0);
   state.tokensOut += output ?? 0;
   state.hasUsage = true;
-  const cost = asPositiveCost(raw.costUSD ?? raw.cost_usd ?? msg.costUSD ?? msg.cost_usd ?? usage.cost_usd ?? usage.costUSD);
+  let cost = asPositiveCost(raw.costUSD ?? raw.cost_usd ?? msg.costUSD ?? msg.cost_usd ?? usage.cost_usd ?? usage.costUSD);
+  if (cost === void 0) {
+    const est = estimateClaudeCostUsd(typeof msg.model === "string" ? msg.model : void 0, {
+      input: input ?? 0,
+      output: output ?? 0,
+      cacheRead: cacheRead ?? 0,
+      cacheWrite: cacheCreate ?? 0
+    });
+    if (est !== null && est > 0) cost = est;
+  }
   if (cost !== void 0) {
     state.costUsd += cost;
     state.hasCost = true;

package/dist/{status-KBBSAADD.js → status-GOCFNO7K.js}

@@ -1,41 +1,52 @@
 #!/usr/bin/env node
 import {
   detectRepo
-} from "./chunk-2BSA7LFD.js";
+} from "./chunk-RYGL6XU4.js";
 import {
   resolveSession
-} from "./chunk-7KF7IQJN.js";
-import "./chunk-2IMJECYD.js";
-import "./chunk-TKMIV7BG.js";
+} from "./chunk-H6NYMF2D.js";
 import {
   SCHTASKS_TASK,
+  hostKey,
   readCredentials,
   windowsServiceStatus
-} from "./chunk-PDXYOREI.js";
+} from "./chunk-6MDJB3BV.js";
+import {
+  checkUnknownFlags
+} from "./chunk-TKMIV7BG.js";
 import {
   profileKeys
-} from "./chunk-UJ4BQFWV.js";
+} from "./chunk-J36OIJBM.js";
 import {
   SERVICE_ALIVE_MS,
   readMachine,
   readServiceState
-} from "./chunk-T7TG6WA4.js";
+} from "./chunk-IJRHCDIG.js";
 import {
   apiRequest,
   errorOf
-} from "./chunk-PY74LT2W.js";
-import "./chunk-VNCQFFQO.js";
+} from "./chunk-VX7SCIF2.js";
+import "./chunk-TPMFQUAW.js";
 import {
-  cliNpxCommand,
   machineName,
   runCmd
-} from "./chunk-ZC2DAKB5.js";
+} from "./chunk-SOXRITAW.js";
+import {
+  cliNpxCommand
+} from "./chunk-4DRHR7LR.js";
 import "./chunk-K3NQKI34.js";
 
 // src/status.ts
 var str = (v) => typeof v === "string" ? v : void 0;
 var rec = (v) => typeof v === "object" && v !== null ? v : {};
+var STATUS_FLAGS = /* @__PURE__ */ new Set(["host", "tool", "help", "h"]);
 async function status(ctx, p) {
+  const unknown = checkUnknownFlags(p, STATUS_FLAGS);
+  if (unknown) {
+    ctx.err(`hivefloor: unknown flag "--${unknown}". Run "hivefloor help".
+`);
+    return 2;
+  }
   const machine = readMachine();
   if (machine) await machineStatus(ctx, machine);
   const s = await resolveSession(ctx, p);
@@ -50,7 +61,8 @@ async function status(ctx, p) {
   ctx.out(`Host: ${s.host}
 Machine: ${machineName()}
 `);
-  const connected = Object.keys(readCredentials().hosts[s.host]?.tools ?? {});
+  const creds = readCredentials();
+  const connected = Object.keys(creds.hosts[hostKey(creds, s.host) ?? ""]?.tools ?? {});
   if (connected.length > 0) ctx.out(`Connected tools: ${connected.join(", ")}
 `);
   if (repo) ctx.out(`Repo here: ${repo.remote}${repo.branch ? ` (${repo.branch})` : ""}
@@ -59,7 +71,7 @@ Machine: ${machineName()}
   try {
     res = await apiRequest(ctx, s.host, "/api/v1/agent/whoami", { token: s.token, headers: repo ? { "x-hf-repo": repo.remote } : {}, timeoutMs: 8e3 });
   } catch (e) {
-    ctx.err(`hivefloor: could not reach ${s.host}: ${e.message}
+    ctx.err(`hivefloor: ${e.message}
 `);
     return 1;
   }

package/dist/{token-JDRLEV5D.js → token-EMM4AJAU.js}

@@ -1,18 +1,27 @@
 #!/usr/bin/env node
 import {
   resolveSession
-} from "./chunk-7KF7IQJN.js";
-import "./chunk-2IMJECYD.js";
-import "./chunk-TKMIV7BG.js";
-import "./chunk-PDXYOREI.js";
-import "./chunk-VNCQFFQO.js";
+} from "./chunk-H6NYMF2D.js";
+import "./chunk-6MDJB3BV.js";
+import {
+  checkUnknownFlags
+} from "./chunk-TKMIV7BG.js";
+import "./chunk-TPMFQUAW.js";
+import "./chunk-SOXRITAW.js";
 import {
   cliNpxCommand
-} from "./chunk-ZC2DAKB5.js";
+} from "./chunk-4DRHR7LR.js";
 import "./chunk-K3NQKI34.js";
 
 // src/token.ts
+var TOKEN_FLAGS = /* @__PURE__ */ new Set(["reveal", "host", "tool", "help", "h"]);
 async function token(ctx, p) {
+  const unknown = checkUnknownFlags(p, TOKEN_FLAGS);
+  if (unknown) {
+    ctx.err(`hivefloor: unknown flag "--${unknown}". Run "hivefloor help".
+`);
+    return 2;
+  }
   const s = await resolveSession(ctx, p);
   if (!s) {
     ctx.err(`hivefloor: no token stored. Run: ${cliNpxCommand("connect")}