@hivefloor/cli 0.1.5 → 0.1.8

package/dist/{chunk-6MDJB3BV.js → chunk-QLMLB7RB.js}

@@ -1,4 +1,9 @@
 #!/usr/bin/env node
+import { createRequire as __hfCreateRequire } from 'node:module';
+const require = __hfCreateRequire(import.meta.url);
+import {
+  userBinDirs
+} from "./chunk-XAXKZ572.js";
 import {
   atomicWrite,
   atomicWriteUtf16,
@@ -8,15 +13,15 @@ import {
   isRecord,
   readText,
   removeFile
-} from "./chunk-TPMFQUAW.js";
+} from "./chunk-XPGL7VYE.js";
 import {
   normalizeHost,
   runCmd,
   sameOrigin
-} from "./chunk-SOXRITAW.js";
+} from "./chunk-QGULSOQ2.js";
 import {
   cliNpxCommand
-} from "./chunk-4DRHR7LR.js";
+} from "./chunk-HWBUESB4.js";
 
 // src/service/units.ts
 import os from "os";
@@ -27,8 +32,11 @@ var SCHTASKS_TASK = "Hivefloor Machine";
 var xml = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 var sdEscape = (s) => s.replace(/(["\\$])/g, "\\$1").replace(/%/g, "%%");
 var sdQuote = (s) => /^[\w@+=:,./-]+$/.test(s) ? s : `"${sdEscape(s)}"`;
+function unitPath(plan, system, homeDir = home()) {
+  if (/[\r\n\0]/.test(homeDir)) throw new Error("refusing to write a service unit: HOME contains a control character");
+  return [path.dirname(plan.node), ...userBinDirs(homeDir), ...system].filter((d, i, a) => a.indexOf(d) === i).join(":");
+}
 function launchdPlist(plan) {
-  const bin = path.dirname(plan.node);
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -54,7 +62,7 @@ function launchdPlist(plan) {
   <key>EnvironmentVariables</key>
   <dict>
     <key>PATH</key>
-    <string>${xml(`${bin}:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin`)}</string>
+    <string>${xml(unitPath(plan, ["/usr/bin", "/bin", "/usr/sbin", "/sbin"]))}</string>
   </dict>
   <key>StandardOutPath</key>
   <string>/dev/null</string>
@@ -66,14 +74,14 @@ function launchdPlist(plan) {
 }
 function systemdUnit(plan) {
   return `[Unit]
-Description=Hivefloor machine service
+Description=HiveFloor machine service
 After=network-online.target
 
 [Service]
 ExecStart=${sdQuote(plan.node)} ${sdQuote(plan.script)} service run
 Restart=on-failure
 RestartSec=30
-Environment="PATH=${sdEscape(`${path.dirname(plan.node)}:/usr/local/bin:/usr/bin:/bin`)}"
+Environment="PATH=${sdEscape(unitPath(plan, ["/usr/bin", "/bin"]))}"
 
 [Install]
 WantedBy=default.target
@@ -95,7 +103,7 @@ function windowsTaskXml(plan, user) {
   return `<?xml version="1.0" encoding="UTF-16"?>
 <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
   <RegistrationInfo>
-    <Description>Hivefloor machine service</Description>
+    <Description>HiveFloor machine service</Description>
   </RegistrationInfo>
   <Triggers>
     <LogonTrigger>
@@ -278,7 +286,7 @@ function writeCredentials(c) {
   }
   atomicWrite(file, JSON.stringify(c, null, 2) + "\n", 384);
 }
-var windowsAclError = () => new Error("could not restrict the Hivefloor config to your Windows user with icacls; the token was not kept");
+var windowsAclError = () => new Error("could not restrict the HiveFloor config to your Windows user with icacls; the token was not kept");
 async function secureWindowsCredentials(run, username) {
   if (!username) throw new Error("could not determine the Windows user; the token was not kept");
   const dir = prepareConfigDir();

package/dist/{chunk-TKMIV7BG.js → chunk-QPAFN47B.js}

@@ -1,7 +1,9 @@
 #!/usr/bin/env node
+import { createRequire as __hfCreateRequire } from 'node:module';
+const require = __hfCreateRequire(import.meta.url);
 
 // src/args.ts
-var BOOLEAN = /* @__PURE__ */ new Set(["no-open", "yes", "y", "reveal", "help", "h", "json", "no-cli", "agent", "no-service"]);
+var BOOLEAN = /* @__PURE__ */ new Set(["no-open", "yes", "y", "reveal", "help", "h", "json", "no-cli", "agent", "no-service", "permission-prompt", "full", "no-full"]);
 function parseArgs(argv) {
   const positionals = [];
   const flags = {};

package/dist/chunk-SBOEAOHD.js

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+import { createRequire as __hfCreateRequire } from 'node:module';
+const require = __hfCreateRequire(import.meta.url);
+
+// src/service/control/private.ts
+import fs from "fs";
+var uid = () => typeof process.getuid === "function" ? process.getuid() : void 0;
+function ensurePrivateDir(dir) {
+  fs.mkdirSync(dir, { recursive: true, mode: 448 });
+  if (process.platform !== "win32") fs.chmodSync(dir, 448);
+}
+function privateDirTrouble(dir) {
+  let st;
+  try {
+    st = fs.lstatSync(dir);
+  } catch {
+    return `${dir} does not exist`;
+  }
+  if (st.isSymbolicLink() || !st.isDirectory()) return `${dir} is not a plain folder`;
+  if (process.platform === "win32") return void 0;
+  if (uid() !== void 0 && st.uid !== uid()) return `${dir} is owned by another user`;
+  if ((st.mode & 63) !== 0) return `${dir} is open to group or others`;
+  return void 0;
+}
+function privateFileTrouble(file) {
+  let st;
+  try {
+    st = fs.lstatSync(file);
+  } catch {
+    return `${file} does not exist`;
+  }
+  if (st.isSymbolicLink() || !st.isFile()) return `${file} is not a regular file`;
+  if (process.platform === "win32") return void 0;
+  if (uid() !== void 0 && st.uid !== uid()) return `${file} is owned by another user`;
+  if ((st.mode & 63) !== 0) return `${file} is open to group or others`;
+  return void 0;
+}
+function safeName(id) {
+  const s = id.replace(/[^A-Za-z0-9_.-]/g, "_").replace(/^\.+/, "_").slice(0, 120);
+  return s === "" ? "_" : s;
+}
+
+export {
+  ensurePrivateDir,
+  privateDirTrouble,
+  privateFileTrouble,
+  safeName
+};

package/dist/{chunk-IWIDKNWC.js → chunk-TIR4CV3P.js}

@@ -1,44 +1,48 @@
 #!/usr/bin/env node
+import { createRequire as __hfCreateRequire } from 'node:module';
+const require = __hfCreateRequire(import.meta.url);
 import {
   deviceLogin
-} from "./chunk-3N5JYP5O.js";
+} from "./chunk-FPJNGKT5.js";
 import {
   RC_LINE,
   addRcLine,
-  emptyReport,
-  envTokenSharedWith,
   hasRcLine,
-  installClaude,
-  installCodex,
   installCursor,
   installGemini,
   installGrok,
-  rcFileFor,
+  rcFileFor
+} from "./chunk-QBBKGORP.js";
+import {
+  emptyReport,
+  envTokenSharedWith,
+  installClaude,
+  installCodex,
   readManifest,
   toolReadsEnvToken,
   updateManifest
-} from "./chunk-6XVIEX75.js";
+} from "./chunk-X2KH6AR4.js";
 import {
   detectRepo
-} from "./chunk-RYGL6XU4.js";
+} from "./chunk-BLLPDPTL.js";
 import {
   defaultHost,
   loadToken,
   saveToken
-} from "./chunk-6MDJB3BV.js";
+} from "./chunk-QLMLB7RB.js";
 import {
   checkUnknownFlags,
   flagStr
-} from "./chunk-TKMIV7BG.js";
+} from "./chunk-QPAFN47B.js";
 import {
   VERSION
-} from "./chunk-C627OKTW.js";
+} from "./chunk-K2IRTZH5.js";
 import {
   readMachine
-} from "./chunk-IJRHCDIG.js";
+} from "./chunk-LX5A25O6.js";
 import {
   ApiError
-} from "./chunk-VX7SCIF2.js";
+} from "./chunk-NRJONTFT.js";
 import {
   ConfigError,
   REAL_TOOLS,
@@ -47,19 +51,19 @@ import {
   findBin,
   isTool,
   toolFromEnv
-} from "./chunk-TPMFQUAW.js";
+} from "./chunk-XPGL7VYE.js";
 import {
   hostFromEnv,
   hostFromFlag,
   machineName,
   normalizeHost,
   sameOrigin
-} from "./chunk-SOXRITAW.js";
+} from "./chunk-QGULSOQ2.js";
 import {
   CLI_BIN_NAME,
   CLI_INSTALL_COMMAND,
   cliNpxCommand
-} from "./chunk-4DRHR7LR.js";
+} from "./chunk-HWBUESB4.js";
 
 // src/connect.ts
 var INSTALLERS = {
@@ -252,7 +256,7 @@ async function connect(ctx, p) {
     return 2;
   }
   if (p.flags.agent || p.flags.tool !== void 0) return connectAgent(ctx, p);
-  return (await import("./machine-connect-N52CKQEW.js")).connectMachine(ctx, p);
+  return (await import("./machine-connect-KEI4BRWF.js")).connectMachine(ctx, p);
 }
 
 export {

package/dist/{chunk-6XVIEX75.js → chunk-X2KH6AR4.js}

@@ -1,7 +1,9 @@
 #!/usr/bin/env node
+import { createRequire as __hfCreateRequire } from 'node:module';
+const require = __hfCreateRequire(import.meta.url);
 import {
   ApiError
-} from "./chunk-VX7SCIF2.js";
+} from "./chunk-NRJONTFT.js";
 import {
   atomicWrite,
   backupOnce,
@@ -14,14 +16,11 @@ import {
   readText,
   removeFile,
   serializeJson
-} from "./chunk-TPMFQUAW.js";
+} from "./chunk-XPGL7VYE.js";
 import {
   runCmd,
   sameOrigin
-} from "./chunk-SOXRITAW.js";
-import {
-  cliNpxCommand
-} from "./chunk-4DRHR7LR.js";
+} from "./chunk-QGULSOQ2.js";
 
 // src/manifest.ts
 function readManifest() {
@@ -71,54 +70,8 @@ function envTokenSharedWith(host, tool, shellExportsToken) {
   });
 }
 
-// src/shellrc.ts
-import fs from "fs";
-import path from "path";
-var RC_MARK = "# hivefloor";
-var RC_LINE = `export HIVEFLOOR_TOKEN="$(hivefloor token)" ${RC_MARK}`;
-function rcFileFor(env) {
-  const shell = path.basename(env.SHELL ?? "");
-  if (shell === "zsh") return path.join(home(), ".zshrc");
-  if (shell === "bash") {
-    const profile = path.join(home(), ".bash_profile");
-    return process.platform === "darwin" && fs.existsSync(profile) ? profile : path.join(home(), ".bashrc");
-  }
-  return void 0;
-}
-function isRcLine(line) {
-  const t = line.trim();
-  return !t.startsWith("#") && t.includes("HIVEFLOOR_TOKEN") && t.includes("hivefloor token") && t.endsWith(RC_MARK);
-}
-function hasRcLine(file) {
-  return (readText(file) ?? "").split("\n").some(isRcLine);
-}
-function addRcLine(file) {
-  if (hasRcLine(file)) return false;
-  const cur = readText(file);
-  if (cur === void 0) addCreated(file);
-  const sep = cur && !cur.endsWith("\n") ? "\n" : "";
-  atomicWrite(file, `${cur ?? ""}${sep}${RC_LINE}
-`);
-  return true;
-}
-function removeRcLine(file) {
-  const cur = readText(file);
-  if (cur === void 0) return false;
-  const lines = cur.split("\n");
-  const kept = lines.filter((l) => !isRcLine(l));
-  if (kept.length === lines.length) return false;
-  const next = kept.join("\n");
-  if (next.trim() === "" && wasCreated(file)) {
-    fs.rmSync(file, { force: true });
-    forgetCreated(file);
-  } else {
-    atomicWrite(file, next);
-  }
-  return true;
-}
-
 // src/writers/common.ts
-import fs2 from "fs";
+import fs from "fs";
 var emptyReport = () => ({ lines: [], warnings: [] });
 var CLI_COPY_RE = /hivefloor[/\\]cli[/\\]index\.js$/;
 var MACHINE_CMD_RE = /hivefloor[/\\]+cli[/\\]+index\.js"?\s+hook\s/;
@@ -197,7 +150,7 @@ function editJson(file, mutate, opts = {}) {
 function secureFile(file) {
   for (const f of [file, `${file}.hivefloor.bak`]) {
     try {
-      fs2.chmodSync(f, 384);
+      fs.chmodSync(f, 384);
     } catch {
     }
   }
@@ -214,10 +167,10 @@ function dropBackupWithEntry(file, name) {
 }
 
 // src/writers/claude.ts
-import path2 from "path";
+import path from "path";
 var CLAUDE_EVENTS = ["SessionStart", "SessionEnd", "UserPromptSubmit", "Stop", "Notification", "SubagentStart", "SubagentStop"];
-var claudeJson = () => path2.join(home(), ".claude.json");
-var claudeSettings = () => path2.join(home(), ".claude", "settings.json");
+var claudeJson = () => path.join(home(), ".claude.json");
+var claudeSettings = () => path.join(home(), ".claude", "settings.json");
 var MCP_NAME = "hivefloor";
 function claudeHookSpecs() {
   return CLAUDE_EVENTS.map((event) => ({
@@ -295,7 +248,7 @@ async function removeClaude(ctx, viaCli, keepHooks = false, viaFile = false) {
 }
 
 // src/writers/codex.ts
-import path3 from "path";
+import path2 from "path";
 
 // src/writers/toml.ts
 var BEGIN = (name, sep) => `# hivefloor:begin ${name} sep=${sep}`;
@@ -423,9 +376,9 @@ function restoreFeatureHooks(content) {
 
 // src/writers/codex.ts
 var CODEX_EVENTS = ["SessionStart", "SessionEnd", "UserPromptSubmit", "Stop", "SubagentStart", "SubagentStop"];
-var codexDir = () => path3.join(process.env.CODEX_HOME || path3.join(home(), ".codex"));
-var codexConfig = () => path3.join(codexDir(), "config.toml");
-var codexHooks = () => path3.join(codexDir(), "hooks.json");
+var codexDir = () => path2.join(process.env.CODEX_HOME || path2.join(home(), ".codex"));
+var codexConfig = () => path2.join(codexDir(), "config.toml");
+var codexHooks = () => path2.join(codexDir(), "hooks.json");
 function codexHookSpecs() {
   return CODEX_EVENTS.map((event) => ({ event, entry: { type: "command", command: `hivefloor hook codex ${event}` } }));
 }
@@ -530,7 +483,7 @@ async function installCodex(i) {
       report.lines.push(`Codex hooks: ${codexHooks()} (${CODEX_EVENTS.join(", ")})`);
       editToml(enableFeatureHooks);
       report.lines.push(`Codex: features.hooks = true in ${codexConfig()}`);
-      report.warnings.push("Codex asks you to trust new hooks: run codex, open /hooks and approve the Hivefloor hooks once.");
+      report.warnings.push("Codex asks you to trust new hooks: run codex, open /hooks and approve the HiveFloor hooks once.");
     }
   }
   return { report, mcp };
@@ -552,234 +505,6 @@ async function removeCodex(ctx, viaCli, keepHooks = false) {
   return report;
 }
 
-// src/writers/cursor.ts
-import path4 from "path";
-var CURSOR_EVENTS = ["sessionStart", "sessionEnd", "beforeSubmitPrompt", "stop", "subagentStart", "subagentStop"];
-var cursorMcp = () => path4.join(home(), ".cursor", "mcp.json");
-var cursorHooks = () => path4.join(home(), ".cursor", "hooks.json");
-function cursorHookSpecs() {
-  return CURSOR_EVENTS.map((event) => ({ event, entry: { command: `hivefloor hook cursor ${event}` } }));
-}
-async function installCursor(i) {
-  const report = emptyReport();
-  const auth = i.useEnvToken ? "Bearer ${env:HIVEFLOOR_TOKEN}" : `Bearer ${i.token}`;
-  editJson(
-    cursorMcp(),
-    (d) => {
-      const servers = isRecord(d.mcpServers) ? d.mcpServers : d.mcpServers = {};
-      servers[MCP_NAME] = { url: i.mcpUrl, headers: { Authorization: auth } };
-      return true;
-    },
-    i.useEnvToken ? {} : { mode: 384 }
-  );
-  report.lines.push(`Cursor MCP: ${cursorMcp()} (mcpServers.${MCP_NAME})`);
-  i.onMcpRegistered?.("file");
-  if (!i.mcpOnly) {
-    editJson(cursorHooks(), (d) => {
-      if (d.version === void 0) d.version = 1;
-      addHooks(d, "flat", cursorHookSpecs());
-      return true;
-    });
-    report.lines.push(`Cursor hooks: ${cursorHooks()} (${CURSOR_EVENTS.join(", ")})`);
-  }
-  return { report, mcp: "file" };
-}
-async function removeCursor() {
-  const report = emptyReport();
-  const changed = editJson(
-    cursorMcp(),
-    (d) => {
-      if (!isRecord(d.mcpServers) || !(MCP_NAME in d.mcpServers)) return false;
-      delete d.mcpServers[MCP_NAME];
-      if (Object.keys(d.mcpServers).length === 0) delete d.mcpServers;
-      return true;
-    },
-    { drop: true }
-  );
-  if (changed) report.lines.push(`Cursor MCP: removed from ${cursorMcp()}`);
-  if (editJson(cursorHooks(), (d) => removeHooks(d, "flat") > 0, { drop: true })) report.lines.push(`Cursor hooks: removed from ${cursorHooks()}`);
-  return report;
-}
-
-// src/writers/gemini.ts
-import path5 from "path";
-var GEMINI_EVENTS = ["SessionStart", "SessionEnd", "AfterAgent"];
-var geminiSettings = () => path5.join(home(), ".gemini", "settings.json");
-function geminiHookSpecs() {
-  return GEMINI_EVENTS.map((event) => ({
-    event,
-    // Gemini hook entries carry a name: ours is "hivefloor", which is also how disconnect finds them.
-    entry: { name: "hivefloor", type: "command", command: `hivefloor hook gemini ${event}` }
-  }));
-}
-async function installGemini(i) {
-  const report = emptyReport();
-  const auth = i.useEnvToken ? "Bearer $HIVEFLOOR_TOKEN" : `Bearer ${i.token}`;
-  let mcp = "file";
-  const priorCli = !i.useEnvToken && readManifest().tools.gemini?.mcp === "cli";
-  const bin = i.noCli ? void 0 : findBin("gemini", i.ctx.env);
-  if (bin && (i.useEnvToken || priorCli)) {
-    await runCmd(bin, ["mcp", "remove", MCP_NAME, "-s", "user"], { env: i.ctx.env });
-    if (i.useEnvToken) {
-      const r = await runCmd(bin, ["mcp", "add", MCP_NAME, i.mcpUrl, "-t", "http", "-s", "user", "-H", `Authorization: ${auth}`], { env: i.ctx.env });
-      if (r.code === 0) {
-        mcp = "cli";
-        report.lines.push(`Gemini MCP: gemini mcp add (user scope) -> ${i.mcpUrl}`);
-      }
-    }
-  }
-  if (mcp === "file") {
-    editJson(
-      geminiSettings(),
-      (d) => {
-        const servers = isRecord(d.mcpServers) ? d.mcpServers : d.mcpServers = {};
-        servers[MCP_NAME] = { httpUrl: i.mcpUrl, headers: { Authorization: auth } };
-        return true;
-      },
-      i.useEnvToken ? {} : { mode: 384 }
-    );
-    if (!i.useEnvToken) secureFile(geminiSettings());
-    report.lines.push(`Gemini MCP: ${geminiSettings()} (mcpServers.${MCP_NAME})`);
-  }
-  i.onMcpRegistered?.(mcp);
-  if (!i.mcpOnly) {
-    editJson(geminiSettings(), (d) => (addHooks(d, "nested", geminiHookSpecs()), true), i.useEnvToken ? {} : { mode: 384 });
-    report.lines.push(`Gemini hooks: ${geminiSettings()} (${GEMINI_EVENTS.join(", ")})`);
-  }
-  return { report, mcp };
-}
-async function removeGemini(ctx, viaCli, viaFile = false) {
-  const report = emptyReport();
-  if (viaCli) {
-    const bin = findBin("gemini", ctx.env);
-    if (bin && (await runCmd(bin, ["mcp", "remove", MCP_NAME, "-s", "user"], { env: ctx.env })).code === 0) report.lines.push("Gemini MCP: gemini mcp remove");
-  }
-  const changed = editJson(
-    geminiSettings(),
-    (d) => {
-      let did = removeHooks(d, "nested") > 0;
-      if (viaFile && isRecord(d.mcpServers) && MCP_NAME in d.mcpServers) {
-        delete d.mcpServers[MCP_NAME];
-        if (Object.keys(d.mcpServers).length === 0) delete d.mcpServers;
-        did = true;
-      }
-      return did;
-    },
-    { drop: true }
-  );
-  if (changed) report.lines.push(`Gemini: removed our entries from ${geminiSettings()}`);
-  dropBackupWithEntry(geminiSettings(), MCP_NAME);
-  return report;
-}
-
-// src/writers/grok.ts
-import path6 from "path";
-var grokConfig = () => path6.join(home(), ".grok", "config.toml");
-var HOOKS_LINE = "Grok hooks: none needed (Grok reads the Claude Code hooks in ~/.claude/settings.json; connect Claude Code too for live sessions)";
-function editGrokToml(fn, opts = {}) {
-  const file = grokConfig();
-  const before = readText(file);
-  const next = fn(before ?? "");
-  if (next === (before ?? "")) return false;
-  if (opts.drop && wasCreated(file) && next.trim() === "") {
-    removeFile(file);
-    forgetCreated(file);
-    return true;
-  }
-  if (before === void 0) addCreated(file);
-  else if (!wasCreated(file)) backupOnce(file);
-  atomicWrite(file, next, opts.mode);
-  if (opts.drop) dropBackupIfSame(file);
-  return true;
-}
-function grokMcpBlock(mcpUrl, auth) {
-  return `[mcp_servers.${MCP_NAME}]
-url = ${tomlString(mcpUrl)}
-enabled = true
-
-[mcp_servers.${MCP_NAME}.headers]
-Authorization = ${tomlString(auth)}`;
-}
-var GROK_TABLE = `mcp_servers.${MCP_NAME}`;
-var ENV_AUTH = "Bearer ${HIVEFLOOR_TOKEN}";
-function outsideHasRawAuthorization(content) {
-  const stripped = content.replace(/# hivefloor:begin[\s\S]*?# hivefloor:end [^\n]*(?:\n|$)/g, "");
-  let inTable = false;
-  for (const line of stripped.split("\n")) {
-    const bare = line.replace(/\r$/, "");
-    const header = /^\s*\[\s*([^\]]+?)\s*\]/.exec(bare);
-    if (header) {
-      const name = header[1].replace(/\s+/g, "");
-      inTable = name === GROK_TABLE || name.startsWith(`${GROK_TABLE}.`);
-      continue;
-    }
-    if (!inTable) continue;
-    const auth = /Authorization\s*=\s*["']([^"']*)["']/.exec(bare);
-    if (auth && auth[1] !== ENV_AUTH) return true;
-  }
-  return false;
-}
-async function dropOutsideServer(env, bin) {
-  const file = grokConfig();
-  const bak = `${file}.hivefloor.bak`;
-  const before = readText(file);
-  const beforeBak = readText(bak);
-  const staleLive = before !== void 0 && hasOutsideTable(before, GROK_TABLE);
-  const staleBak = beforeBak !== void 0 && hasOutsideTable(beforeBak, GROK_TABLE);
-  if (!staleLive && !staleBak) return false;
-  if (bin && staleLive) await runCmd(bin, ["mcp", "remove", MCP_NAME, "-s", "user"], { env });
-  for (const f of [file, bak]) {
-    const cur = readText(f);
-    if (cur === void 0 || !hasOutsideTable(cur, GROK_TABLE)) continue;
-    const next = removeOutsideTable(cur, GROK_TABLE);
-    if (next.trim() === "") removeFile(f);
-    else atomicWrite(f, next);
-  }
-  const left = readText(file);
-  if (left !== void 0 && left.trim() === "") removeFile(file);
-  return true;
-}
-async function installGrok(i) {
-  const report = emptyReport();
-  const auth = i.useEnvToken ? ENV_AUTH : `Bearer ${i.token}`;
-  const bin = i.noCli ? void 0 : findBin("grok", i.ctx.env);
-  const liveBefore = readText(grokConfig());
-  const bakBefore = readText(`${grokConfig()}.hivefloor.bak`);
-  const hadRaw = [liveBefore, bakBefore].some((t) => t !== void 0 && outsideHasRawAuthorization(t));
-  const removed = await dropOutsideServer(i.ctx.env, bin);
-  if (removed && hadRaw) report.warnings.push(`${grokConfig()} had [${GROK_TABLE}] outside our block; removed it so an older token does not stay on disk`);
-  if (bin && i.useEnvToken) {
-    await runCmd(bin, ["mcp", "remove", MCP_NAME, "-s", "user"], { env: i.ctx.env });
-    const r = await runCmd(bin, ["mcp", "add", "--transport", "http", MCP_NAME, i.mcpUrl, "-s", "user", "--header", `Authorization: ${auth}`], { env: i.ctx.env });
-    if (r.code === 0) {
-      report.lines.push(`Grok MCP: grok mcp add (user scope) -> ${i.mcpUrl}`);
-      if (!i.mcpOnly) report.lines.push(HOOKS_LINE);
-      i.onMcpRegistered?.("cli");
-      return { report, mcp: "cli" };
-    }
-  }
-  const file = grokConfig();
-  const changed = editGrokToml((c) => setBlock(c, "mcp", grokMcpBlock(i.mcpUrl, auth)), i.useEnvToken ? {} : { mode: 384 });
-  if (!i.useEnvToken && (changed || (readText(file) ?? "").includes(i.token))) secureFile(file);
-  if (changed || hasBlock(readText(file) ?? "", "mcp")) {
-    report.lines.push(`Grok MCP: ${file} ([${GROK_TABLE}])`);
-    if (!i.mcpOnly) report.lines.push(HOOKS_LINE);
-    i.onMcpRegistered?.("file");
-    return { report, mcp: "file" };
-  }
-  report.warnings.push(`Could not run the grok CLI. Add the server by hand: grok mcp add --transport http ${MCP_NAME} ${i.mcpUrl} -s user --header "Authorization: Bearer <token from ${cliNpxCommand("token --reveal")}>"`);
-  return { report, mcp: "manual" };
-}
-async function removeGrok(ctx, viaCli, viaFile = false) {
-  const report = emptyReport();
-  if (viaCli) {
-    const bin = findBin("grok", ctx.env);
-    if (bin && (await runCmd(bin, ["mcp", "remove", MCP_NAME, "-s", "user"], { env: ctx.env })).code === 0) report.lines.push("Grok MCP: grok mcp remove");
-  }
-  if (viaFile && editGrokToml((c) => removeBlock(c, "mcp"), { drop: true })) report.lines.push(`Grok MCP: removed from ${grokConfig()}`);
-  return report;
-}
-
 export {
   readManifest,
   updateManifest,
@@ -788,29 +513,26 @@ export {
   forgetCreated,
   toolReadsEnvToken,
   envTokenSharedWith,
-  RC_LINE,
-  rcFileFor,
-  hasRcLine,
-  addRcLine,
-  removeRcLine,
   emptyReport,
   addHooks,
   removeHooks,
   editJson,
+  secureFile,
+  dropBackupWithEntry,
   CLAUDE_EVENTS,
   claudeJson,
+  MCP_NAME,
   installClaude,
   removeClaude,
+  tomlString,
+  setBlock,
+  removeBlock,
+  hasBlock,
+  removeOutsideTable,
+  hasOutsideTable,
   enableFeatureHooks,
   restoreFeatureHooks,
   CODEX_EVENTS,
   installCodex,
-  removeCodex,
-  installCursor,
-  removeCursor,
-  geminiSettings,
-  installGemini,
-  removeGemini,
-  installGrok,
-  removeGrok
+  removeCodex
 };