@hoox-sh/hoox-cli 0.11.0 → 0.11.2

package/README.md

@@ -455,7 +455,7 @@ The CI pipeline runs in this order:
 
 1. `bun run lint` — ESLint check
 2. `bun run typecheck` — TypeScript check (`tsc --noEmit`)
-3. `bun test packages/cli --coverage` — Run tests with coverage (80% threshold)
+3. `bun test packages/cli --coverage` — Run tests with coverage (~80%+ overall; `src/` ~95%)
 4. `bun run build` — TypeScript build check
 
 ## Project Structure

package/dist/index.js

@@ -14719,6 +14719,7 @@ var init_types = __esm(() => {
     price: exports_external.number().positive().finite().optional(),
     leverage: exports_external.number().int().positive().max(125).optional(),
     test: exports_external.boolean().optional(),
+    idempotencyKey: exports_external.string().min(1).max(512).optional(),
     queuedAt: exports_external.string().min(1).max(64)
   }).strict();
   TradeSignalSchema = exports_external.object({
@@ -14753,7 +14754,7 @@ var init_types = __esm(() => {
 });
 
 // ../shared/src/kvKeys.ts
-var KV_TRADE_DEFAULT_LEVERAGE = "trade:default_leverage", KV_TRADE_MAX_POSITION_SIZE = "trade:max_position_size", KV_TRADE_MAX_DAILY_DRAWDOWN_PERCENT = "trade:max_daily_drawdown_percent", KV_TRADE_TRAILING_STOP_PERCENT = "trade:trailing_stop_percent", KV_TRADE_KILL_SWITCH = "trade:kill_switch", KV_TRADE_ROUTING = "trade:routing", KV_BOT_ENABLED = "bot:enabled", KV_BOT_DEFAULT_CHAT_ID = "bot:default_chat_id", KV_BOT_NOTIFY_ON_EXECUTION = "bot:notify_on_execution", KV_BOT_NOTIFY_ON_ERROR = "bot:notify_on_error", KV_WEBHOOK_IP_CHECK_ENABLED = "webhook:tradingview:ip_check_enabled", KV_WEBHOOK_ALLOWED_IPS = "webhook:tradingview:allowed_ips", KV_WEBHOOK_QUEUE_MODE = "webhook:queue_mode", KV_EMAIL_SCAN_SUBJECT = "email:scan_subject", KV_EMAIL_USE_IMAP = "email:use_imap", KV_EMAIL_COIN_PATTERN = "email:coin_pattern", KV_EMAIL_ACTION_PATTERN = "email:action_pattern", KV_EMAIL_QUANTITY_MULTIPLIER = "email:quantity_multiplier", KV_AGENT_CONFIG = "agent:config", KV_AGENT_OPENAI_KEY = "agent:openai_key", KV_AGENT_ANTHROPIC_KEY = "agent:anthropic_key", KV_AGENT_GOOGLE_KEY = "agent:google_key", KV_DASHBOARD_AI_HEALTH_SUMMARY = "dashboard:ai_health_summary", KV_HEALTH_CHECK = "health_check", KV_HOUSEKEEPING_LAST_CHECK = "housekeeping:last_check", QUEUE_MODE_FAILOVER = "queue_failover", QUEUE_MODE_EVERYWHERE = "queue_everywhere", QUEUE_MODE_DISABLED = "queue_disabled", KVKeys;
+var KV_TRADE_DEFAULT_LEVERAGE = "trade:default_leverage", KV_TRADE_MAX_POSITION_SIZE = "trade:max_position_size", KV_TRADE_MAX_DAILY_DRAWDOWN_PERCENT = "trade:max_daily_drawdown_percent", KV_TRADE_TRAILING_STOP_PERCENT = "trade:trailing_stop_percent", KV_TRADE_KILL_SWITCH = "trade:kill_switch", KV_TRADE_ROUTING = "trade:routing", KV_BOT_ENABLED = "bot:enabled", KV_BOT_DEFAULT_CHAT_ID = "bot:default_chat_id", KV_BOT_NOTIFY_ON_EXECUTION = "bot:notify_on_execution", KV_BOT_NOTIFY_ON_ERROR = "bot:notify_on_error", KV_WEBHOOK_IP_CHECK_ENABLED = "webhook:tradingview:ip_check_enabled", KV_WEBHOOK_ALLOWED_IPS = "webhook:tradingview:allowed_ips", KV_WEBHOOK_QUEUE_MODE = "webhook:queue_mode", KV_EMAIL_SCAN_SUBJECT = "email:scan_subject", KV_EMAIL_USE_IMAP = "email:use_imap", KV_EMAIL_COIN_PATTERN = "email:coin_pattern", KV_EMAIL_ACTION_PATTERN = "email:action_pattern", KV_EMAIL_QUANTITY_MULTIPLIER = "email:quantity_multiplier", KV_AGENT_CONFIG = "agent:config", KV_AGENT_OPENAI_KEY = "agent:openai_key", KV_AGENT_ANTHROPIC_KEY = "agent:anthropic_key", KV_AGENT_GOOGLE_KEY = "agent:google_key", KV_DASHBOARD_AI_HEALTH_SUMMARY = "dashboard:ai_health_summary", KV_GLOBAL_KILL_SWITCH = "global:kill_switch", KV_HEALTH_CHECK = "health_check", KV_HOUSEKEEPING_LAST_CHECK = "housekeeping:last_check", QUEUE_MODE_FAILOVER = "queue_failover", QUEUE_MODE_EVERYWHERE = "queue_everywhere", QUEUE_MODE_DISABLED = "queue_disabled", KVKeys;
 var init_kvKeys = __esm(() => {
   KVKeys = {
     KV_TRADE_DEFAULT_LEVERAGE,
@@ -14779,6 +14780,7 @@ var init_kvKeys = __esm(() => {
     KV_AGENT_ANTHROPIC_KEY,
     KV_AGENT_GOOGLE_KEY,
     KV_DASHBOARD_AI_HEALTH_SUMMARY,
+    KV_GLOBAL_KILL_SWITCH,
     KV_HEALTH_CHECK,
     KV_HOUSEKEEPING_LAST_CHECK,
     QUEUE_MODE_FAILOVER,
@@ -14787,6 +14789,54 @@ var init_kvKeys = __esm(() => {
   };
 });
 
+// ../shared/src/kill-switch.ts
+function isTruthyKillSwitchFlag(value) {
+  if (value == null)
+    return false;
+  const v = value.trim().toLowerCase();
+  return v === "true" || v === "1" || v === "yes" || v === "on";
+}
+async function checkKillSwitch(kv, options) {
+  const onMissingKv = options?.onMissingKv ?? "open";
+  const onReadError = options?.onReadError ?? "closed";
+  if (!kv) {
+    if (onMissingKv === "closed") {
+      return { enabled: true, source: "missing_kv" };
+    }
+    return { enabled: false };
+  }
+  try {
+    const values = await Promise.all(KILL_SWITCH_KEYS.map(async (key) => ({
+      key,
+      value: await kv.get(key)
+    })));
+    for (const { key, value } of values) {
+      if (isTruthyKillSwitchFlag(value)) {
+        return { enabled: true, source: key };
+      }
+    }
+    return { enabled: false };
+  } catch (error51) {
+    const errorStr = String(error51);
+    if (onReadError === "closed") {
+      return { enabled: true, source: "read_error", error: errorStr };
+    }
+    return { enabled: false, error: errorStr };
+  }
+}
+async function isTradingPaused(kv, options) {
+  const result = await checkKillSwitch(kv, options);
+  return result.enabled;
+}
+var KILL_SWITCH_ACTIVE_PREFIX = "KILL_SWITCH_ACTIVE", KILL_SWITCH_KEYS;
+var init_kill_switch = __esm(() => {
+  init_kvKeys();
+  KILL_SWITCH_KEYS = [
+    KV_TRADE_KILL_SWITCH,
+    KV_GLOBAL_KILL_SWITCH
+  ];
+});
+
 // ../shared/src/errors.ts
 function toError(err, fallback = "Unknown error") {
   if (err instanceof Error)
@@ -15908,7 +15958,11 @@ var init_config = __esm(() => {
 
 // ../shared/src/operator-transport.ts
 function stripTrailingSlashes(url2) {
-  return url2.replace(/\/+$/, "");
+  let end = url2.length;
+  while (end > 0 && url2.charCodeAt(end - 1) === 47) {
+    end -= 1;
+  }
+  return end === url2.length ? url2 : url2.slice(0, end);
 }
 function parseTransport(raw) {
   if (!raw)
@@ -15955,7 +16009,7 @@ function hasOperatorClientCredentials(profile) {
   return Boolean(profile.accessClientId && profile.accessClientSecret);
 }
 function operatorUrl(profile, path2) {
-  const base = profile.apiBase.replace(/\/+$/, "");
+  const base = stripTrailingSlashes(profile.apiBase);
   const p = path2.startsWith("/") ? path2 : `/${path2}`;
   return `${base}${p}`;
 }
@@ -22006,6 +22060,8 @@ __export(exports_src, {
   kvManifestFromDashboardManifests: () => kvManifestFromDashboardManifests,
   isWithinHooxHome: () => isWithinHooxHome,
   isUnixModeGroupOrWorldAccessible: () => isUnixModeGroupOrWorldAccessible,
+  isTruthyKillSwitchFlag: () => isTruthyKillSwitchFlag,
+  isTradingPaused: () => isTradingPaused,
   isHooxSetupRoot: () => isHooxSetupRoot,
   isDashboardSectionFlatKv: () => isDashboardSectionFlatKv,
   isDashboardSectionEditable: () => isDashboardSectionEditable,
@@ -22064,6 +22120,7 @@ __export(exports_src, {
   createJsonResponse: () => createJsonResponse,
   createErrorResponse: () => createErrorResponse,
   createCronHandler: () => createCronHandler,
+  checkKillSwitch: () => checkKillSwitch,
   buildOperatorAuthHeaders: () => buildOperatorAuthHeaders,
   buildDashboardKvKey: () => buildDashboardKvKey,
   authenticatedServiceFetch: () => authenticatedServiceFetch,
@@ -22090,6 +22147,8 @@ __export(exports_src, {
   PRESETS: () => PRESETS,
   LogLevelColor: () => LogLevelColor,
   KVKeys: () => KVKeys,
+  KILL_SWITCH_KEYS: () => KILL_SWITCH_KEYS,
+  KILL_SWITCH_ACTIVE_PREFIX: () => KILL_SWITCH_ACTIVE_PREFIX,
   InternalAuthKeyFields: () => InternalAuthKeyFields,
   INTEGRATIONS: () => INTEGRATIONS,
   HOOX_DIR_MODE: () => HOOX_DIR_MODE,
@@ -22127,6 +22186,7 @@ var init_src = __esm(() => {
   init_legal();
   init_types();
   init_kvKeys();
+  init_kill_switch();
   init_errors3();
   init_exchanges();
   init_kvUtils();
@@ -29255,18 +29315,20 @@ async function runInitCommand(options, globalOpts, isNonInteractive) {
     engine = new WizardEngine;
   }
   const skipRiskWarning = options.acceptRisk;
-  if (!skipRiskWarning && engine.getCurrentStep().id === "PREREQUISITES") {
-    const accepted = await confirm({
-      message: "Hoox connects to live trading exchanges and can execute real trades with real money. By continuing, you acknowledge that you are solely responsible for all trading activity and accept the risk of financial loss. Do you accept these terms?",
-      initialValue: false
-    });
-    if (isCancel(accepted)) {
-      cancel("Setup cancelled.");
-      process.exitCode = 0;
-    }
-    if (!accepted) {
-      outro("Setup cancelled. See DISCLAIMER.md for full terms.");
-      process.exitCode = 0;
+  if (engine.getCurrentStep().id === "PREREQUISITES") {
+    if (!skipRiskWarning) {
+      const accepted = await confirm({
+        message: "Hoox connects to live trading exchanges and can execute real trades with real money. By continuing, you acknowledge that you are solely responsible for all trading activity and accept the risk of financial loss. Do you accept these terms?",
+        initialValue: false
+      });
+      if (isCancel(accepted)) {
+        cancel("Setup cancelled.");
+        process.exitCode = 0;
+      }
+      if (!accepted) {
+        outro("Setup cancelled. See DISCLAIMER.md for full terms.");
+        process.exitCode = 0;
+      }
     }
     engine.execute({ checksPassed: true });
     await saveState(engine);
@@ -33256,6 +33318,35 @@ init_dist4();
 // src/services/secrets/secrets-service.ts
 init_main();
 init_wrangler_output();
+import { join as join8, resolve as resolvePath } from "path";
+async function resolveWorkerWranglerConfig(workerPath) {
+  const abs = resolvePath(workerPath);
+  const candidates = [
+    join8(abs, "wrangler.jsonc"),
+    join8(abs, "wrangler.toml"),
+    join8(abs, "wrangler.jsonc.example")
+  ];
+  for (const configPath of candidates) {
+    if (!await Bun.file(configPath).exists())
+      continue;
+    let deployName = null;
+    try {
+      const text2 = await Bun.file(configPath).text();
+      if (configPath.endsWith(".toml")) {
+        const m3 = text2.match(/^\s*name\s*=\s*["']([^"']+)["']/m);
+        if (m3?.[1])
+          deployName = m3[1];
+      } else {
+        const parsed = parse6(text2);
+        if (typeof parsed?.name === "string" && parsed.name.trim()) {
+          deployName = parsed.name.trim();
+        }
+      }
+    } catch {}
+    return { configPath, deployName };
+  }
+  throw new Error(`No wrangler.jsonc (or wrangler.jsonc.example) in ${workerPath}. ` + `Copy the example config into wrangler.jsonc and fill account resources, ` + `then re-run secrets sync.`);
+}
 var SYSTEM_SECRET_NAMES = [
   "INTERNAL_KEY_BINDING",
   "AGENT_INTERNAL_KEY",
@@ -33400,7 +33491,7 @@ class SecretsService {
       try {
         const value = existingValues.get(secret);
         if (value !== undefined && !this.isPlaceholder(value)) {
-          await this.execWranglerSecretPut(worker.path, secret, value);
+          await this.execWranglerSecretPut(worker.path, secret, value, workerName);
           synced.push(secret);
           items.push({ name: secret, status: "synced" });
         } else {
@@ -33456,9 +33547,15 @@ class SecretsService {
     const v = value.trim();
     return v === "" || v.startsWith("placeholder_") || v.startsWith("your_") || v.startsWith("generate_") || v.startsWith("<") || v.includes("generate-with");
   }
-  async execWranglerSecretPut(workerPath, name, value) {
-    const proc = Bun.spawn(["wrangler", "secret", "put", name], {
-      cwd: workerPath,
+  async execWranglerSecretPut(workerPath, name, value, logicalWorkerName) {
+    const { configPath, deployName } = await resolveWorkerWranglerConfig(workerPath);
+    const workerName = deployName ?? logicalWorkerName ?? null;
+    const args = ["wrangler", "secret", "put", name, "-c", configPath];
+    if (workerName) {
+      args.push("--name", workerName);
+    }
+    const proc = Bun.spawn(args, {
+      cwd: resolvePath(workerPath),
       stdin: "pipe",
       stdout: "pipe",
       stderr: "pipe"
@@ -33725,7 +33822,18 @@ EXAMPLES:
       throw new CLIError(`Secret "${secretName}" is not declared for worker "${workerName}".`, 2 /* INVALID_USAGE */);
     }
     const workerPath = svc.getWorkerPath(workerName) ?? `workers/${workerName}`;
-    const proc = Bun.spawn(["wrangler", "secret", "delete", secretName], {
+    const { configPath, deployName } = await resolveWorkerWranglerConfig(workerPath);
+    const deploy = deployName ?? workerName;
+    const proc = Bun.spawn([
+      "wrangler",
+      "secret",
+      "delete",
+      secretName,
+      "-c",
+      configPath,
+      "--name",
+      deploy
+    ], {
       cwd: workerPath,
       stdout: "pipe",
       stderr: "pipe"
@@ -36175,7 +36283,7 @@ init_dist4();
 init_config2();
 init_cloudflare_service();
 import { existsSync as existsSync9 } from "fs";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 var D1_WRANGLER_CONFIG_CANDIDATES = [
   "workers/d1-worker/wrangler.jsonc",
   "workers/trade-worker/wrangler.jsonc"
@@ -36192,13 +36300,13 @@ class DbService {
   }
   resolveDefaultSchemaPath() {
     if (this.homeDir) {
-      return join8(this.homeDir, ".hoox", "workers", "trade-worker", "schema.sql");
+      return join9(this.homeDir, ".hoox", "workers", "trade-worker", "schema.sql");
     }
     return "workers/trade-worker/schema.sql";
   }
   resolveMigrationScriptPath() {
     if (this.homeDir) {
-      return join8(this.homeDir, ".hoox", "scripts", "migrate-tracking.sh");
+      return join9(this.homeDir, ".hoox", "scripts", "migrate-tracking.sh");
     }
     return "scripts/migrate-tracking.sh";
   }
@@ -37405,7 +37513,7 @@ init_theme();
 init_errors4();
 import { spawn } from "child_process";
 import { createRequire } from "module";
-import { resolve as resolve6, dirname as dirname3, join as join9 } from "path";
+import { resolve as resolve6, dirname as dirname3, join as join10 } from "path";
 import { fileURLToPath } from "url";
 import { existsSync as existsSync11, realpathSync } from "fs";
 import { homedir as homedir5 } from "os";
@@ -37458,14 +37566,14 @@ function collectTuiCandidates() {
   candidates.push(resolve6(__dirname2, "../../../../tui/src/main.tsx"), resolve6(__dirname2, "../../../../tui/dist/main.js"), resolve6(__dirname2, "../../../tui/src/main.tsx"), resolve6(__dirname2, "../../../tui/dist/main.js"), resolve6(process.cwd(), "packages/tui/src/main.tsx"), resolve6(process.cwd(), "packages/tui/dist/main.js"), resolve6(process.cwd(), "../tui/src/main.tsx"), resolve6(process.cwd(), "../tui/dist/main.js"));
   pushPackageEntries(candidates, require2);
   try {
-    const cwdRequire = createRequire(join9(process.cwd(), "package.json"));
+    const cwdRequire = createRequire(join10(process.cwd(), "package.json"));
     pushPackageEntries(candidates, cwdRequire);
   } catch {}
-  const bunGlobal = join9(homedir5(), ".bun", "install", "global", "node_modules", TUI_PKG);
+  const bunGlobal = join10(homedir5(), ".bun", "install", "global", "node_modules", TUI_PKG);
   pushPackageRootEntries(candidates, bunGlobal);
   const npmGlobal = process.env.npm_config_prefix?.trim();
   if (npmGlobal) {
-    pushPackageRootEntries(candidates, join9(npmGlobal, "lib", "node_modules", TUI_PKG));
+    pushPackageRootEntries(candidates, join10(npmGlobal, "lib", "node_modules", TUI_PKG));
   }
   pushFromWhich(candidates, "hoox-tui");
   return [...new Set(candidates)];
@@ -37473,7 +37581,7 @@ function collectTuiCandidates() {
 function pushPackageRootEntries(candidates, root) {
   if (!root || !existsSync11(root))
     return;
-  candidates.push(join9(root, "dist", "main.js"), join9(root, "src", "main.tsx"), join9(root, "bin", "hoox-tui.js"), join9(root, "src", "main.ts"));
+  candidates.push(join10(root, "dist", "main.js"), join10(root, "src", "main.tsx"), join10(root, "bin", "hoox-tui.js"), join10(root, "src", "main.ts"));
 }
 function pushPackageEntries(candidates, req) {
   try {
@@ -37713,14 +37821,14 @@ TUI exited with code ${code}
 // src/commands/doctor/doctor-command.ts
 init_dist4();
 init_src();
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 import { homedir as homedir6 } from "os";
 
 // src/services/runtime/runtime-service.ts
 init_src();
 import { existsSync as existsSync12, lstatSync as lstatSync2, readlinkSync, rmSync } from "fs";
 import { mkdir } from "fs/promises";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 var DEFAULT_HOOX_RUNTIME_REPO = "https://github.com/hoox-sh/hoox.git";
 function firstExisting(paths) {
   for (const p3 of paths) {
@@ -37803,9 +37911,9 @@ ${clone2.stderr || clone2.stdout}`.trim());
   }
   let installed = false;
   if (!options.skipInstall) {
-    const nodeModules = join10(repoPath, "node_modules");
-    const tuiPkg = join10(repoPath, "packages", "tui", "package.json");
-    const needsInstall = !existsSync12(nodeModules) || existsSync12(tuiPkg) && !existsSync12(join10(repoPath, "packages", "tui", "node_modules")) && !existsSync12(join10(nodeModules, "@opentui"));
+    const nodeModules = join11(repoPath, "node_modules");
+    const tuiPkg = join11(repoPath, "packages", "tui", "package.json");
+    const needsInstall = !existsSync12(nodeModules) || existsSync12(tuiPkg) && !existsSync12(join11(repoPath, "packages", "tui", "node_modules")) && !existsSync12(join11(nodeModules, "@opentui"));
     if (cloned || needsInstall || !existsSync12(nodeModules)) {
       log2(`Running bun install in ${repoPath}`);
       const install = await runCommand(["bun", "install"], repoPath);
@@ -38134,7 +38242,7 @@ Hoox doctor
   return failed === 0 ? 0 /* SUCCESS */ : 1 /* ERROR */;
 }
 function printSecurityHygieneSection(env = process.env) {
-  const configPath = join11(homedir6(), ".hoox", "config.json");
+  const configPath = join12(homedir6(), ".hoox", "config.json");
   const lines = collectSecurityHygiene(env, { configPath });
   process.stdout.write(theme.heading(`Security hygiene
 `));
@@ -38152,7 +38260,7 @@ async function runSecurityDoctor(options) {
     env.HOOX_API_URL = options.apiUrl;
   }
   const profile = resolveOperatorTransportProfile(env);
-  const configPath = join11(homedir6(), ".hoox", "config.json");
+  const configPath = join12(homedir6(), ".hoox", "config.json");
   const hygiene = collectSecurityHygiene(env, { configPath });
   const isLocal = profile.apiBase.includes("localhost") || profile.apiBase.includes("127.0.0.1");
   const shouldProbe = options.probe === true || options.probe !== false && !isLocal;
@@ -38483,7 +38591,31 @@ function sanitizeErrorMessage(message, secrets) {
   out = out.replace(/([?&]key=)[^&\s]+/gi, "$1[redacted]");
   return out;
 }
+var PROBE_ALLOWED_HOSTS = new Set([
+  "api.cloudflare.com",
+  "api.openai.com",
+  "api.anthropic.com",
+  "generativelanguage.googleapis.com",
+  "api.cognitive.microsoft.com"
+]);
+function assertProbeUrl(url2) {
+  let parsed;
+  try {
+    parsed = new URL(url2);
+  } catch {
+    throw new Error(`Invalid probe URL: ${url2}`);
+  }
+  if (parsed.protocol !== "https:") {
+    throw new Error(`Probe URL must be https: ${url2}`);
+  }
+  const host = parsed.hostname.toLowerCase();
+  const allowed = PROBE_ALLOWED_HOSTS.has(host) || host.endsWith(".openai.azure.com") || host.endsWith(".cognitiveservices.azure.com");
+  if (!allowed) {
+    throw new Error(`Probe URL host not allowlisted: ${host}`);
+  }
+}
 async function timedFetch(url2, init, timeoutMs) {
+  assertProbeUrl(url2);
   const start = performance.now();
   const response = await fetch(url2, {
     ...init,
@@ -38592,9 +38724,8 @@ async function probeAnthropic(apiKey, timeoutMs) {
       return { status: "online", latencyMs };
     }
     if (response.status === 404) {
-      const start = performance.now();
       try {
-        const msgRes = await fetch("https://api.anthropic.com/v1/messages", {
+        const { response: msgRes, latencyMs: lat } = await timedFetch("https://api.anthropic.com/v1/messages", {
           method: "POST",
           headers: {
             "x-api-key": apiKey,
@@ -38605,10 +38736,8 @@ async function probeAnthropic(apiKey, timeoutMs) {
             model: "claude-sonnet-4-20250514",
             max_tokens: 1,
             messages: [{ role: "user", content: "ping" }]
-          }),
-          signal: AbortSignal.timeout(timeoutMs)
-        });
-        const lat = Math.round(performance.now() - start);
+          })
+        }, timeoutMs);
         if (msgRes.ok)
           return { status: "online", latencyMs: lat };
         if (msgRes.status === 401 || msgRes.status === 403) {
@@ -38684,7 +38813,9 @@ async function probeAzure(apiKey, timeoutMs) {
       error: "AZURE_ENDPOINT missing"
     };
   }
-  const base = endpoint.replace(/\/+$/, "");
+  let base = endpoint;
+  while (base.endsWith("/"))
+    base = base.slice(0, -1);
   const url2 = `${base}/openai/models?api-version=2024-02-01`;
   try {
     const { response, latencyMs } = await timedFetch(url2, {
@@ -38942,15 +39073,18 @@ init_config2();
 import { existsSync as existsSync13, readFileSync as readFileSync8 } from "fs";
 import { resolve as resolve7 } from "path";
 init_errors4();
-var PYNE_WORKER_DIR = resolve7(process.cwd(), "workers/pyne-worker");
 var DEFAULT_TIMEOUT_MS = 30000;
+function getPyneWorkerDir() {
+  return resolve7(process.cwd(), "workers/pyne-worker");
+}
 function requirePyneDir() {
-  if (!existsSync13(PYNE_WORKER_DIR)) {
-    throw new CLIError(`pyne-worker directory not found: ${PYNE_WORKER_DIR}
+  const dir = getPyneWorkerDir();
+  if (!existsSync13(dir)) {
+    throw new CLIError(`pyne-worker directory not found: ${dir}
 ` + `  Clone it with: hoox clone pyne-worker
 ` + `  Or: git submodule update --init workers/pyne-worker`, 1 /* ERROR */);
   }
-  return PYNE_WORKER_DIR;
+  return dir;
 }
 function loadDevVars(workerDir) {
   const out = {};
@@ -39018,11 +39152,33 @@ function resolveApiKey(explicit, workerDir) {
   }
   return null;
 }
+function normalizeBaseUrl(url2) {
+  let end = url2.length;
+  while (end > 0 && url2.charCodeAt(end - 1) === 47) {
+    end -= 1;
+  }
+  return end === url2.length ? url2 : url2.slice(0, end);
+}
+function buildPyneRequestUrl(baseUrl, path6) {
+  const base = normalizeBaseUrl(baseUrl);
+  let parsed;
+  try {
+    parsed = new URL(base);
+  } catch {
+    throw new CLIError(`Invalid pyne-worker URL: ${baseUrl}`, 1 /* ERROR */);
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+    throw new CLIError(`pyne-worker URL must be http(s): ${baseUrl}`, 1 /* ERROR */);
+  }
+  const suffix = path6.startsWith("/") ? path6 : `/${path6}`;
+  return `${parsed.origin}${parsed.pathname === "/" ? "" : parsed.pathname}${suffix}`;
+}
 async function pyneFetch(baseUrl, path6, options = {}) {
   const method = options.method ?? "GET";
   const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   const controller = new AbortController;
   const timer = setTimeout(() => controller.abort(), timeoutMs);
+  const requestUrl = buildPyneRequestUrl(baseUrl, path6);
   const headers = {
     Accept: "application/json"
   };
@@ -39035,7 +39191,7 @@ async function pyneFetch(baseUrl, path6, options = {}) {
     body = JSON.stringify(options.body);
   }
   try {
-    const res = await fetch(`${baseUrl.replace(/\/+$/, "")}${path6}`, {
+    const res = await fetch(requestUrl, {
       method,
       headers,
       body,
@@ -39055,8 +39211,7 @@ async function pyneFetch(baseUrl, path6, options = {}) {
 }
 function printResult(data, fmt) {
   if (fmt.json) {
-    process.stdout.write(formatJson(data) + `
-`);
+    formatJson(data, fmt);
     return;
   }
   if (typeof data === "string") {
@@ -39065,8 +39220,7 @@ function printResult(data, fmt) {
 `));
     return;
   }
-  process.stdout.write(formatJson(data) + `
-`);
+  formatJson(data, fmt);
 }
 async function spawnInPyneDir(cmd, cwd) {
   const proc = Bun.spawn(cmd, {
@@ -39118,27 +39272,24 @@ EXAMPLES:
       if (!res.ok)
         process.exitCode = 1 /* ERROR */;
       if (fmt.json) {
-        process.stdout.write(formatJson(payload) + `
-`);
+        formatJson(payload, fmt);
       } else {
         const icon = res.ok ? "ok" : "fail";
         formatSuccess(`pyne-worker ${icon} \u2014 HTTP ${res.status} in ${latencyMs}ms (${baseUrl})`, fmt);
         if (res.json) {
-          process.stdout.write(formatJson(res.json) + `
-`);
+          formatJson(res.json, fmt);
         }
       }
     } catch (err) {
       process.exitCode = 1 /* ERROR */;
       const message = err instanceof Error ? err.message : String(err);
       if (fmt.json) {
-        process.stdout.write(formatJson({
+        formatJson({
           worker: "pyne-worker",
           url: `${baseUrl}/health`,
           status: "down",
           error: message
-        }) + `
-`);
+        }, fmt);
       } else {
         throw new CLIError(`pyne-worker health failed: ${message}`, 1 /* ERROR */);
       }
@@ -40880,7 +41031,7 @@ init_ansis();
 init_theme();
 import { existsSync as existsSync14, readFileSync as readFileSync9 } from "fs";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { dirname as dirname4, join as join12 } from "path";
+import { dirname as dirname4, join as join13 } from "path";
 var ORANGE = ansis_default.hex("#ff7f2a");
 var AMBER = ansis_default.hex("#ffb722");
 var INDIGO = ansis_default.hex("#818cf8");
@@ -40893,7 +41044,7 @@ function findCliVersion() {
   const PKG_NAME = "@hoox-sh/hoox-cli";
   let dir = dirname4(fileURLToPath2(import.meta.url));
   for (let i2 = 0;i2 < 5; i2++) {
-    const pkgPath = join12(dir, "package.json");
+    const pkgPath = join13(dir, "package.json");
     if (existsSync14(pkgPath)) {
       try {
         const pkg = JSON.parse(readFileSync9(pkgPath, "utf-8"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hoox-sh/hoox-cli",
-  "version": "0.11.0",
+  "version": "0.11.2",
   "description": "Hoox CLI — manage Cloudflare Workers, infrastructure, secrets, and deployments (@hoox-sh/hoox-cli)",
   "type": "module",
   "bin": {
@@ -26,7 +26,7 @@
     "@hoox-sh/hoox-tui": "workspace:*"
   },
   "devDependencies": {
-    "@hoox-sh/hoox-shared": "^1.2.0",
+    "@hoox-sh/hoox-shared": "^1.2.1",
     "@types/node": "^26.1.1",
     "bun-types": "^1.3.14",
     "typescript": "^6.0.3"