@hoox-sh/hoox-cli 0.11.1 → 0.11.2

package/README.md

@@ -455,7 +455,7 @@ The CI pipeline runs in this order:
 
 1. `bun run lint` — ESLint check
 2. `bun run typecheck` — TypeScript check (`tsc --noEmit`)
-3. `bun test packages/cli --coverage` — Run tests with coverage (80% threshold)
+3. `bun test packages/cli --coverage` — Run tests with coverage (~80%+ overall; `src/` ~95%)
 4. `bun run build` — TypeScript build check
 
 ## Project Structure

package/dist/index.js

@@ -14719,6 +14719,7 @@ var init_types = __esm(() => {
     price: exports_external.number().positive().finite().optional(),
     leverage: exports_external.number().int().positive().max(125).optional(),
     test: exports_external.boolean().optional(),
+    idempotencyKey: exports_external.string().min(1).max(512).optional(),
     queuedAt: exports_external.string().min(1).max(64)
   }).strict();
   TradeSignalSchema = exports_external.object({
@@ -14753,7 +14754,7 @@ var init_types = __esm(() => {
 });
 
 // ../shared/src/kvKeys.ts
-var KV_TRADE_DEFAULT_LEVERAGE = "trade:default_leverage", KV_TRADE_MAX_POSITION_SIZE = "trade:max_position_size", KV_TRADE_MAX_DAILY_DRAWDOWN_PERCENT = "trade:max_daily_drawdown_percent", KV_TRADE_TRAILING_STOP_PERCENT = "trade:trailing_stop_percent", KV_TRADE_KILL_SWITCH = "trade:kill_switch", KV_TRADE_ROUTING = "trade:routing", KV_BOT_ENABLED = "bot:enabled", KV_BOT_DEFAULT_CHAT_ID = "bot:default_chat_id", KV_BOT_NOTIFY_ON_EXECUTION = "bot:notify_on_execution", KV_BOT_NOTIFY_ON_ERROR = "bot:notify_on_error", KV_WEBHOOK_IP_CHECK_ENABLED = "webhook:tradingview:ip_check_enabled", KV_WEBHOOK_ALLOWED_IPS = "webhook:tradingview:allowed_ips", KV_WEBHOOK_QUEUE_MODE = "webhook:queue_mode", KV_EMAIL_SCAN_SUBJECT = "email:scan_subject", KV_EMAIL_USE_IMAP = "email:use_imap", KV_EMAIL_COIN_PATTERN = "email:coin_pattern", KV_EMAIL_ACTION_PATTERN = "email:action_pattern", KV_EMAIL_QUANTITY_MULTIPLIER = "email:quantity_multiplier", KV_AGENT_CONFIG = "agent:config", KV_AGENT_OPENAI_KEY = "agent:openai_key", KV_AGENT_ANTHROPIC_KEY = "agent:anthropic_key", KV_AGENT_GOOGLE_KEY = "agent:google_key", KV_DASHBOARD_AI_HEALTH_SUMMARY = "dashboard:ai_health_summary", KV_HEALTH_CHECK = "health_check", KV_HOUSEKEEPING_LAST_CHECK = "housekeeping:last_check", QUEUE_MODE_FAILOVER = "queue_failover", QUEUE_MODE_EVERYWHERE = "queue_everywhere", QUEUE_MODE_DISABLED = "queue_disabled", KVKeys;
+var KV_TRADE_DEFAULT_LEVERAGE = "trade:default_leverage", KV_TRADE_MAX_POSITION_SIZE = "trade:max_position_size", KV_TRADE_MAX_DAILY_DRAWDOWN_PERCENT = "trade:max_daily_drawdown_percent", KV_TRADE_TRAILING_STOP_PERCENT = "trade:trailing_stop_percent", KV_TRADE_KILL_SWITCH = "trade:kill_switch", KV_TRADE_ROUTING = "trade:routing", KV_BOT_ENABLED = "bot:enabled", KV_BOT_DEFAULT_CHAT_ID = "bot:default_chat_id", KV_BOT_NOTIFY_ON_EXECUTION = "bot:notify_on_execution", KV_BOT_NOTIFY_ON_ERROR = "bot:notify_on_error", KV_WEBHOOK_IP_CHECK_ENABLED = "webhook:tradingview:ip_check_enabled", KV_WEBHOOK_ALLOWED_IPS = "webhook:tradingview:allowed_ips", KV_WEBHOOK_QUEUE_MODE = "webhook:queue_mode", KV_EMAIL_SCAN_SUBJECT = "email:scan_subject", KV_EMAIL_USE_IMAP = "email:use_imap", KV_EMAIL_COIN_PATTERN = "email:coin_pattern", KV_EMAIL_ACTION_PATTERN = "email:action_pattern", KV_EMAIL_QUANTITY_MULTIPLIER = "email:quantity_multiplier", KV_AGENT_CONFIG = "agent:config", KV_AGENT_OPENAI_KEY = "agent:openai_key", KV_AGENT_ANTHROPIC_KEY = "agent:anthropic_key", KV_AGENT_GOOGLE_KEY = "agent:google_key", KV_DASHBOARD_AI_HEALTH_SUMMARY = "dashboard:ai_health_summary", KV_GLOBAL_KILL_SWITCH = "global:kill_switch", KV_HEALTH_CHECK = "health_check", KV_HOUSEKEEPING_LAST_CHECK = "housekeeping:last_check", QUEUE_MODE_FAILOVER = "queue_failover", QUEUE_MODE_EVERYWHERE = "queue_everywhere", QUEUE_MODE_DISABLED = "queue_disabled", KVKeys;
 var init_kvKeys = __esm(() => {
   KVKeys = {
     KV_TRADE_DEFAULT_LEVERAGE,
@@ -14779,6 +14780,7 @@ var init_kvKeys = __esm(() => {
     KV_AGENT_ANTHROPIC_KEY,
     KV_AGENT_GOOGLE_KEY,
     KV_DASHBOARD_AI_HEALTH_SUMMARY,
+    KV_GLOBAL_KILL_SWITCH,
     KV_HEALTH_CHECK,
     KV_HOUSEKEEPING_LAST_CHECK,
     QUEUE_MODE_FAILOVER,
@@ -14787,6 +14789,54 @@ var init_kvKeys = __esm(() => {
   };
 });
 
+// ../shared/src/kill-switch.ts
+function isTruthyKillSwitchFlag(value) {
+  if (value == null)
+    return false;
+  const v = value.trim().toLowerCase();
+  return v === "true" || v === "1" || v === "yes" || v === "on";
+}
+async function checkKillSwitch(kv, options) {
+  const onMissingKv = options?.onMissingKv ?? "open";
+  const onReadError = options?.onReadError ?? "closed";
+  if (!kv) {
+    if (onMissingKv === "closed") {
+      return { enabled: true, source: "missing_kv" };
+    }
+    return { enabled: false };
+  }
+  try {
+    const values = await Promise.all(KILL_SWITCH_KEYS.map(async (key) => ({
+      key,
+      value: await kv.get(key)
+    })));
+    for (const { key, value } of values) {
+      if (isTruthyKillSwitchFlag(value)) {
+        return { enabled: true, source: key };
+      }
+    }
+    return { enabled: false };
+  } catch (error51) {
+    const errorStr = String(error51);
+    if (onReadError === "closed") {
+      return { enabled: true, source: "read_error", error: errorStr };
+    }
+    return { enabled: false, error: errorStr };
+  }
+}
+async function isTradingPaused(kv, options) {
+  const result = await checkKillSwitch(kv, options);
+  return result.enabled;
+}
+var KILL_SWITCH_ACTIVE_PREFIX = "KILL_SWITCH_ACTIVE", KILL_SWITCH_KEYS;
+var init_kill_switch = __esm(() => {
+  init_kvKeys();
+  KILL_SWITCH_KEYS = [
+    KV_TRADE_KILL_SWITCH,
+    KV_GLOBAL_KILL_SWITCH
+  ];
+});
+
 // ../shared/src/errors.ts
 function toError(err, fallback = "Unknown error") {
   if (err instanceof Error)
@@ -15908,7 +15958,11 @@ var init_config = __esm(() => {
 
 // ../shared/src/operator-transport.ts
 function stripTrailingSlashes(url2) {
-  return url2.replace(/\/+$/, "");
+  let end = url2.length;
+  while (end > 0 && url2.charCodeAt(end - 1) === 47) {
+    end -= 1;
+  }
+  return end === url2.length ? url2 : url2.slice(0, end);
 }
 function parseTransport(raw) {
   if (!raw)
@@ -15955,7 +16009,7 @@ function hasOperatorClientCredentials(profile) {
   return Boolean(profile.accessClientId && profile.accessClientSecret);
 }
 function operatorUrl(profile, path2) {
-  const base = profile.apiBase.replace(/\/+$/, "");
+  const base = stripTrailingSlashes(profile.apiBase);
   const p = path2.startsWith("/") ? path2 : `/${path2}`;
   return `${base}${p}`;
 }
@@ -22006,6 +22060,8 @@ __export(exports_src, {
   kvManifestFromDashboardManifests: () => kvManifestFromDashboardManifests,
   isWithinHooxHome: () => isWithinHooxHome,
   isUnixModeGroupOrWorldAccessible: () => isUnixModeGroupOrWorldAccessible,
+  isTruthyKillSwitchFlag: () => isTruthyKillSwitchFlag,
+  isTradingPaused: () => isTradingPaused,
   isHooxSetupRoot: () => isHooxSetupRoot,
   isDashboardSectionFlatKv: () => isDashboardSectionFlatKv,
   isDashboardSectionEditable: () => isDashboardSectionEditable,
@@ -22064,6 +22120,7 @@ __export(exports_src, {
   createJsonResponse: () => createJsonResponse,
   createErrorResponse: () => createErrorResponse,
   createCronHandler: () => createCronHandler,
+  checkKillSwitch: () => checkKillSwitch,
   buildOperatorAuthHeaders: () => buildOperatorAuthHeaders,
   buildDashboardKvKey: () => buildDashboardKvKey,
   authenticatedServiceFetch: () => authenticatedServiceFetch,
@@ -22090,6 +22147,8 @@ __export(exports_src, {
   PRESETS: () => PRESETS,
   LogLevelColor: () => LogLevelColor,
   KVKeys: () => KVKeys,
+  KILL_SWITCH_KEYS: () => KILL_SWITCH_KEYS,
+  KILL_SWITCH_ACTIVE_PREFIX: () => KILL_SWITCH_ACTIVE_PREFIX,
   InternalAuthKeyFields: () => InternalAuthKeyFields,
   INTEGRATIONS: () => INTEGRATIONS,
   HOOX_DIR_MODE: () => HOOX_DIR_MODE,
@@ -22127,6 +22186,7 @@ var init_src = __esm(() => {
   init_legal();
   init_types();
   init_kvKeys();
+  init_kill_switch();
   init_errors3();
   init_exchanges();
   init_kvUtils();
@@ -29255,18 +29315,20 @@ async function runInitCommand(options, globalOpts, isNonInteractive) {
     engine = new WizardEngine;
   }
   const skipRiskWarning = options.acceptRisk;
-  if (!skipRiskWarning && engine.getCurrentStep().id === "PREREQUISITES") {
-    const accepted = await confirm({
-      message: "Hoox connects to live trading exchanges and can execute real trades with real money. By continuing, you acknowledge that you are solely responsible for all trading activity and accept the risk of financial loss. Do you accept these terms?",
-      initialValue: false
-    });
-    if (isCancel(accepted)) {
-      cancel("Setup cancelled.");
-      process.exitCode = 0;
-    }
-    if (!accepted) {
-      outro("Setup cancelled. See DISCLAIMER.md for full terms.");
-      process.exitCode = 0;
+  if (engine.getCurrentStep().id === "PREREQUISITES") {
+    if (!skipRiskWarning) {
+      const accepted = await confirm({
+        message: "Hoox connects to live trading exchanges and can execute real trades with real money. By continuing, you acknowledge that you are solely responsible for all trading activity and accept the risk of financial loss. Do you accept these terms?",
+        initialValue: false
+      });
+      if (isCancel(accepted)) {
+        cancel("Setup cancelled.");
+        process.exitCode = 0;
+      }
+      if (!accepted) {
+        outro("Setup cancelled. See DISCLAIMER.md for full terms.");
+        process.exitCode = 0;
+      }
     }
     engine.execute({ checksPassed: true });
     await saveState(engine);
@@ -38529,7 +38591,31 @@ function sanitizeErrorMessage(message, secrets) {
   out = out.replace(/([?&]key=)[^&\s]+/gi, "$1[redacted]");
   return out;
 }
+var PROBE_ALLOWED_HOSTS = new Set([
+  "api.cloudflare.com",
+  "api.openai.com",
+  "api.anthropic.com",
+  "generativelanguage.googleapis.com",
+  "api.cognitive.microsoft.com"
+]);
+function assertProbeUrl(url2) {
+  let parsed;
+  try {
+    parsed = new URL(url2);
+  } catch {
+    throw new Error(`Invalid probe URL: ${url2}`);
+  }
+  if (parsed.protocol !== "https:") {
+    throw new Error(`Probe URL must be https: ${url2}`);
+  }
+  const host = parsed.hostname.toLowerCase();
+  const allowed = PROBE_ALLOWED_HOSTS.has(host) || host.endsWith(".openai.azure.com") || host.endsWith(".cognitiveservices.azure.com");
+  if (!allowed) {
+    throw new Error(`Probe URL host not allowlisted: ${host}`);
+  }
+}
 async function timedFetch(url2, init, timeoutMs) {
+  assertProbeUrl(url2);
   const start = performance.now();
   const response = await fetch(url2, {
     ...init,
@@ -38638,9 +38724,8 @@ async function probeAnthropic(apiKey, timeoutMs) {
       return { status: "online", latencyMs };
     }
     if (response.status === 404) {
-      const start = performance.now();
       try {
-        const msgRes = await fetch("https://api.anthropic.com/v1/messages", {
+        const { response: msgRes, latencyMs: lat } = await timedFetch("https://api.anthropic.com/v1/messages", {
           method: "POST",
           headers: {
             "x-api-key": apiKey,
@@ -38651,10 +38736,8 @@ async function probeAnthropic(apiKey, timeoutMs) {
             model: "claude-sonnet-4-20250514",
             max_tokens: 1,
             messages: [{ role: "user", content: "ping" }]
-          }),
-          signal: AbortSignal.timeout(timeoutMs)
-        });
-        const lat = Math.round(performance.now() - start);
+          })
+        }, timeoutMs);
         if (msgRes.ok)
           return { status: "online", latencyMs: lat };
         if (msgRes.status === 401 || msgRes.status === 403) {
@@ -38730,7 +38813,9 @@ async function probeAzure(apiKey, timeoutMs) {
       error: "AZURE_ENDPOINT missing"
     };
   }
-  const base = endpoint.replace(/\/+$/, "");
+  let base = endpoint;
+  while (base.endsWith("/"))
+    base = base.slice(0, -1);
   const url2 = `${base}/openai/models?api-version=2024-02-01`;
   try {
     const { response, latencyMs } = await timedFetch(url2, {
@@ -38988,15 +39073,18 @@ init_config2();
 import { existsSync as existsSync13, readFileSync as readFileSync8 } from "fs";
 import { resolve as resolve7 } from "path";
 init_errors4();
-var PYNE_WORKER_DIR = resolve7(process.cwd(), "workers/pyne-worker");
 var DEFAULT_TIMEOUT_MS = 30000;
+function getPyneWorkerDir() {
+  return resolve7(process.cwd(), "workers/pyne-worker");
+}
 function requirePyneDir() {
-  if (!existsSync13(PYNE_WORKER_DIR)) {
-    throw new CLIError(`pyne-worker directory not found: ${PYNE_WORKER_DIR}
+  const dir = getPyneWorkerDir();
+  if (!existsSync13(dir)) {
+    throw new CLIError(`pyne-worker directory not found: ${dir}
 ` + `  Clone it with: hoox clone pyne-worker
 ` + `  Or: git submodule update --init workers/pyne-worker`, 1 /* ERROR */);
   }
-  return PYNE_WORKER_DIR;
+  return dir;
 }
 function loadDevVars(workerDir) {
   const out = {};
@@ -39064,11 +39152,33 @@ function resolveApiKey(explicit, workerDir) {
   }
   return null;
 }
+function normalizeBaseUrl(url2) {
+  let end = url2.length;
+  while (end > 0 && url2.charCodeAt(end - 1) === 47) {
+    end -= 1;
+  }
+  return end === url2.length ? url2 : url2.slice(0, end);
+}
+function buildPyneRequestUrl(baseUrl, path6) {
+  const base = normalizeBaseUrl(baseUrl);
+  let parsed;
+  try {
+    parsed = new URL(base);
+  } catch {
+    throw new CLIError(`Invalid pyne-worker URL: ${baseUrl}`, 1 /* ERROR */);
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+    throw new CLIError(`pyne-worker URL must be http(s): ${baseUrl}`, 1 /* ERROR */);
+  }
+  const suffix = path6.startsWith("/") ? path6 : `/${path6}`;
+  return `${parsed.origin}${parsed.pathname === "/" ? "" : parsed.pathname}${suffix}`;
+}
 async function pyneFetch(baseUrl, path6, options = {}) {
   const method = options.method ?? "GET";
   const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   const controller = new AbortController;
   const timer = setTimeout(() => controller.abort(), timeoutMs);
+  const requestUrl = buildPyneRequestUrl(baseUrl, path6);
   const headers = {
     Accept: "application/json"
   };
@@ -39081,7 +39191,7 @@ async function pyneFetch(baseUrl, path6, options = {}) {
     body = JSON.stringify(options.body);
   }
   try {
-    const res = await fetch(`${baseUrl.replace(/\/+$/, "")}${path6}`, {
+    const res = await fetch(requestUrl, {
       method,
       headers,
       body,
@@ -39101,8 +39211,7 @@ async function pyneFetch(baseUrl, path6, options = {}) {
 }
 function printResult(data, fmt) {
   if (fmt.json) {
-    process.stdout.write(formatJson(data) + `
-`);
+    formatJson(data, fmt);
     return;
   }
   if (typeof data === "string") {
@@ -39111,8 +39220,7 @@ function printResult(data, fmt) {
 `));
     return;
   }
-  process.stdout.write(formatJson(data) + `
-`);
+  formatJson(data, fmt);
 }
 async function spawnInPyneDir(cmd, cwd) {
   const proc = Bun.spawn(cmd, {
@@ -39164,27 +39272,24 @@ EXAMPLES:
       if (!res.ok)
         process.exitCode = 1 /* ERROR */;
       if (fmt.json) {
-        process.stdout.write(formatJson(payload) + `
-`);
+        formatJson(payload, fmt);
       } else {
         const icon = res.ok ? "ok" : "fail";
         formatSuccess(`pyne-worker ${icon} \u2014 HTTP ${res.status} in ${latencyMs}ms (${baseUrl})`, fmt);
         if (res.json) {
-          process.stdout.write(formatJson(res.json) + `
-`);
+          formatJson(res.json, fmt);
         }
       }
     } catch (err) {
       process.exitCode = 1 /* ERROR */;
       const message = err instanceof Error ? err.message : String(err);
       if (fmt.json) {
-        process.stdout.write(formatJson({
+        formatJson({
           worker: "pyne-worker",
           url: `${baseUrl}/health`,
           status: "down",
           error: message
-        }) + `
-`);
+        }, fmt);
       } else {
         throw new CLIError(`pyne-worker health failed: ${message}`, 1 /* ERROR */);
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hoox-sh/hoox-cli",
-  "version": "0.11.1",
+  "version": "0.11.2",
   "description": "Hoox CLI — manage Cloudflare Workers, infrastructure, secrets, and deployments (@hoox-sh/hoox-cli)",
   "type": "module",
   "bin": {
@@ -26,7 +26,7 @@
     "@hoox-sh/hoox-tui": "workspace:*"
   },
   "devDependencies": {
-    "@hoox-sh/hoox-shared": "^1.2.0",
+    "@hoox-sh/hoox-shared": "^1.2.1",
     "@types/node": "^26.1.1",
     "bun-types": "^1.3.14",
     "typescript": "^6.0.3"