@hoox-sh/hoox-cli 0.11.1 → 0.11.3

package/README.md

@@ -6,7 +6,7 @@
 
 > **Runtime requirement:** Bun ≥ 1.2. The bin shebang and bundle target are Bun-only; `npm install -g` will install the package but the CLI will not run under Node.js.
 
-**v0.10.1** — operator security plane: fail-closed `tui --remote`, transport profile (Bearer + Access), `doctor --security`, `tunnel check`, management `/v1/*` contract. **v0.9.x** shipped hop-level `perf fastpath` observability and reliability fixes.
+**v0.11.x** — operator security plane (`doctor --security`, `tunnel check`, transport profile Bearer + Access), PYNE edge ops (`hoox pyne`), schema validate/generate, and wrangler **4.x**. **v0.10.x** hardened fail-closed remote TUI / management `/v1/*`. **v0.9.x** shipped hop-level `perf fastpath` observability.
 
 ## Features
 
@@ -24,7 +24,7 @@
 - **Repair & Recovery** (`hoox repair`): Comprehensive system check, guided rebuild, per-component repair.
 - **Top-level Secrets & Keys**: `hoox secrets` and `hoox keys` for Cloudflare Worker secrets and internal auth keys.
 - **Unified Dashboard** (`hoox dashboard dev | deploy`): Start the dev server or build & deploy the Next.js dashboard.
-- **Interactive menu & TUI**: Running `hoox` with no arguments opens the interactive menu; `hoox tui` launches the full OpenTUI operations center.
+- **Interactive menu & TUI**: Running `hoox` with **no arguments**: if `wrangler.jsonc` is missing, auto-runs `onboard` (or `onboard --resume` when `.wizard-state.json` exists); otherwise opens the interactive menu. `hoox tui` launches the full OpenTUI operations center.
 - **Operator security plane** (`hoox doctor`, `hoox tunnel`): Path/TUI hygiene, fail-closed remote transport (Bearer + Access), and private-ingress checks.
 - **Modern-minimal output**: Zinc/indigo palette, completion footer with “next step” suggestions, “did you mean …” for typos, custom help formatter, `--no-color` / `NO_COLOR` / `TERM=dumb`, compact `formatNumber` / `formatBytes`. Shared `format*` helpers available to plugin authors.
 - **Shell Completions**: bash, zsh, and fish completion scripts via `hoox completion <shell>`.
@@ -455,7 +455,7 @@ The CI pipeline runs in this order:
 
 1. `bun run lint` — ESLint check
 2. `bun run typecheck` — TypeScript check (`tsc --noEmit`)
-3. `bun test packages/cli --coverage` — Run tests with coverage (80% threshold)
+3. `bun test packages/cli --coverage` — Run tests with coverage (~80%+ overall; `src/` ~95%)
 4. `bun run build` — TypeScript build check
 
 ## Project Structure

package/bin/hoox.js

@@ -24,6 +24,20 @@
  * when the module is loaded as a side effect from here.
  */
 
+// Runtime guard before any dynamic import: Node users (wrong shebang, or
+// `node bin/hoox.js`) get a clear message instead of ESM resolution stacks.
+// The same check lives in src/index.ts for direct source entry; this one
+// covers the bin path when Node loads this file without Bun globals.
+if (typeof globalThis.Bun === "undefined") {
+  process.stderr.write(
+    "Error: the Hoox CLI requires Bun >= 1.2 to run.\n" +
+      "  Install Bun:  curl -fsSL https://bun.sh | bash\n" +
+      "  Then run:    bunx hoox <command>\n" +
+      "  (npm install -g / node bin/hoox.js will not work.)\n"
+  );
+  process.exit(1);
+}
+
 import { existsSync, statSync, readdirSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname, resolve, join } from "node:path";

package/dist/index.js

@@ -14719,6 +14719,7 @@ var init_types = __esm(() => {
     price: exports_external.number().positive().finite().optional(),
     leverage: exports_external.number().int().positive().max(125).optional(),
     test: exports_external.boolean().optional(),
+    idempotencyKey: exports_external.string().min(1).max(512).optional(),
     queuedAt: exports_external.string().min(1).max(64)
   }).strict();
   TradeSignalSchema = exports_external.object({
@@ -14753,7 +14754,7 @@ var init_types = __esm(() => {
 });
 
 // ../shared/src/kvKeys.ts
-var KV_TRADE_DEFAULT_LEVERAGE = "trade:default_leverage", KV_TRADE_MAX_POSITION_SIZE = "trade:max_position_size", KV_TRADE_MAX_DAILY_DRAWDOWN_PERCENT = "trade:max_daily_drawdown_percent", KV_TRADE_TRAILING_STOP_PERCENT = "trade:trailing_stop_percent", KV_TRADE_KILL_SWITCH = "trade:kill_switch", KV_TRADE_ROUTING = "trade:routing", KV_BOT_ENABLED = "bot:enabled", KV_BOT_DEFAULT_CHAT_ID = "bot:default_chat_id", KV_BOT_NOTIFY_ON_EXECUTION = "bot:notify_on_execution", KV_BOT_NOTIFY_ON_ERROR = "bot:notify_on_error", KV_WEBHOOK_IP_CHECK_ENABLED = "webhook:tradingview:ip_check_enabled", KV_WEBHOOK_ALLOWED_IPS = "webhook:tradingview:allowed_ips", KV_WEBHOOK_QUEUE_MODE = "webhook:queue_mode", KV_EMAIL_SCAN_SUBJECT = "email:scan_subject", KV_EMAIL_USE_IMAP = "email:use_imap", KV_EMAIL_COIN_PATTERN = "email:coin_pattern", KV_EMAIL_ACTION_PATTERN = "email:action_pattern", KV_EMAIL_QUANTITY_MULTIPLIER = "email:quantity_multiplier", KV_AGENT_CONFIG = "agent:config", KV_AGENT_OPENAI_KEY = "agent:openai_key", KV_AGENT_ANTHROPIC_KEY = "agent:anthropic_key", KV_AGENT_GOOGLE_KEY = "agent:google_key", KV_DASHBOARD_AI_HEALTH_SUMMARY = "dashboard:ai_health_summary", KV_HEALTH_CHECK = "health_check", KV_HOUSEKEEPING_LAST_CHECK = "housekeeping:last_check", QUEUE_MODE_FAILOVER = "queue_failover", QUEUE_MODE_EVERYWHERE = "queue_everywhere", QUEUE_MODE_DISABLED = "queue_disabled", KVKeys;
+var KV_TRADE_DEFAULT_LEVERAGE = "trade:default_leverage", KV_TRADE_MAX_POSITION_SIZE = "trade:max_position_size", KV_TRADE_MAX_DAILY_DRAWDOWN_PERCENT = "trade:max_daily_drawdown_percent", KV_TRADE_TRAILING_STOP_PERCENT = "trade:trailing_stop_percent", KV_TRADE_KILL_SWITCH = "trade:kill_switch", KV_TRADE_ROUTING = "trade:routing", KV_BOT_ENABLED = "bot:enabled", KV_BOT_DEFAULT_CHAT_ID = "bot:default_chat_id", KV_BOT_NOTIFY_ON_EXECUTION = "bot:notify_on_execution", KV_BOT_NOTIFY_ON_ERROR = "bot:notify_on_error", KV_WEBHOOK_IP_CHECK_ENABLED = "webhook:tradingview:ip_check_enabled", KV_WEBHOOK_ALLOWED_IPS = "webhook:tradingview:allowed_ips", KV_WEBHOOK_QUEUE_MODE = "webhook:queue_mode", KV_EMAIL_SCAN_SUBJECT = "email:scan_subject", KV_EMAIL_USE_IMAP = "email:use_imap", KV_EMAIL_COIN_PATTERN = "email:coin_pattern", KV_EMAIL_ACTION_PATTERN = "email:action_pattern", KV_EMAIL_QUANTITY_MULTIPLIER = "email:quantity_multiplier", KV_AGENT_CONFIG = "agent:config", KV_AGENT_OPENAI_KEY = "agent:openai_key", KV_AGENT_ANTHROPIC_KEY = "agent:anthropic_key", KV_AGENT_GOOGLE_KEY = "agent:google_key", KV_DASHBOARD_AI_HEALTH_SUMMARY = "dashboard:ai_health_summary", KV_GLOBAL_KILL_SWITCH = "global:kill_switch", KV_HEALTH_CHECK = "health_check", KV_HOUSEKEEPING_LAST_CHECK = "housekeeping:last_check", QUEUE_MODE_FAILOVER = "queue_failover", QUEUE_MODE_EVERYWHERE = "queue_everywhere", QUEUE_MODE_DISABLED = "queue_disabled", KVKeys;
 var init_kvKeys = __esm(() => {
   KVKeys = {
     KV_TRADE_DEFAULT_LEVERAGE,
@@ -14779,6 +14780,7 @@ var init_kvKeys = __esm(() => {
     KV_AGENT_ANTHROPIC_KEY,
     KV_AGENT_GOOGLE_KEY,
     KV_DASHBOARD_AI_HEALTH_SUMMARY,
+    KV_GLOBAL_KILL_SWITCH,
     KV_HEALTH_CHECK,
     KV_HOUSEKEEPING_LAST_CHECK,
     QUEUE_MODE_FAILOVER,
@@ -14787,6 +14789,54 @@ var init_kvKeys = __esm(() => {
   };
 });
 
+// ../shared/src/kill-switch.ts
+function isTruthyKillSwitchFlag(value) {
+  if (value == null)
+    return false;
+  const v = value.trim().toLowerCase();
+  return v === "true" || v === "1" || v === "yes" || v === "on";
+}
+async function checkKillSwitch(kv, options) {
+  const onMissingKv = options?.onMissingKv ?? "open";
+  const onReadError = options?.onReadError ?? "closed";
+  if (!kv) {
+    if (onMissingKv === "closed") {
+      return { enabled: true, source: "missing_kv" };
+    }
+    return { enabled: false };
+  }
+  try {
+    const values = await Promise.all(KILL_SWITCH_KEYS.map(async (key) => ({
+      key,
+      value: await kv.get(key)
+    })));
+    for (const { key, value } of values) {
+      if (isTruthyKillSwitchFlag(value)) {
+        return { enabled: true, source: key };
+      }
+    }
+    return { enabled: false };
+  } catch (error51) {
+    const errorStr = String(error51);
+    if (onReadError === "closed") {
+      return { enabled: true, source: "read_error", error: errorStr };
+    }
+    return { enabled: false, error: errorStr };
+  }
+}
+async function isTradingPaused(kv, options) {
+  const result = await checkKillSwitch(kv, options);
+  return result.enabled;
+}
+var KILL_SWITCH_ACTIVE_PREFIX = "KILL_SWITCH_ACTIVE", KILL_SWITCH_KEYS;
+var init_kill_switch = __esm(() => {
+  init_kvKeys();
+  KILL_SWITCH_KEYS = [
+    KV_TRADE_KILL_SWITCH,
+    KV_GLOBAL_KILL_SWITCH
+  ];
+});
+
 // ../shared/src/errors.ts
 function toError(err, fallback = "Unknown error") {
   if (err instanceof Error)
@@ -15908,7 +15958,11 @@ var init_config = __esm(() => {
 
 // ../shared/src/operator-transport.ts
 function stripTrailingSlashes(url2) {
-  return url2.replace(/\/+$/, "");
+  let end = url2.length;
+  while (end > 0 && url2.charCodeAt(end - 1) === 47) {
+    end -= 1;
+  }
+  return end === url2.length ? url2 : url2.slice(0, end);
 }
 function parseTransport(raw) {
   if (!raw)
@@ -15955,7 +16009,7 @@ function hasOperatorClientCredentials(profile) {
   return Boolean(profile.accessClientId && profile.accessClientSecret);
 }
 function operatorUrl(profile, path2) {
-  const base = profile.apiBase.replace(/\/+$/, "");
+  const base = stripTrailingSlashes(profile.apiBase);
   const p = path2.startsWith("/") ? path2 : `/${path2}`;
   return `${base}${p}`;
 }
@@ -22006,6 +22060,8 @@ __export(exports_src, {
   kvManifestFromDashboardManifests: () => kvManifestFromDashboardManifests,
   isWithinHooxHome: () => isWithinHooxHome,
   isUnixModeGroupOrWorldAccessible: () => isUnixModeGroupOrWorldAccessible,
+  isTruthyKillSwitchFlag: () => isTruthyKillSwitchFlag,
+  isTradingPaused: () => isTradingPaused,
   isHooxSetupRoot: () => isHooxSetupRoot,
   isDashboardSectionFlatKv: () => isDashboardSectionFlatKv,
   isDashboardSectionEditable: () => isDashboardSectionEditable,
@@ -22064,6 +22120,7 @@ __export(exports_src, {
   createJsonResponse: () => createJsonResponse,
   createErrorResponse: () => createErrorResponse,
   createCronHandler: () => createCronHandler,
+  checkKillSwitch: () => checkKillSwitch,
   buildOperatorAuthHeaders: () => buildOperatorAuthHeaders,
   buildDashboardKvKey: () => buildDashboardKvKey,
   authenticatedServiceFetch: () => authenticatedServiceFetch,
@@ -22090,6 +22147,8 @@ __export(exports_src, {
   PRESETS: () => PRESETS,
   LogLevelColor: () => LogLevelColor,
   KVKeys: () => KVKeys,
+  KILL_SWITCH_KEYS: () => KILL_SWITCH_KEYS,
+  KILL_SWITCH_ACTIVE_PREFIX: () => KILL_SWITCH_ACTIVE_PREFIX,
   InternalAuthKeyFields: () => InternalAuthKeyFields,
   INTEGRATIONS: () => INTEGRATIONS,
   HOOX_DIR_MODE: () => HOOX_DIR_MODE,
@@ -22127,6 +22186,7 @@ var init_src = __esm(() => {
   init_legal();
   init_types();
   init_kvKeys();
+  init_kill_switch();
   init_errors3();
   init_exchanges();
   init_kvUtils();
@@ -25007,7 +25067,7 @@ class ConfigService {
       const e = result.error;
       switch (e.code) {
         case "not-found":
-          throw new Error(e.triedFallback ? `Config file not found: ${e.path}. Also tried: ${e.triedFallback}. Run 'hoox config init' to create one.` : `Config file not found: ${e.path}. Run 'hoox config init' to create one.`);
+          throw new Error(e.triedFallback ? `Config file not found: ${e.path}. Also tried: ${e.triedFallback}. Run 'hoox onboard' (or 'hoox init') to create one.` : `Config file not found: ${e.path}. Run 'hoox onboard' (or 'hoox init') to create one.`);
         case "invalid-jsonc":
           throw new Error(`Invalid JSONC in ${e.path}:
 ${e.errors.map((m3) => `  - ${m3}`).join(`
@@ -25831,6 +25891,7 @@ class UpdateService {
   }
   async checkAndPromptUpdate(options) {
     const silent = options?.silent === true;
+    const yes = options?.yes === true;
     try {
       const versionCheck = await this.prereqs.checkWranglerVersion();
       if (!versionCheck.outdated) {
@@ -25840,6 +25901,9 @@ class UpdateService {
         }
         return { updated: false };
       }
+      if (silent && !yes) {
+        return { updated: false };
+      }
       const current2 = versionCheck.current ?? "unknown";
       const minimum = versionCheck.minimum ?? "unknown";
       const latest2 = await this.checkLatestVersion();
@@ -26080,7 +26144,7 @@ var exports_schema_service = {};
 __export(exports_schema_service, {
   SchemaService: () => SchemaService
 });
-import { readFileSync as readFileSync5, existsSync as existsSync10 } from "fs";
+import { readFileSync as readFileSync5, existsSync as existsSync11 } from "fs";
 import { resolve as resolve4 } from "path";
 
 class SchemaService {
@@ -26114,7 +26178,7 @@ class SchemaService {
     const workerWranglerPath = resolve4(workersDir, name, "wrangler.jsonc");
     const devVarsPath = resolve4(workersDir, name, ".dev.vars");
     const errors4 = [];
-    const isHooxProject = existsSync10(resolve4(this.projectRoot, "wrangler.jsonc")) || existsSync10(resolve4(this.projectRoot, "workers"));
+    const isHooxProject = existsSync11(resolve4(this.projectRoot, "wrangler.jsonc")) || existsSync11(resolve4(this.projectRoot, "workers"));
     try {
       const wranglerContent = readFileSync5(workerWranglerPath, "utf-8");
       errors4.push(...validateWranglerJsonc(name, manifest, wranglerContent));
@@ -28919,7 +28983,12 @@ function captureHelpEvent(cmd, eventName) {
 // src/utils/completion.ts
 var SUGGEST_NEXT = {
   init: { command: "hoox setup", reason: "provision infrastructure" },
-  setup: { command: "hoox deploy all", reason: "ship to Cloudflare" },
+  onboard: { command: "hoox check setup", reason: "verify bootstrap" },
+  setup: { command: "hoox check setup", reason: "verify infrastructure" },
+  "check setup": {
+    command: "hoox deploy all",
+    reason: "ship workers to Cloudflare"
+  },
   "deploy all": { command: "hoox check health", reason: "verify the deploy" },
   "check health": {
     command: "hoox monitor trades",
@@ -28954,6 +29023,7 @@ function getCmdPath(cmd) {
 // src/commands/init/init-command.ts
 init_dist4();
 init_src();
+import * as fs2 from "fs";
 
 // src/services/cloudflare/index.ts
 init_cloudflare_service();
@@ -29020,21 +29090,32 @@ class CLIProvisioner {
 
 // src/commands/init/init-command.ts
 async function verifyRepoRoot() {
-  const rootConfig = Bun.file("wrangler.jsonc");
   const cliPackage = Bun.file("packages/cli/package.json");
-  const [rootConfigExists, cliPackageExists] = await Promise.all([
-    rootConfig.exists(),
-    cliPackage.exists()
+  const wranglerExample = Bun.file("wrangler.jsonc.example");
+  const wranglerConfig = Bun.file("wrangler.jsonc");
+  const gitmodules = Bun.file(".gitmodules");
+  const [
+    cliPackageExists,
+    wranglerExampleExists,
+    wranglerConfigExists,
+    gitmodulesExists
+  ] = await Promise.all([
+    cliPackage.exists(),
+    wranglerExample.exists(),
+    wranglerConfig.exists(),
+    gitmodules.exists()
   ]);
-  if (rootConfigExists && cliPackageExists)
+  const workersDirExists = fs2.existsSync("workers");
+  const hasRepoSignal = wranglerExampleExists || wranglerConfigExists || workersDirExists || gitmodulesExists;
+  if (cliPackageExists && hasRepoSignal)
     return;
   const reasons = [];
-  if (!rootConfigExists) {
-    reasons.push("no root `wrangler.jsonc` found in the current directory");
-  }
   if (!cliPackageExists) {
     reasons.push("no `packages/cli` workspace found (this is not the hoox monorepo)");
   }
+  if (cliPackageExists && !hasRepoSignal) {
+    reasons.push("missing Hoox repo markers (expected one of: `wrangler.jsonc.example`, `wrangler.jsonc`, `workers/`, or `.gitmodules`)");
+  }
   const cloneHint = "  Clone first: git clone --recursive " + "https://github.com/hoox-sh/hoox.git";
   throw new CLIError(`Not inside a Hoox repository root.
   ` + reasons.join(`
@@ -29207,7 +29288,10 @@ async function runInitCommand(options, globalOpts, isNonInteractive) {
     if (error51) {
       formatError2(new CLIError(error51, 1 /* ERROR */), globalOpts);
       process.exitCode = 1 /* ERROR */;
+      return;
     }
+    process.env.CLOUDFLARE_API_TOKEN = token;
+    process.env.CLOUDFLARE_ACCOUNT_ID = account;
     if (!globalOpts.quiet) {
       formatSuccess("Cloudflare API token validated", globalOpts);
     }
@@ -29245,6 +29329,7 @@ async function runInitCommand(options, globalOpts, isNonInteractive) {
       if (isCancel(resumed)) {
         cancel("Setup cancelled.");
         process.exitCode = 0;
+        return;
       }
       if (!resumed) {
         engine = null;
@@ -29255,18 +29340,22 @@ async function runInitCommand(options, globalOpts, isNonInteractive) {
     engine = new WizardEngine;
   }
   const skipRiskWarning = options.acceptRisk;
-  if (!skipRiskWarning && engine.getCurrentStep().id === "PREREQUISITES") {
-    const accepted = await confirm({
-      message: "Hoox connects to live trading exchanges and can execute real trades with real money. By continuing, you acknowledge that you are solely responsible for all trading activity and accept the risk of financial loss. Do you accept these terms?",
-      initialValue: false
-    });
-    if (isCancel(accepted)) {
-      cancel("Setup cancelled.");
-      process.exitCode = 0;
-    }
-    if (!accepted) {
-      outro("Setup cancelled. See DISCLAIMER.md for full terms.");
-      process.exitCode = 0;
+  if (engine.getCurrentStep().id === "PREREQUISITES") {
+    if (!skipRiskWarning) {
+      const accepted = await confirm({
+        message: "Hoox connects to live trading exchanges and can execute real trades with real money. By continuing, you acknowledge that you are solely responsible for all trading activity and accept the risk of financial loss. Do you accept these terms?",
+        initialValue: false
+      });
+      if (isCancel(accepted)) {
+        cancel("Setup cancelled.");
+        process.exitCode = 0;
+        return;
+      }
+      if (!accepted) {
+        outro("Setup cancelled. See DISCLAIMER.md for full terms.");
+        process.exitCode = 0;
+        return;
+      }
     }
     engine.execute({ checksPassed: true });
     await saveState(engine);
@@ -29287,6 +29376,7 @@ async function runInitCommand(options, globalOpts, isNonInteractive) {
       if (isCancel(apiToken)) {
         cancel("Setup cancelled.");
         process.exitCode = 0;
+        return;
       }
       log.step("Validating Cloudflare API token...");
       const tokenError = await validateApiToken(cf, apiToken);
@@ -29295,6 +29385,7 @@ async function runInitCommand(options, globalOpts, isNonInteractive) {
         log.warn("Please check your token and try again.");
       } else {
         tokenValid = true;
+        process.env.CLOUDFLARE_API_TOKEN = apiToken;
         formatSuccess("Cloudflare API token validated", globalOpts);
       }
     }
@@ -29315,6 +29406,7 @@ async function runInitCommand(options, globalOpts, isNonInteractive) {
     if (isCancel(accountResult)) {
       cancel("Setup cancelled.");
       process.exitCode = 0;
+      return;
     }
     const secretStoreResult = await text({
       message: "Cloudflare Secret Store ID:",
@@ -29324,6 +29416,7 @@ async function runInitCommand(options, globalOpts, isNonInteractive) {
     if (isCancel(secretStoreResult)) {
       cancel("Setup cancelled.");
       process.exitCode = 0;
+      return;
     }
     const prefixResult = await text({
       message: "Subdomain prefix:",
@@ -29338,7 +29431,9 @@ async function runInitCommand(options, globalOpts, isNonInteractive) {
     if (isCancel(prefixResult)) {
       cancel("Setup cancelled.");
       process.exitCode = 0;
+      return;
     }
+    process.env.CLOUDFLARE_ACCOUNT_ID = accountResult;
     engine.execute({
       apiToken,
       accountId: accountResult,
@@ -29371,6 +29466,7 @@ async function runInitCommand(options, globalOpts, isNonInteractive) {
     if (isCancel(presetChoice)) {
       cancel("Setup cancelled.");
       process.exitCode = 0;
+      return;
     }
     engine.execute({ preset: presetChoice });
     await saveState(engine);
@@ -29394,6 +29490,7 @@ async function runInitCommand(options, globalOpts, isNonInteractive) {
       if (isCancel(shouldProvision)) {
         cancel("Setup cancelled.");
         process.exitCode = 0;
+        return;
       }
       if (shouldProvision) {
         log.step("Provisioning infrastructure...");
@@ -29443,6 +29540,9 @@ async function runInitCommand(options, globalOpts, isNonInteractive) {
             process.exitCode = 0;
           }
         });
+        if (isCancel(collected)) {
+          return;
+        }
         collectedSecrets[key] = {};
         for (const [secretName] of secretEntries) {
           const val = collected[secretName];
@@ -29470,6 +29570,7 @@ async function runInitCommand(options, globalOpts, isNonInteractive) {
     if (isCancel(shouldDeploy)) {
       cancel("Setup cancelled.");
       process.exitCode = 0;
+      return;
     }
     if (shouldDeploy) {
       log.step("Deploying workers...");
@@ -29485,7 +29586,8 @@ async function runInitCommand(options, globalOpts, isNonInteractive) {
 }
 // src/services/setup/setup-service.ts
 import {
-  existsSync as existsSync6,
+  chmodSync as chmodSync3,
+  existsSync as existsSync7,
   mkdirSync as mkdirSync3,
   readFileSync as readFileSync3,
   statSync as statSync2,
@@ -29545,6 +29647,25 @@ var KEYS_DIR = ".keys";
 function escapeRegex2(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+function parseEnvFile(text2) {
+  const map2 = new Map;
+  for (const line of text2.split(`
+`)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#"))
+      continue;
+    const eq = trimmed.indexOf("=");
+    if (eq <= 0)
+      continue;
+    map2.set(trimmed.slice(0, eq), trimmed.slice(eq + 1));
+  }
+  return map2;
+}
+function safeChmod(path4, mode) {
+  try {
+    chmodSync3(path4, mode);
+  } catch {}
+}
 
 class SetupService {
   onProgress;
@@ -29573,35 +29694,53 @@ class SetupService {
       TRADE_INTERNAL_KEY: internalKey,
       API_SERVICE_KEY_BINDING: internalKey
     };
-    if (!existsSync6(KEYS_DIR)) {
+    if (!existsSync7(KEYS_DIR)) {
       mkdirSync3(KEYS_DIR, { recursive: true });
     } else if (!statSync2(KEYS_DIR).isDirectory()) {
       mkdirSync3(KEYS_DIR, { recursive: true });
     }
+    safeChmod(KEYS_DIR, 448);
+    const setupEnvPath = join7(KEYS_DIR, "setup.env");
     const envLines = Object.entries(keys).map(([k, v]) => `${k}=${v}`);
-    await Bun.write(join7(KEYS_DIR, "setup.env"), `# Hoox Setup \u2014 Auto-Generated Keys
+    await Bun.write(setupEnvPath, `# Hoox Setup \u2014 Auto-Generated Keys
 ` + "# Generated by `hoox setup`. NEVER commit this file.\n" + `# Created: ${new Date().toISOString()}
 
 ` + envLines.join(`
 `) + `
 `);
+    safeChmod(setupEnvPath, 384);
     for (const [name, value] of Object.entries(keys)) {
-      await Bun.write(join7(KEYS_DIR, `${name.toLowerCase()}.env`), `${name}=${value}
+      const keyPath = join7(KEYS_DIR, `${name.toLowerCase()}.env`);
+      await Bun.write(keyPath, `${name}=${value}
 `);
+      safeChmod(keyPath, 384);
     }
     let devVarsCount = 0;
     for (const [worker, secretNames] of Object.entries(DEV_VARS_WORKER_KEYS)) {
       const path4 = `workers/${workerFsDir(worker)}/.dev.vars`;
+      const meshNames = secretNames;
+      const meshSet = new Set(meshNames);
+      const existing = existsSync7(path4) ? parseEnvFile(readFileSync3(path4, "utf-8")) : new Map;
+      for (const secretName of meshNames) {
+        existing.set(secretName, keys[secretName]);
+      }
       let content = `# .dev.vars \u2014 local secrets for ${worker}
 `;
       content += `# Generated by \`hoox setup\`. NEVER commit this file.
 
 `;
-      for (const secretName of secretNames) {
-        content += `${secretName}=${keys[secretName]}
+      for (const secretName of meshNames) {
+        content += `${secretName}=${existing.get(secretName)}
+`;
+      }
+      for (const [k, v] of existing) {
+        if (!meshSet.has(k)) {
+          content += `${k}=${v}
 `;
+        }
       }
       await Bun.write(path4, content);
+      safeChmod(path4, 384);
       devVarsCount++;
     }
     this.onProgress({
@@ -29930,7 +30069,7 @@ class SetupService {
       join7(dir, "pyproject.toml"),
       join7(dir, "wrangler.jsonc")
     ];
-    return markers.some((p3) => existsSync6(p3));
+    return markers.some((p3) => existsSync7(p3));
   }
   async ensureWorkers() {
     this.onProgress({
@@ -29975,7 +30114,7 @@ class SetupService {
       step: "workers",
       message: `${missing.length} worker(s) not cloned: ${missing.join(", ")}`
     });
-    if (!existsSync6(gitmodulesPath)) {
+    if (!existsSync7(gitmodulesPath)) {
       this.onProgress({
         type: "step-error",
         step: "workers",
@@ -30371,7 +30510,7 @@ class SetupService {
     } else {
       steps.push({ step: "d1-schema", success: true, message: "Skipped" });
     }
-    if (keys) {
+    if (!options.skipSecrets && keys) {
       const reconcile = await this.reconcileSecrets(keys);
       if (reconcile.warnings.length > 0) {
         for (const w of reconcile.warnings) {
@@ -30379,20 +30518,25 @@ class SetupService {
         }
       }
     }
-    const secretResults = await this.setSecrets(keys);
-    results.secrets = secretResults;
-    const secretOk = secretResults.filter((r2) => r2.ok).length;
-    const secretFail = secretResults.filter((r2) => !r2.ok).length;
-    steps.push({
-      step: "secrets",
-      success: secretFail === 0,
-      message: `${secretOk} set, ${secretFail} failed`,
-      details: {
-        total: secretResults.length,
-        ok: secretOk,
-        failed: secretFail
-      }
-    });
+    if (options.skipSecrets) {
+      steps.push({ step: "secrets", success: true, message: "Skipped" });
+      results.secrets = [];
+    } else {
+      const secretResults = await this.setSecrets(keys);
+      results.secrets = secretResults;
+      const secretOk = secretResults.filter((r2) => r2.ok).length;
+      const secretFail = secretResults.filter((r2) => !r2.ok).length;
+      steps.push({
+        step: "secrets",
+        success: secretFail === 0,
+        message: `${secretOk} set, ${secretFail} failed`,
+        details: {
+          total: secretResults.length,
+          ok: secretOk,
+          failed: secretFail
+        }
+      });
+    }
     const dashResult = await this.rebuildDashboard(options.skipDashboard);
     steps.push(dashResult);
     if (keys) {
@@ -30497,12 +30641,27 @@ async function runOnboard(options, fmt) {
     acceptRisk: options.acceptRisk
   };
   await runInitCommand(initOpts, { json: fmt.json, quiet: fmt.quiet }, isNonInteractive);
+  if (process.exitCode && process.exitCode !== 0) {
+    return;
+  }
+  if (options.token) {
+    process.env.CLOUDFLARE_API_TOKEN = options.token;
+  }
+  if (options.account) {
+    process.env.CLOUDFLARE_ACCOUNT_ID = options.account;
+  }
   if (!quiet) {
     process.stdout.write(theme.heading(`
 \u2501\u2501\u2501 Step 2/2: Setup (infrastructure bootstrap) \u2501\u2501\u2501
 `));
   }
   const setupSvc = new SetupService;
+  const authOk = await setupSvc.checkAuth();
+  if (!authOk) {
+    formatError2(new CLIError("Not authenticated with Cloudflare. Run 'wrangler login' first.", 1 /* ERROR */, undefined, false, "Run `wrangler login` interactively, or set CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID environment variables for CI / non-interactive use."), fmt);
+    process.exitCode = 1 /* ERROR */;
+    return;
+  }
   const setupOpts = {
     skipKeys: Boolean(options.skipKeys),
     skipDb: Boolean(options.skipDb),
@@ -30514,14 +30673,14 @@ async function runOnboard(options, fmt) {
     const result = await setupSvc.runAll(setupOpts);
     if (result.success) {
       if (!quiet) {
-        formatSuccess("Bootstrap complete! Run: hoox check setup to verify.", fmt);
+        formatSuccess("Bootstrap complete! Next: `hoox check setup` then `hoox deploy all`", fmt);
       }
     } else {
-      formatError2(new CLIError("Bootstrap completed with issues. See logs above.", 1 /* ERROR */), fmt);
+      formatError2(new CLIError("Bootstrap completed with issues. See logs above.", 1 /* ERROR */, undefined, false, "Retry with `hoox setup`, diagnose with `hoox check setup`, or run `hoox repair check`."), fmt);
       process.exitCode = 1 /* ERROR */;
     }
   } catch (e) {
-    formatError2(new CLIError(e instanceof Error ? e.message : String(e), 1 /* ERROR */), fmt);
+    formatError2(new CLIError(e instanceof Error ? e.message : String(e), 1 /* ERROR */, undefined, false, "Retry with `hoox setup`, diagnose with `hoox check setup`, or run `hoox repair check`."), fmt);
     process.exitCode = 1 /* ERROR */;
   }
 }
@@ -31039,7 +31198,7 @@ function renderDefaultSummary(results) {
 init_errors4();
 import {
   statSync as statSync3,
-  existsSync as existsSync7,
+  existsSync as existsSync8,
   readFileSync as readFileSync4,
   writeFileSync as writeFileSync3,
   renameSync
@@ -31474,7 +31633,7 @@ ${section}:
 init_main();
 function getDashboardBuildInfo(dashboardPath) {
   const workerPath = resolve2(dashboardPath, ".open-next", "worker.js");
-  if (!existsSync7(workerPath)) {
+  if (!existsSync8(workerPath)) {
     return { exists: false };
   }
   const stats = statSync3(workerPath);
@@ -31817,7 +31976,7 @@ async function doUpdateInternalUrls(fmt) {
     const prefix = global.subdomain_prefix ?? "hoox";
     const workers = config2.listEnabledWorkers();
     const filePath = resolve2(process.cwd(), "workers", "dashboard", "wrangler.jsonc");
-    if (!existsSync7(filePath)) {
+    if (!existsSync8(filePath)) {
       formatError2(new CLIError("Dashboard wrangler.jsonc not found at workers/dashboard/wrangler.jsonc", 1 /* ERROR */), fmt);
       process.exitCode = 1 /* ERROR */;
       return;
@@ -33894,7 +34053,7 @@ EXAMPLES:
 }
 
 // src/commands/config/keys-subcommands.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync4 } from "fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync4 } from "fs";
 init_theme();
 function generateKey(bytes = 32) {
   const buf = new Uint8Array(bytes);
@@ -33920,7 +34079,7 @@ EXAMPLES:
   hoox config keys generate`).action(withErrorHandling(async (_2, cmd) => {
     const opts = getFormatOptions(cmd);
     const keysDir = ".keys";
-    if (!existsSync8(keysDir)) {
+    if (!existsSync9(keysDir)) {
       mkdirSync4(keysDir, { recursive: true });
     }
     const meshKey = generateKey();
@@ -33954,7 +34113,7 @@ EXAMPLES:
   hoox config keys list`).action(withErrorHandling(async (_2, cmd) => {
     const opts = getFormatOptions(cmd);
     const keysDir = ".keys";
-    if (!existsSync8(keysDir)) {
+    if (!existsSync9(keysDir)) {
       process.stdout.write(`${theme.dim("No .keys/ directory found.")}
 `);
       return;
@@ -34595,7 +34754,7 @@ async function runSecretsChecks(secretsService, configService, cf) {
 async function runDatabaseChecks(cf, configService) {
   const checks3 = [];
   const d1Worker = configService.getWorker("d1-worker");
-  const dbName = d1Worker?.vars?.database_name ?? "my-database";
+  const dbName = d1Worker?.vars?.database_name ?? "trade-data-db";
   const d1ListResult = await cf.d1List();
   if (d1ListResult.ok) {
     const hasDb = d1ListResult.value.includes(dbName);
@@ -36220,7 +36379,7 @@ init_dist4();
 // src/services/db/db-service.ts
 init_config2();
 init_cloudflare_service();
-import { existsSync as existsSync9 } from "fs";
+import { existsSync as existsSync10 } from "fs";
 import { join as join9 } from "path";
 var D1_WRANGLER_CONFIG_CANDIDATES = [
   "workers/d1-worker/wrangler.jsonc",
@@ -36258,7 +36417,7 @@ class DbService {
       if (vars?.database_name)
         return vars.database_name;
     } catch {}
-    return "my-database";
+    return "trade-data-db";
   }
   async apply(dbName, remote, schemaPath) {
     const path6 = schemaPath ?? this.resolveDefaultSchemaPath();
@@ -36322,7 +36481,7 @@ class DbService {
     if (this.wranglerConfigPath)
       return this.wranglerConfigPath;
     for (const candidate of D1_WRANGLER_CONFIG_CANDIDATES) {
-      if (existsSync9(candidate))
+      if (existsSync10(candidate))
         return candidate;
     }
     return;
@@ -37417,8 +37576,7 @@ function registerSchemaCommand(program2) {
     const svc = new SchemaService;
     const manifest = svc.getManifest(worker);
     if (!manifest) {
-      formatError2(new CLIError(`Unknown worker "${worker}"`, 2 /* INVALID_USAGE */), fmt);
-      return;
+      throw new CLIError(`Unknown worker "${worker}"`, 2 /* INVALID_USAGE */, undefined, false, `Known workers: ${svc.getWorkerNames().join(", ") || "(none)"}. Run: hoox schema list`);
     }
     const wranglerContent = generateWranglerJsonc(manifest);
     const devVarsContent = generateDevVars(manifest);
@@ -37453,7 +37611,7 @@ import { spawn } from "child_process";
 import { createRequire } from "module";
 import { resolve as resolve6, dirname as dirname3, join as join10 } from "path";
 import { fileURLToPath } from "url";
-import { existsSync as existsSync11, realpathSync } from "fs";
+import { existsSync as existsSync12, realpathSync } from "fs";
 import { homedir as homedir5 } from "os";
 
 // src/services/perf/endpoint-resolver.ts
@@ -37517,7 +37675,7 @@ function collectTuiCandidates() {
   return [...new Set(candidates)];
 }
 function pushPackageRootEntries(candidates, root) {
-  if (!root || !existsSync11(root))
+  if (!root || !existsSync12(root))
     return;
   candidates.push(join10(root, "dist", "main.js"), join10(root, "src", "main.tsx"), join10(root, "bin", "hoox-tui.js"), join10(root, "src", "main.ts"));
 }
@@ -37545,7 +37703,7 @@ function pushFromWhich(candidates, binName) {
 function resolveTUIEntry() {
   const candidates = collectTuiCandidates();
   for (const path6 of candidates) {
-    if (existsSync11(path6))
+    if (existsSync12(path6))
       return path6;
   }
   const runtime = resolveHooxRuntimeRoot();
@@ -37764,13 +37922,13 @@ import { homedir as homedir6 } from "os";
 
 // src/services/runtime/runtime-service.ts
 init_src();
-import { existsSync as existsSync12, lstatSync as lstatSync2, readlinkSync, rmSync } from "fs";
+import { existsSync as existsSync13, lstatSync as lstatSync2, readlinkSync, rmSync } from "fs";
 import { mkdir } from "fs/promises";
 import { join as join11 } from "path";
 var DEFAULT_HOOX_RUNTIME_REPO = "https://github.com/hoox-sh/hoox.git";
 function firstExisting(paths) {
   for (const p3 of paths) {
-    if (existsSync12(p3))
+    if (existsSync13(p3))
       return p3;
   }
   return null;
@@ -37784,7 +37942,7 @@ function getRuntimeStatus(cwd = process.cwd()) {
     repoPath,
     runtime,
     tuiEntry,
-    repoPresent: existsSync12(repoPath),
+    repoPresent: existsSync13(repoPath),
     isSetupRoot: isHooxSetupRoot(repoPath)
   };
 }
@@ -37806,7 +37964,7 @@ function isBrokenSymlink(path6) {
   try {
     if (!lstatSync2(path6).isSymbolicLink())
       return false;
-    return !existsSync12(path6);
+    return !existsSync13(path6);
   } catch {
     return false;
   }
@@ -37819,7 +37977,7 @@ async function ensureGlobalRuntime(options = {}) {
   await mkdir(hooxHome, { recursive: true });
   let cloned = false;
   if (!isHooxSetupRoot(repoPath)) {
-    if (existsSync12(repoPath) || isBrokenSymlink(repoPath)) {
+    if (existsSync13(repoPath) || isBrokenSymlink(repoPath)) {
       if (isBrokenSymlink(repoPath)) {
         let target = "";
         try {
@@ -37851,8 +38009,8 @@ ${clone2.stderr || clone2.stdout}`.trim());
   if (!options.skipInstall) {
     const nodeModules = join11(repoPath, "node_modules");
     const tuiPkg = join11(repoPath, "packages", "tui", "package.json");
-    const needsInstall = !existsSync12(nodeModules) || existsSync12(tuiPkg) && !existsSync12(join11(repoPath, "packages", "tui", "node_modules")) && !existsSync12(join11(nodeModules, "@opentui"));
-    if (cloned || needsInstall || !existsSync12(nodeModules)) {
+    const needsInstall = !existsSync13(nodeModules) || existsSync13(tuiPkg) && !existsSync13(join11(repoPath, "packages", "tui", "node_modules")) && !existsSync13(join11(nodeModules, "@opentui"));
+    if (cloned || needsInstall || !existsSync13(nodeModules)) {
       log2(`Running bun install in ${repoPath}`);
       const install = await runCommand(["bun", "install"], repoPath);
       if (!install.ok) {
@@ -38529,7 +38687,31 @@ function sanitizeErrorMessage(message, secrets) {
   out = out.replace(/([?&]key=)[^&\s]+/gi, "$1[redacted]");
   return out;
 }
+var PROBE_ALLOWED_HOSTS = new Set([
+  "api.cloudflare.com",
+  "api.openai.com",
+  "api.anthropic.com",
+  "generativelanguage.googleapis.com",
+  "api.cognitive.microsoft.com"
+]);
+function assertProbeUrl(url2) {
+  let parsed;
+  try {
+    parsed = new URL(url2);
+  } catch {
+    throw new Error(`Invalid probe URL: ${url2}`);
+  }
+  if (parsed.protocol !== "https:") {
+    throw new Error(`Probe URL must be https: ${url2}`);
+  }
+  const host = parsed.hostname.toLowerCase();
+  const allowed = PROBE_ALLOWED_HOSTS.has(host) || host.endsWith(".openai.azure.com") || host.endsWith(".cognitiveservices.azure.com");
+  if (!allowed) {
+    throw new Error(`Probe URL host not allowlisted: ${host}`);
+  }
+}
 async function timedFetch(url2, init, timeoutMs) {
+  assertProbeUrl(url2);
   const start = performance.now();
   const response = await fetch(url2, {
     ...init,
@@ -38638,9 +38820,8 @@ async function probeAnthropic(apiKey, timeoutMs) {
       return { status: "online", latencyMs };
     }
     if (response.status === 404) {
-      const start = performance.now();
       try {
-        const msgRes = await fetch("https://api.anthropic.com/v1/messages", {
+        const { response: msgRes, latencyMs: lat } = await timedFetch("https://api.anthropic.com/v1/messages", {
           method: "POST",
           headers: {
             "x-api-key": apiKey,
@@ -38651,10 +38832,8 @@ async function probeAnthropic(apiKey, timeoutMs) {
             model: "claude-sonnet-4-20250514",
             max_tokens: 1,
             messages: [{ role: "user", content: "ping" }]
-          }),
-          signal: AbortSignal.timeout(timeoutMs)
-        });
-        const lat = Math.round(performance.now() - start);
+          })
+        }, timeoutMs);
         if (msgRes.ok)
           return { status: "online", latencyMs: lat };
         if (msgRes.status === 401 || msgRes.status === 403) {
@@ -38730,7 +38909,9 @@ async function probeAzure(apiKey, timeoutMs) {
       error: "AZURE_ENDPOINT missing"
     };
   }
-  const base = endpoint.replace(/\/+$/, "");
+  let base = endpoint;
+  while (base.endsWith("/"))
+    base = base.slice(0, -1);
   const url2 = `${base}/openai/models?api-version=2024-02-01`;
   try {
     const { response, latencyMs } = await timedFetch(url2, {
@@ -38985,18 +39166,21 @@ EXAMPLES:
 }
 // src/commands/pyne/pyne-command.ts
 init_config2();
-import { existsSync as existsSync13, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync8 } from "fs";
 import { resolve as resolve7 } from "path";
 init_errors4();
-var PYNE_WORKER_DIR = resolve7(process.cwd(), "workers/pyne-worker");
 var DEFAULT_TIMEOUT_MS = 30000;
+function getPyneWorkerDir() {
+  return resolve7(process.cwd(), "workers/pyne-worker");
+}
 function requirePyneDir() {
-  if (!existsSync13(PYNE_WORKER_DIR)) {
-    throw new CLIError(`pyne-worker directory not found: ${PYNE_WORKER_DIR}
+  const dir = getPyneWorkerDir();
+  if (!existsSync14(dir)) {
+    throw new CLIError(`pyne-worker directory not found: ${dir}
 ` + `  Clone it with: hoox clone pyne-worker
 ` + `  Or: git submodule update --init workers/pyne-worker`, 1 /* ERROR */);
   }
-  return PYNE_WORKER_DIR;
+  return dir;
 }
 function loadDevVars(workerDir) {
   const out = {};
@@ -39006,7 +39190,7 @@ function loadDevVars(workerDir) {
   ];
   for (const filePath of candidates) {
     try {
-      if (!existsSync13(filePath))
+      if (!existsSync14(filePath))
         continue;
       const content = readFileSync8(filePath, "utf-8");
       for (const line of content.split(`
@@ -39064,11 +39248,33 @@ function resolveApiKey(explicit, workerDir) {
   }
   return null;
 }
+function normalizeBaseUrl(url2) {
+  let end = url2.length;
+  while (end > 0 && url2.charCodeAt(end - 1) === 47) {
+    end -= 1;
+  }
+  return end === url2.length ? url2 : url2.slice(0, end);
+}
+function buildPyneRequestUrl(baseUrl, path6) {
+  const base = normalizeBaseUrl(baseUrl);
+  let parsed;
+  try {
+    parsed = new URL(base);
+  } catch {
+    throw new CLIError(`Invalid pyne-worker URL: ${baseUrl}`, 1 /* ERROR */);
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+    throw new CLIError(`pyne-worker URL must be http(s): ${baseUrl}`, 1 /* ERROR */);
+  }
+  const suffix = path6.startsWith("/") ? path6 : `/${path6}`;
+  return `${parsed.origin}${parsed.pathname === "/" ? "" : parsed.pathname}${suffix}`;
+}
 async function pyneFetch(baseUrl, path6, options = {}) {
   const method = options.method ?? "GET";
   const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   const controller = new AbortController;
   const timer = setTimeout(() => controller.abort(), timeoutMs);
+  const requestUrl = buildPyneRequestUrl(baseUrl, path6);
   const headers = {
     Accept: "application/json"
   };
@@ -39081,7 +39287,7 @@ async function pyneFetch(baseUrl, path6, options = {}) {
     body = JSON.stringify(options.body);
   }
   try {
-    const res = await fetch(`${baseUrl.replace(/\/+$/, "")}${path6}`, {
+    const res = await fetch(requestUrl, {
       method,
       headers,
       body,
@@ -39101,8 +39307,7 @@ async function pyneFetch(baseUrl, path6, options = {}) {
 }
 function printResult(data, fmt) {
   if (fmt.json) {
-    process.stdout.write(formatJson(data) + `
-`);
+    formatJson(data, fmt);
     return;
   }
   if (typeof data === "string") {
@@ -39111,8 +39316,7 @@ function printResult(data, fmt) {
 `));
     return;
   }
-  process.stdout.write(formatJson(data) + `
-`);
+  formatJson(data, fmt);
 }
 async function spawnInPyneDir(cmd, cwd) {
   const proc = Bun.spawn(cmd, {
@@ -39164,27 +39368,24 @@ EXAMPLES:
       if (!res.ok)
         process.exitCode = 1 /* ERROR */;
       if (fmt.json) {
-        process.stdout.write(formatJson(payload) + `
-`);
+        formatJson(payload, fmt);
       } else {
         const icon = res.ok ? "ok" : "fail";
         formatSuccess(`pyne-worker ${icon} \u2014 HTTP ${res.status} in ${latencyMs}ms (${baseUrl})`, fmt);
         if (res.json) {
-          process.stdout.write(formatJson(res.json) + `
-`);
+          formatJson(res.json, fmt);
         }
       }
     } catch (err) {
       process.exitCode = 1 /* ERROR */;
       const message = err instanceof Error ? err.message : String(err);
       if (fmt.json) {
-        process.stdout.write(formatJson({
+        formatJson({
           worker: "pyne-worker",
           url: `${baseUrl}/health`,
           status: "down",
           error: message
-        }) + `
-`);
+        }, fmt);
       } else {
         throw new CLIError(`pyne-worker health failed: ${message}`, 1 /* ERROR */);
       }
@@ -39207,7 +39408,7 @@ EXAMPLES:
       body.script = await new Response(Bun.stdin).text();
     } else {
       const abs = resolve7(process.cwd(), scriptPath);
-      if (!existsSync13(abs)) {
+      if (!existsSync14(abs)) {
         throw new CLIError(`Script not found: ${abs}`, 1 /* ERROR */);
       }
       body.script = readFileSync8(abs, "utf-8");
@@ -39258,7 +39459,7 @@ EXAMPLES:
       throw new CLIError("API key required for authenticated endpoints", 2 /* INVALID_USAGE */);
     }
     const abs = resolve7(process.cwd(), scriptPath);
-    if (!existsSync13(abs)) {
+    if (!existsSync14(abs)) {
       throw new CLIError(`Script not found: ${abs}`, 1 /* ERROR */);
     }
     const script = readFileSync8(abs, "utf-8");
@@ -39366,7 +39567,7 @@ Pass script flags after -- :
 Required before wrangler deploy after pulling new PYNE APIs.`).action(withErrorHandling(async () => {
     const dir = requirePyneDir();
     const script = resolve7(dir, "scripts/sync_vendor.sh");
-    if (!existsSync13(script)) {
+    if (!existsSync14(script)) {
       throw new CLIError(`sync_vendor.sh not found at ${script}`, 1 /* ERROR */);
     }
     process.exitCode = await spawnInPyneDir(["bash", script], dir);
@@ -39375,7 +39576,7 @@ Required before wrangler deploy after pulling new PYNE APIs.`).action(withErrorH
     const dir = requirePyneDir();
     if (!opts.skipSync) {
       const script = resolve7(dir, "scripts/sync_vendor.sh");
-      if (existsSync13(script)) {
+      if (existsSync14(script)) {
         const code = await spawnInPyneDir(["bash", script], dir);
         if (code !== 0) {
           process.exitCode = code;
@@ -40924,7 +41125,7 @@ function registerCompletionCommand(program2) {
 // src/ui/banner.ts
 init_ansis();
 init_theme();
-import { existsSync as existsSync14, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync9 } from "fs";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { dirname as dirname4, join as join13 } from "path";
 var ORANGE = ansis_default.hex("#ff7f2a");
@@ -40940,7 +41141,7 @@ function findCliVersion() {
   let dir = dirname4(fileURLToPath2(import.meta.url));
   for (let i2 = 0;i2 < 5; i2++) {
     const pkgPath = join13(dir, "package.json");
-    if (existsSync14(pkgPath)) {
+    if (existsSync15(pkgPath)) {
       try {
         const pkg = JSON.parse(readFileSync9(pkgPath, "utf-8"));
         if (pkg.name === PKG_NAME)
@@ -41579,6 +41780,13 @@ Hoox CLI \u2014 Cloudflare Workers Platform
   styleCommandText: (str) => theme.bold(str),
   styleOptionText: (str) => str,
   styleDescriptionText: (str) => theme.dim(str)
+}).configureOutput({
+  outputError: (str, write) => {
+    if (/^error: unknown command/i.test(str) || /^error: unknown option/i.test(str) || /^error: missing required argument/i.test(str) || /^error: required option/i.test(str) || /^\(Did you mean /i.test(str)) {
+      return;
+    }
+    write(str);
+  }
 });
 program2.option("--json", "Output in JSON format");
 program2.option("--quiet", "Minimal output");
@@ -41593,10 +41801,16 @@ program2.hook("preAction", async () => {
     return;
   if (process.env.BUN_TEST === "1")
     return;
+  if (process.argv.includes("--json"))
+    return;
   try {
     const { UpdateService: UpdateService2 } = await Promise.resolve().then(() => (init_update(), exports_update));
     const service = new UpdateService2;
-    await service.checkAndPromptUpdate({ yes: true, silent: true });
+    const autoUpdate = process.env.HOOX_AUTO_UPDATE_WRANGLER === "1";
+    await service.checkAndPromptUpdate({
+      yes: autoUpdate,
+      silent: true
+    });
   } catch {}
 });
 program2.hook("postAction", (thisCmd) => {
@@ -41608,22 +41822,29 @@ program2.hook("postAction", (thisCmd) => {
   const durationMs = Date.now() - startedAt;
   const path6 = getCmdPath(thisCmd);
   const suggestion = suggestNextCommand(path6);
-  formatCompletion("Done", { durationMs, suggestion });
+  const g2 = program2.opts();
+  formatCompletion("Done", {
+    durationMs,
+    suggestion,
+    json: Boolean(g2.json),
+    quiet: Boolean(g2.quiet),
+    noColor: g2.color === false || Boolean(process.env.NO_COLOR)
+  });
 });
 program2.exitOverride((err) => {
   const globalOpts = program2.opts();
   const errFmtOpts = {
     json: Boolean(globalOpts.json),
     quiet: Boolean(globalOpts.quiet),
-    noColor: Boolean(globalOpts.noColor)
+    noColor: globalOpts.color === false || Boolean(process.env.NO_COLOR)
   };
   if (err.code === "commander.helpDisplayed" || err.code === "commander.version") {
     process.exitCode = 0 /* SUCCESS */;
-    return;
+    throw err;
   }
-  if (err.code === "commander.missingArgument" || err.message === "(outputHelp)" || err.message?.includes("outputHelp")) {
+  if ((err.message === "(outputHelp)" || err.message?.includes("outputHelp")) && err.code !== "commander.missingArgument") {
     process.exitCode = 0 /* SUCCESS */;
-    return;
+    throw err;
   }
   if (err.code === "commander.unknownCommand") {
     const match = err.message.match(/'([^']+)'/);
@@ -41631,31 +41852,36 @@ program2.exitOverride((err) => {
     const suggestion = suggestForCommand(program2, badArg);
     formatError2(new CLIError(err.message, 2 /* INVALID_USAGE */, undefined, false), suggestion ? { ...errFmtOpts, suggestions: [suggestion] } : errFmtOpts);
     process.exitCode = 2 /* INVALID_USAGE */;
-    return;
+    throw err;
   }
   if (err.code === "commander.unknownOption") {
     formatError2(new CLIError(err.message, 2 /* INVALID_USAGE */, undefined, false), errFmtOpts);
     process.exitCode = 2 /* INVALID_USAGE */;
-    return;
+    throw err;
   }
-  if (err.code === "commander.missingMandatoryOptionValue" || err.code === "commander.missingArgument") {
+  if (err.code === "commander.missingArgument" || err.code === "commander.missingMandatoryOptionValue") {
     formatError2(new CLIError(err.message, 2 /* INVALID_USAGE */, undefined, false), errFmtOpts);
     process.exitCode = 2 /* INVALID_USAGE */;
-    return;
+    throw err;
   }
   if (err instanceof CLIError) {
     formatError2(err, errFmtOpts);
     process.exitCode = err.code;
-    return;
+    throw err;
   }
   formatError2(new CLIError(err.message, 1 /* ERROR */, undefined, false), errFmtOpts);
   process.exitCode = 1 /* ERROR */;
+  throw err;
 });
 process.on("uncaughtException", (err) => {
+  if (process.exitCode !== undefined && process.exitCode !== 0)
+    return;
   formatError2(err instanceof CLIError ? err : new CLIError(`Uncaught exception: ${err.message}`, 1 /* ERROR */, err.stack, false));
   process.exitCode = 1 /* ERROR */;
 });
 process.on("unhandledRejection", (reason) => {
+  if (process.exitCode !== undefined && process.exitCode !== 0)
+    return;
   const err = reason instanceof Error ? reason : new Error(`Unhandled rejection: ${toError(reason)}`);
   formatError2(new CLIError(err.message, 1 /* ERROR */, err.stack, false));
   process.exitCode = 1 /* ERROR */;
@@ -41699,17 +41925,31 @@ async function main() {
       const configFile = Bun.file("wrangler.jsonc");
       const hasConfig = await configFile.exists();
       const wizardStateFile = Bun.file(WIZARD_STATE_PATH);
-      const hasWizardState = await wizardStateFile.exists();
+      const hasWizardState = await wizardStateFile.exists() && (await wizardStateFile.text()).trim().length > 0;
       if (!hasConfig) {
         const args = hasWizardState ? ["onboard", "--resume"] : ["onboard"];
         await program2.parseAsync(args, { from: "user" });
         return;
       }
-      if (hasWizardState) {
-        await Bun.write(WIZARD_STATE_PATH, "");
+      if (await wizardStateFile.exists()) {
+        try {
+          const { unlinkSync } = await import("fs");
+          unlinkSync(WIZARD_STATE_PATH);
+        } catch {
+          await Bun.write(WIZARD_STATE_PATH, "");
+        }
       }
       await runInteractiveTUI(program2);
     }
+  } catch (err) {
+    if (process.exitCode === undefined) {
+      const message = err instanceof Error ? err.message : `Unhandled error: ${String(err)}`;
+      const isCommander = err instanceof Error && "code" in err && typeof err.code === "string" && String(err.code).startsWith("commander.");
+      if (!isCommander) {
+        formatError2(new CLIError(message, 1 /* ERROR */, undefined, false));
+      }
+      process.exitCode = 1 /* ERROR */;
+    }
   } finally {
     if (typeof process.exit === "function" && process.exitCode !== undefined) {
       process.exit(process.exitCode);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hoox-sh/hoox-cli",
-  "version": "0.11.1",
+  "version": "0.11.3",
   "description": "Hoox CLI — manage Cloudflare Workers, infrastructure, secrets, and deployments (@hoox-sh/hoox-cli)",
   "type": "module",
   "bin": {
@@ -26,7 +26,7 @@
     "@hoox-sh/hoox-tui": "workspace:*"
   },
   "devDependencies": {
-    "@hoox-sh/hoox-shared": "^1.2.0",
+    "@hoox-sh/hoox-shared": "^1.2.1",
     "@types/node": "^26.1.1",
     "bun-types": "^1.3.14",
     "typescript": "^6.0.3"