@hoox-sh/hoox-cli 0.11.2 → 0.11.4

package/README.md

@@ -6,7 +6,7 @@
 
 > **Runtime requirement:** Bun ≥ 1.2. The bin shebang and bundle target are Bun-only; `npm install -g` will install the package but the CLI will not run under Node.js.
 
-**v0.10.1** — operator security plane: fail-closed `tui --remote`, transport profile (Bearer + Access), `doctor --security`, `tunnel check`, management `/v1/*` contract. **v0.9.x** shipped hop-level `perf fastpath` observability and reliability fixes.
+**v0.11.x** — operator security plane (`doctor --security`, `tunnel check`, transport profile Bearer + Access), PYNE edge ops (`hoox pyne`), schema validate/generate, and wrangler **4.x**. **v0.10.x** hardened fail-closed remote TUI / management `/v1/*`. **v0.9.x** shipped hop-level `perf fastpath` observability.
 
 ## Features
 
@@ -24,7 +24,7 @@
 - **Repair & Recovery** (`hoox repair`): Comprehensive system check, guided rebuild, per-component repair.
 - **Top-level Secrets & Keys**: `hoox secrets` and `hoox keys` for Cloudflare Worker secrets and internal auth keys.
 - **Unified Dashboard** (`hoox dashboard dev | deploy`): Start the dev server or build & deploy the Next.js dashboard.
-- **Interactive menu & TUI**: Running `hoox` with no arguments opens the interactive menu; `hoox tui` launches the full OpenTUI operations center.
+- **Interactive menu & TUI**: Running `hoox` with **no arguments**: if `wrangler.jsonc` is missing, auto-runs `onboard` (or `onboard --resume` when `.wizard-state.json` exists); otherwise opens the interactive menu. `hoox tui` launches the full OpenTUI operations center.
 - **Operator security plane** (`hoox doctor`, `hoox tunnel`): Path/TUI hygiene, fail-closed remote transport (Bearer + Access), and private-ingress checks.
 - **Modern-minimal output**: Zinc/indigo palette, completion footer with “next step” suggestions, “did you mean …” for typos, custom help formatter, `--no-color` / `NO_COLOR` / `TERM=dumb`, compact `formatNumber` / `formatBytes`. Shared `format*` helpers available to plugin authors.
 - **Shell Completions**: bash, zsh, and fish completion scripts via `hoox completion <shell>`.

package/bin/hoox.js

@@ -24,6 +24,20 @@
  * when the module is loaded as a side effect from here.
  */
 
+// Runtime guard before any dynamic import: Node users (wrong shebang, or
+// `node bin/hoox.js`) get a clear message instead of ESM resolution stacks.
+// The same check lives in src/index.ts for direct source entry; this one
+// covers the bin path when Node loads this file without Bun globals.
+if (typeof globalThis.Bun === "undefined") {
+  process.stderr.write(
+    "Error: the Hoox CLI requires Bun >= 1.2 to run.\n" +
+      "  Install Bun:  curl -fsSL https://bun.sh | bash\n" +
+      "  Then run:    bunx hoox <command>\n" +
+      "  (npm install -g / node bin/hoox.js will not work.)\n"
+  );
+  process.exit(1);
+}
+
 import { existsSync, statSync, readdirSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname, resolve, join } from "node:path";

package/dist/index.js

@@ -25067,7 +25067,7 @@ class ConfigService {
       const e = result.error;
       switch (e.code) {
         case "not-found":
-          throw new Error(e.triedFallback ? `Config file not found: ${e.path}. Also tried: ${e.triedFallback}. Run 'hoox config init' to create one.` : `Config file not found: ${e.path}. Run 'hoox config init' to create one.`);
+          throw new Error(e.triedFallback ? `Config file not found: ${e.path}. Also tried: ${e.triedFallback}. Run 'hoox onboard' (or 'hoox init') to create one.` : `Config file not found: ${e.path}. Run 'hoox onboard' (or 'hoox init') to create one.`);
         case "invalid-jsonc":
           throw new Error(`Invalid JSONC in ${e.path}:
 ${e.errors.map((m3) => `  - ${m3}`).join(`
@@ -25548,6 +25548,33 @@ var init_cloudflare_service = __esm(() => {
   init_wrangler_output();
 });
 
+// src/utils/fs-secure.ts
+var exports_fs_secure = {};
+__export(exports_fs_secure, {
+  secureSecretFile: () => secureSecretFile,
+  secureChmod: () => secureChmod,
+  ensureSecretDir: () => ensureSecretDir,
+  SECRET_FILE_MODE: () => SECRET_FILE_MODE,
+  SECRET_DIR_MODE: () => SECRET_DIR_MODE
+});
+import { chmodSync as chmodSync3, mkdirSync as mkdirSync3 } from "fs";
+function secureChmod(path4, mode) {
+  try {
+    chmodSync3(path4, mode);
+  } catch {}
+}
+function ensureSecretDir(dir) {
+  try {
+    mkdirSync3(dir, { recursive: true, mode: SECRET_DIR_MODE });
+  } catch {}
+  secureChmod(dir, SECRET_DIR_MODE);
+}
+function secureSecretFile(path4) {
+  secureChmod(path4, SECRET_FILE_MODE);
+}
+var SECRET_FILE_MODE = 384, SECRET_DIR_MODE = 448;
+var init_fs_secure = () => {};
+
 // src/services/prerequisites/prerequisites-service.ts
 class PrerequisitesService {
   MINIMUM_WRANGLER = "3.88.0";
@@ -25891,6 +25918,7 @@ class UpdateService {
   }
   async checkAndPromptUpdate(options) {
     const silent = options?.silent === true;
+    const yes = options?.yes === true;
     try {
       const versionCheck = await this.prereqs.checkWranglerVersion();
       if (!versionCheck.outdated) {
@@ -25900,6 +25928,9 @@ class UpdateService {
         }
         return { updated: false };
       }
+      if (silent && !yes) {
+        return { updated: false };
+      }
       const current2 = versionCheck.current ?? "unknown";
       const minimum = versionCheck.minimum ?? "unknown";
       const latest2 = await this.checkLatestVersion();
@@ -26140,7 +26171,7 @@ var exports_schema_service = {};
 __export(exports_schema_service, {
   SchemaService: () => SchemaService
 });
-import { readFileSync as readFileSync5, existsSync as existsSync10 } from "fs";
+import { readFileSync as readFileSync5, existsSync as existsSync11 } from "fs";
 import { resolve as resolve4 } from "path";
 
 class SchemaService {
@@ -26174,7 +26205,7 @@ class SchemaService {
     const workerWranglerPath = resolve4(workersDir, name, "wrangler.jsonc");
     const devVarsPath = resolve4(workersDir, name, ".dev.vars");
     const errors4 = [];
-    const isHooxProject = existsSync10(resolve4(this.projectRoot, "wrangler.jsonc")) || existsSync10(resolve4(this.projectRoot, "workers"));
+    const isHooxProject = existsSync11(resolve4(this.projectRoot, "wrangler.jsonc")) || existsSync11(resolve4(this.projectRoot, "workers"));
     try {
       const wranglerContent = readFileSync5(workerWranglerPath, "utf-8");
       errors4.push(...validateWranglerJsonc(name, manifest, wranglerContent));
@@ -28579,6 +28610,10 @@ function formatSuccess(message, opts) {
 function formatError2(error51, opts = {}) {
   const message = typeof error51 === "string" ? error51 : error51.message;
   const cliError = error51 instanceof CLIError ? error51 : null;
+  const write = (s) => {
+    process.stderr.write(s);
+    process.stdout.write(s);
+  };
   if (opts.json) {
     const output = {
       success: false,
@@ -28592,12 +28627,12 @@ function formatError2(error51, opts = {}) {
     if (opts.suggestions && opts.suggestions.length > 0) {
       output.suggestions = opts.suggestions;
     }
-    process.stdout.write(JSON.stringify(output) + `
+    write(JSON.stringify(output) + `
 `);
     return;
   }
   if (opts.quiet) {
-    process.stdout.write(`${message}
+    write(`${message}
 `);
     return;
   }
@@ -28607,13 +28642,13 @@ function formatError2(error51, opts = {}) {
     titleParts.push(theme.textSubtle(`[${cliError.code}]`));
   }
   titleParts.push(theme.text(message));
-  process.stdout.write(`${titleParts.join(" ")}
+  write(`${titleParts.join(" ")}
 `);
   if (cliError?.details) {
     const detailLines = cliError.details.split(`
 `).filter((l) => l.length > 0);
     for (const line of detailLines) {
-      process.stdout.write(`  ${theme.textMuted(line)}
+      write(`  ${theme.textMuted(line)}
 `);
     }
   }
@@ -28621,24 +28656,24 @@ function formatError2(error51, opts = {}) {
   const hasSuggestions = !!opts.suggestions && opts.suggestions.length > 0;
   if (hasHint || hasSuggestions) {
     if (inCard) {
-      process.stdout.write(`  ${theme.border(icons.pipe)}
+      write(`  ${theme.border(icons.pipe)}
 `);
     }
     if (hasHint) {
-      process.stdout.write(`  ${inCard ? theme.border(icons.pipe) : " "}  ${theme.dim("\u21B3 hint:")} ${theme.value(cliError.hint)}
+      write(`  ${inCard ? theme.border(icons.pipe) : " "}  ${theme.dim("\u21B3 hint:")} ${theme.value(cliError.hint)}
 `);
     }
     if (hasSuggestions) {
       const sugText = opts.suggestions.map((s) => `'${s}'`).join(", ");
-      process.stdout.write(`  ${inCard ? theme.border(icons.pipe) : " "}  ${theme.dim("did you mean:")} ${theme.accent(sugText)} ${theme.dim("?")}
+      write(`  ${inCard ? theme.border(icons.pipe) : " "}  ${theme.dim("did you mean:")} ${theme.accent(sugText)} ${theme.dim("?")}
 `);
     }
     if (inCard) {
-      process.stdout.write(`  ${theme.border(icons.pipe)}
+      write(`  ${theme.border(icons.pipe)}
 `);
     }
   } else if (inCard && !cliError?.details) {
-    process.stdout.write(`  ${theme.border(icons.pipe)}
+    write(`  ${theme.border(icons.pipe)}
 `);
   }
 }
@@ -28979,7 +29014,12 @@ function captureHelpEvent(cmd, eventName) {
 // src/utils/completion.ts
 var SUGGEST_NEXT = {
   init: { command: "hoox setup", reason: "provision infrastructure" },
-  setup: { command: "hoox deploy all", reason: "ship to Cloudflare" },
+  onboard: { command: "hoox check setup", reason: "verify bootstrap" },
+  setup: { command: "hoox check setup", reason: "verify infrastructure" },
+  "check setup": {
+    command: "hoox deploy all",
+    reason: "ship workers to Cloudflare"
+  },
   "deploy all": { command: "hoox check health", reason: "verify the deploy" },
   "check health": {
     command: "hoox monitor trades",
@@ -29014,6 +29054,7 @@ function getCmdPath(cmd) {
 // src/commands/init/init-command.ts
 init_dist4();
 init_src();
+import * as fs2 from "fs";
 
 // src/services/cloudflare/index.ts
 init_cloudflare_service();
@@ -29080,21 +29121,32 @@ class CLIProvisioner {
 
 // src/commands/init/init-command.ts
 async function verifyRepoRoot() {
-  const rootConfig = Bun.file("wrangler.jsonc");
   const cliPackage = Bun.file("packages/cli/package.json");
-  const [rootConfigExists, cliPackageExists] = await Promise.all([
-    rootConfig.exists(),
-    cliPackage.exists()
+  const wranglerExample = Bun.file("wrangler.jsonc.example");
+  const wranglerConfig = Bun.file("wrangler.jsonc");
+  const gitmodules = Bun.file(".gitmodules");
+  const [
+    cliPackageExists,
+    wranglerExampleExists,
+    wranglerConfigExists,
+    gitmodulesExists
+  ] = await Promise.all([
+    cliPackage.exists(),
+    wranglerExample.exists(),
+    wranglerConfig.exists(),
+    gitmodules.exists()
   ]);
-  if (rootConfigExists && cliPackageExists)
+  const workersDirExists = fs2.existsSync("workers");
+  const hasRepoSignal = wranglerExampleExists || wranglerConfigExists || workersDirExists || gitmodulesExists;
+  if (cliPackageExists && hasRepoSignal)
     return;
   const reasons = [];
-  if (!rootConfigExists) {
-    reasons.push("no root `wrangler.jsonc` found in the current directory");
-  }
   if (!cliPackageExists) {
     reasons.push("no `packages/cli` workspace found (this is not the hoox monorepo)");
   }
+  if (cliPackageExists && !hasRepoSignal) {
+    reasons.push("missing Hoox repo markers (expected one of: `wrangler.jsonc.example`, `wrangler.jsonc`, `workers/`, or `.gitmodules`)");
+  }
   const cloneHint = "  Clone first: git clone --recursive " + "https://github.com/hoox-sh/hoox.git";
   throw new CLIError(`Not inside a Hoox repository root.
   ` + reasons.join(`
@@ -29168,6 +29220,8 @@ async function createDevVars(config2, secrets, opts) {
     const dir = `${worker.path}`;
     try {
       await Bun.write(filePath, content);
+      const { secureSecretFile: secureSecretFile2 } = await Promise.resolve().then(() => (init_fs_secure(), exports_fs_secure));
+      secureSecretFile2(filePath);
       if (!opts?.quiet) {
         formatSuccess(`Created ${filePath}`, opts);
       }
@@ -29175,6 +29229,8 @@ async function createDevVars(config2, secrets, opts) {
       const { mkdir } = await import("fs/promises");
       await mkdir(dir, { recursive: true });
       await Bun.write(filePath, content);
+      const { secureSecretFile: secureSecretFile2 } = await Promise.resolve().then(() => (init_fs_secure(), exports_fs_secure));
+      secureSecretFile2(filePath);
       if (!opts?.quiet) {
         formatSuccess(`Created ${filePath}`, opts);
       }
@@ -29267,7 +29323,10 @@ async function runInitCommand(options, globalOpts, isNonInteractive) {
     if (error51) {
       formatError2(new CLIError(error51, 1 /* ERROR */), globalOpts);
       process.exitCode = 1 /* ERROR */;
+      return;
     }
+    process.env.CLOUDFLARE_API_TOKEN = token;
+    process.env.CLOUDFLARE_ACCOUNT_ID = account;
     if (!globalOpts.quiet) {
       formatSuccess("Cloudflare API token validated", globalOpts);
     }
@@ -29305,6 +29364,7 @@ async function runInitCommand(options, globalOpts, isNonInteractive) {
       if (isCancel(resumed)) {
         cancel("Setup cancelled.");
         process.exitCode = 0;
+        return;
       }
       if (!resumed) {
         engine = null;
@@ -29324,10 +29384,12 @@ async function runInitCommand(options, globalOpts, isNonInteractive) {
       if (isCancel(accepted)) {
         cancel("Setup cancelled.");
         process.exitCode = 0;
+        return;
       }
       if (!accepted) {
         outro("Setup cancelled. See DISCLAIMER.md for full terms.");
         process.exitCode = 0;
+        return;
       }
     }
     engine.execute({ checksPassed: true });
@@ -29349,6 +29411,7 @@ async function runInitCommand(options, globalOpts, isNonInteractive) {
       if (isCancel(apiToken)) {
         cancel("Setup cancelled.");
         process.exitCode = 0;
+        return;
       }
       log.step("Validating Cloudflare API token...");
       const tokenError = await validateApiToken(cf, apiToken);
@@ -29357,6 +29420,7 @@ async function runInitCommand(options, globalOpts, isNonInteractive) {
         log.warn("Please check your token and try again.");
       } else {
         tokenValid = true;
+        process.env.CLOUDFLARE_API_TOKEN = apiToken;
         formatSuccess("Cloudflare API token validated", globalOpts);
       }
     }
@@ -29377,6 +29441,7 @@ async function runInitCommand(options, globalOpts, isNonInteractive) {
     if (isCancel(accountResult)) {
       cancel("Setup cancelled.");
       process.exitCode = 0;
+      return;
     }
     const secretStoreResult = await text({
       message: "Cloudflare Secret Store ID:",
@@ -29386,6 +29451,7 @@ async function runInitCommand(options, globalOpts, isNonInteractive) {
     if (isCancel(secretStoreResult)) {
       cancel("Setup cancelled.");
       process.exitCode = 0;
+      return;
     }
     const prefixResult = await text({
       message: "Subdomain prefix:",
@@ -29400,7 +29466,9 @@ async function runInitCommand(options, globalOpts, isNonInteractive) {
     if (isCancel(prefixResult)) {
       cancel("Setup cancelled.");
       process.exitCode = 0;
+      return;
     }
+    process.env.CLOUDFLARE_ACCOUNT_ID = accountResult;
     engine.execute({
       apiToken,
       accountId: accountResult,
@@ -29433,6 +29501,7 @@ async function runInitCommand(options, globalOpts, isNonInteractive) {
     if (isCancel(presetChoice)) {
       cancel("Setup cancelled.");
       process.exitCode = 0;
+      return;
     }
     engine.execute({ preset: presetChoice });
     await saveState(engine);
@@ -29456,6 +29525,7 @@ async function runInitCommand(options, globalOpts, isNonInteractive) {
       if (isCancel(shouldProvision)) {
         cancel("Setup cancelled.");
         process.exitCode = 0;
+        return;
       }
       if (shouldProvision) {
         log.step("Provisioning infrastructure...");
@@ -29505,6 +29575,9 @@ async function runInitCommand(options, globalOpts, isNonInteractive) {
             process.exitCode = 0;
           }
         });
+        if (isCancel(collected)) {
+          return;
+        }
         collectedSecrets[key] = {};
         for (const [secretName] of secretEntries) {
           const val = collected[secretName];
@@ -29532,6 +29605,7 @@ async function runInitCommand(options, globalOpts, isNonInteractive) {
     if (isCancel(shouldDeploy)) {
       cancel("Setup cancelled.");
       process.exitCode = 0;
+      return;
     }
     if (shouldDeploy) {
       log.step("Deploying workers...");
@@ -29547,8 +29621,10 @@ async function runInitCommand(options, globalOpts, isNonInteractive) {
 }
 // src/services/setup/setup-service.ts
 import {
-  existsSync as existsSync6,
-  mkdirSync as mkdirSync3,
+  chmodSync as chmodSync4,
+  existsSync as existsSync7,
+  mkdirSync as mkdirSync4,
+  readdirSync as readdirSync3,
   readFileSync as readFileSync3,
   statSync as statSync2,
   writeFileSync as writeFileSync2
@@ -29607,6 +29683,54 @@ var KEYS_DIR = ".keys";
 function escapeRegex2(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+function parseEnvFile(text2) {
+  const map2 = new Map;
+  for (const line of text2.split(`
+`)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#"))
+      continue;
+    const eq = trimmed.indexOf("=");
+    if (eq <= 0)
+      continue;
+    map2.set(trimmed.slice(0, eq), trimmed.slice(eq + 1));
+  }
+  return map2;
+}
+function safeChmod(path4, mode) {
+  try {
+    chmodSync4(path4, mode);
+  } catch {}
+}
+function loadExistingKeysFromDisk() {
+  const setupEnv = join7(KEYS_DIR, "setup.env");
+  if (!existsSync7(setupEnv))
+    return null;
+  let text2;
+  try {
+    text2 = readFileSync3(setupEnv, "utf-8");
+  } catch {
+    return null;
+  }
+  const map2 = parseEnvFile(text2);
+  const required2 = [
+    "INTERNAL_KEY_BINDING",
+    "AGENT_INTERNAL_KEY",
+    "SESSION_SECRET",
+    "WEBHOOK_API_KEY_BINDING",
+    "TELEGRAM_INTERNAL_KEY_BINDING",
+    "TRADE_INTERNAL_KEY",
+    "API_SERVICE_KEY_BINDING"
+  ];
+  const keys = {};
+  for (const name of required2) {
+    const v = map2.get(name);
+    if (!v)
+      return null;
+    keys[name] = v;
+  }
+  return keys;
+}
 
 class SetupService {
   onProgress;
@@ -29617,7 +29741,20 @@ class SetupService {
   }
   async generateKeys(skip = false) {
     if (skip) {
-      this.onProgress({ type: "info", step: "keys", message: "Skipped" });
+      const existing = loadExistingKeysFromDisk();
+      if (existing) {
+        this.onProgress({
+          type: "info",
+          step: "keys",
+          message: "Using existing keys from .keys/setup.env (--skip-keys)"
+        });
+        return existing;
+      }
+      this.onProgress({
+        type: "info",
+        step: "keys",
+        message: "Skipped (no existing .keys/setup.env)"
+      });
       return null;
     }
     this.onProgress({
@@ -29635,35 +29772,53 @@ class SetupService {
       TRADE_INTERNAL_KEY: internalKey,
       API_SERVICE_KEY_BINDING: internalKey
     };
-    if (!existsSync6(KEYS_DIR)) {
-      mkdirSync3(KEYS_DIR, { recursive: true });
+    if (!existsSync7(KEYS_DIR)) {
+      mkdirSync4(KEYS_DIR, { recursive: true });
     } else if (!statSync2(KEYS_DIR).isDirectory()) {
-      mkdirSync3(KEYS_DIR, { recursive: true });
+      mkdirSync4(KEYS_DIR, { recursive: true });
     }
+    safeChmod(KEYS_DIR, 448);
+    const setupEnvPath = join7(KEYS_DIR, "setup.env");
     const envLines = Object.entries(keys).map(([k, v]) => `${k}=${v}`);
-    await Bun.write(join7(KEYS_DIR, "setup.env"), `# Hoox Setup \u2014 Auto-Generated Keys
+    await Bun.write(setupEnvPath, `# Hoox Setup \u2014 Auto-Generated Keys
 ` + "# Generated by `hoox setup`. NEVER commit this file.\n" + `# Created: ${new Date().toISOString()}
 
 ` + envLines.join(`
 `) + `
 `);
+    safeChmod(setupEnvPath, 384);
     for (const [name, value] of Object.entries(keys)) {
-      await Bun.write(join7(KEYS_DIR, `${name.toLowerCase()}.env`), `${name}=${value}
+      const keyPath = join7(KEYS_DIR, `${name.toLowerCase()}.env`);
+      await Bun.write(keyPath, `${name}=${value}
 `);
+      safeChmod(keyPath, 384);
     }
     let devVarsCount = 0;
     for (const [worker, secretNames] of Object.entries(DEV_VARS_WORKER_KEYS)) {
       const path4 = `workers/${workerFsDir(worker)}/.dev.vars`;
+      const meshNames = secretNames;
+      const meshSet = new Set(meshNames);
+      const existing = existsSync7(path4) ? parseEnvFile(readFileSync3(path4, "utf-8")) : new Map;
+      for (const secretName of meshNames) {
+        existing.set(secretName, keys[secretName]);
+      }
       let content = `# .dev.vars \u2014 local secrets for ${worker}
 `;
       content += `# Generated by \`hoox setup\`. NEVER commit this file.
 
 `;
-      for (const secretName of secretNames) {
-        content += `${secretName}=${keys[secretName]}
+      for (const secretName of meshNames) {
+        content += `${secretName}=${existing.get(secretName)}
 `;
       }
+      for (const [k, v] of existing) {
+        if (!meshSet.has(k)) {
+          content += `${k}=${v}
+`;
+        }
+      }
       await Bun.write(path4, content);
+      safeChmod(path4, 384);
       devVarsCount++;
     }
     this.onProgress({
@@ -29992,38 +30147,40 @@ class SetupService {
       join7(dir, "pyproject.toml"),
       join7(dir, "wrangler.jsonc")
     ];
-    return markers.some((p3) => existsSync6(p3));
+    return markers.some((p3) => existsSync7(p3));
   }
-  async ensureWorkers() {
-    this.onProgress({
-      type: "step-start",
-      step: "workers",
-      message: "Checking worker submodules..."
-    });
+  listMissingWorkers() {
     const workerDirs = [
       ...ALL_WORKERS,
       ...TOOLING_WORKERS,
       "dashboard"
     ];
     const missing = [];
-    const gitmodulesPath = ".gitmodules";
     for (const name of workerDirs) {
       const dir = `workers/${workerFsDir(name)}`;
       try {
         const gitEntry = readFileSync3(join7(dir, ".git"), "utf-8").trim();
         if (gitEntry.startsWith("gitdir:") || gitEntry.length > 0) {
-          if (!this.isWorkerTreePopulated(dir, name)) {
+          if (!this.isWorkerTreePopulated(dir, name))
             missing.push(name);
-          }
         } else if (!this.isWorkerTreePopulated(dir, name)) {
           missing.push(name);
         }
       } catch {
-        if (!this.isWorkerTreePopulated(dir, name)) {
+        if (!this.isWorkerTreePopulated(dir, name))
           missing.push(name);
-        }
       }
     }
+    return missing;
+  }
+  async ensureWorkers() {
+    this.onProgress({
+      type: "step-start",
+      step: "workers",
+      message: "Checking worker submodules..."
+    });
+    const missing = this.listMissingWorkers();
+    const gitmodulesPath = ".gitmodules";
     if (missing.length === 0) {
       this.onProgress({
         type: "step-complete",
@@ -30037,7 +30194,7 @@ class SetupService {
       step: "workers",
       message: `${missing.length} worker(s) not cloned: ${missing.join(", ")}`
     });
-    if (!existsSync6(gitmodulesPath)) {
+    if (!existsSync7(gitmodulesPath)) {
       this.onProgress({
         type: "step-error",
         step: "workers",
@@ -30078,14 +30235,17 @@ class SetupService {
     ];
     const toBuild = [];
     for (const pkg of packages) {
+      let built = false;
       try {
-        const jsFiles = readFileSync3(pkg.dist, "utf-8");
-        if (!jsFiles.includes(".js")) {
-          toBuild.push(pkg.name);
+        if (existsSync7(pkg.dist) && statSync2(pkg.dist).isDirectory()) {
+          const entries = readdirSync3(pkg.dist);
+          built = entries.some((e) => e.endsWith(".js"));
         }
       } catch {
-        toBuild.push(pkg.name);
+        built = false;
       }
+      if (!built)
+        toBuild.push(pkg.name);
     }
     if (toBuild.length === 0) {
       this.onProgress({
@@ -30402,13 +30562,21 @@ class SetupService {
       results.success = false;
       return results;
     }
-    const cloned = await this.ensureWorkers();
-    if (cloned.length > 0) {
+    const missingAfterClone = await this.ensureWorkers();
+    const stillMissing = this.listMissingWorkers();
+    if (stillMissing.length > 0) {
+      steps.push({
+        step: "workers",
+        success: false,
+        message: `Missing worker trees: ${stillMissing.join(", ")}. Run: git submodule update --init --recursive`
+      });
       this.onProgress({
-        type: "warn",
+        type: "step-error",
         step: "workers",
-        message: "Run `hoox setup` again after clone completes."
+        message: missingAfterClone.length > 0 ? "Workers still missing after clone attempt \u2014 aborting setup." : "Workers missing \u2014 aborting setup."
       });
+      results.success = false;
+      return results;
     }
     const built = await this.ensurePackages();
     if (!built) {
@@ -30417,6 +30585,8 @@ class SetupService {
         success: false,
         message: "Package build failed \u2014 check dependencies"
       });
+      results.success = false;
+      return results;
     }
     this.fixWranglerConfigs();
     const keys = await this.generateKeys(options.skipKeys);
@@ -30433,7 +30603,7 @@ class SetupService {
     } else {
       steps.push({ step: "d1-schema", success: true, message: "Skipped" });
     }
-    if (keys) {
+    if (!options.skipSecrets && keys) {
       const reconcile = await this.reconcileSecrets(keys);
       if (reconcile.warnings.length > 0) {
         for (const w of reconcile.warnings) {
@@ -30441,20 +30611,25 @@ class SetupService {
         }
       }
     }
-    const secretResults = await this.setSecrets(keys);
-    results.secrets = secretResults;
-    const secretOk = secretResults.filter((r2) => r2.ok).length;
-    const secretFail = secretResults.filter((r2) => !r2.ok).length;
-    steps.push({
-      step: "secrets",
-      success: secretFail === 0,
-      message: `${secretOk} set, ${secretFail} failed`,
-      details: {
-        total: secretResults.length,
-        ok: secretOk,
-        failed: secretFail
-      }
-    });
+    if (options.skipSecrets) {
+      steps.push({ step: "secrets", success: true, message: "Skipped" });
+      results.secrets = [];
+    } else {
+      const secretResults = await this.setSecrets(keys);
+      results.secrets = secretResults;
+      const secretOk = secretResults.filter((r2) => r2.ok).length;
+      const secretFail = secretResults.filter((r2) => !r2.ok).length;
+      steps.push({
+        step: "secrets",
+        success: secretFail === 0,
+        message: `${secretOk} set, ${secretFail} failed`,
+        details: {
+          total: secretResults.length,
+          ok: secretOk,
+          failed: secretFail
+        }
+      });
+    }
     const dashResult = await this.rebuildDashboard(options.skipDashboard);
     steps.push(dashResult);
     if (keys) {
@@ -30559,12 +30734,35 @@ async function runOnboard(options, fmt) {
     acceptRisk: options.acceptRisk
   };
   await runInitCommand(initOpts, { json: fmt.json, quiet: fmt.quiet }, isNonInteractive);
+  if (process.exitCode && process.exitCode !== 0) {
+    return;
+  }
+  const configReady = await Bun.file("wrangler.jsonc").exists();
+  if (!configReady) {
+    if (!quiet) {
+      formatError2(new CLIError("Onboard stopped: workspace config was not written (init cancelled or incomplete).", 1 /* ERROR */, undefined, false, "Re-run `hoox onboard` or `hoox init` to finish configuration, then `hoox setup`."), fmt);
+    }
+    process.exitCode = 1 /* ERROR */;
+    return;
+  }
+  if (options.token) {
+    process.env.CLOUDFLARE_API_TOKEN = options.token;
+  }
+  if (options.account) {
+    process.env.CLOUDFLARE_ACCOUNT_ID = options.account;
+  }
   if (!quiet) {
     process.stdout.write(theme.heading(`
 \u2501\u2501\u2501 Step 2/2: Setup (infrastructure bootstrap) \u2501\u2501\u2501
 `));
   }
   const setupSvc = new SetupService;
+  const authOk = await setupSvc.checkAuth();
+  if (!authOk) {
+    formatError2(new CLIError("Not authenticated with Cloudflare. Run 'wrangler login' first.", 1 /* ERROR */, undefined, false, "Run `wrangler login` interactively, or set CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID environment variables for CI / non-interactive use."), fmt);
+    process.exitCode = 1 /* ERROR */;
+    return;
+  }
   const setupOpts = {
     skipKeys: Boolean(options.skipKeys),
     skipDb: Boolean(options.skipDb),
@@ -30576,14 +30774,14 @@ async function runOnboard(options, fmt) {
     const result = await setupSvc.runAll(setupOpts);
     if (result.success) {
       if (!quiet) {
-        formatSuccess("Bootstrap complete! Run: hoox check setup to verify.", fmt);
+        formatSuccess("Bootstrap complete! Next: `hoox check setup` then `hoox deploy all`", fmt);
       }
     } else {
-      formatError2(new CLIError("Bootstrap completed with issues. See logs above.", 1 /* ERROR */), fmt);
+      formatError2(new CLIError("Bootstrap completed with issues. See logs above.", 1 /* ERROR */, undefined, false, "Retry with `hoox setup`, diagnose with `hoox check setup`, or run `hoox repair check`."), fmt);
       process.exitCode = 1 /* ERROR */;
     }
   } catch (e) {
-    formatError2(new CLIError(e instanceof Error ? e.message : String(e), 1 /* ERROR */), fmt);
+    formatError2(new CLIError(e instanceof Error ? e.message : String(e), 1 /* ERROR */, undefined, false, "Retry with `hoox setup`, diagnose with `hoox check setup`, or run `hoox repair check`."), fmt);
     process.exitCode = 1 /* ERROR */;
   }
 }
@@ -31101,7 +31299,7 @@ function renderDefaultSummary(results) {
 init_errors4();
 import {
   statSync as statSync3,
-  existsSync as existsSync7,
+  existsSync as existsSync8,
   readFileSync as readFileSync4,
   writeFileSync as writeFileSync3,
   renameSync
@@ -31536,7 +31734,7 @@ ${section}:
 init_main();
 function getDashboardBuildInfo(dashboardPath) {
   const workerPath = resolve2(dashboardPath, ".open-next", "worker.js");
-  if (!existsSync7(workerPath)) {
+  if (!existsSync8(workerPath)) {
     return { exists: false };
   }
   const stats = statSync3(workerPath);
@@ -31879,7 +32077,7 @@ async function doUpdateInternalUrls(fmt) {
     const prefix = global.subdomain_prefix ?? "hoox";
     const workers = config2.listEnabledWorkers();
     const filePath = resolve2(process.cwd(), "workers", "dashboard", "wrangler.jsonc");
-    if (!existsSync7(filePath)) {
+    if (!existsSync8(filePath)) {
       formatError2(new CLIError("Dashboard wrangler.jsonc not found at workers/dashboard/wrangler.jsonc", 1 /* ERROR */), fmt);
       process.exitCode = 1 /* ERROR */;
       return;
@@ -33033,6 +33231,8 @@ async function handleInit(opts) {
     await Bun.write(tmpPath, envContent);
     await Bun.write(".env.local", envContent);
     await Bun.file(tmpPath).delete().catch(() => {});
+    const { secureSecretFile: secureSecretFile2 } = await Promise.resolve().then(() => (init_fs_secure(), exports_fs_secure));
+    secureSecretFile2(".env.local");
     if (!opts.quiet)
       formatSuccess(".env.local written", opts);
     log.step("Writing .dev.vars files...");
@@ -33047,6 +33247,8 @@ async function handleInit(opts) {
       ].join(`
 `);
       await Bun.write(`${workerPath}/.dev.vars`, content);
+      const { secureSecretFile: chmodDev } = await Promise.resolve().then(() => (init_fs_secure(), exports_fs_secure));
+      chmodDev(`${workerPath}/.dev.vars`);
       if (!opts.quiet)
         formatSuccess(`Created ${workerPath}/.dev.vars`, opts);
     }
@@ -33123,6 +33325,8 @@ async function handleGenerateDevVars(opts) {
     ].join(`
 `);
     await Bun.write(`${workerPath}/.dev.vars`, content);
+    const { secureSecretFile: secureSecretFile2 } = await Promise.resolve().then(() => (init_fs_secure(), exports_fs_secure));
+    secureSecretFile2(`${workerPath}/.dev.vars`);
     count++;
   }
   formatSuccess(`Generated .dev.vars for ${count} worker(s)`, opts);
@@ -33370,7 +33574,7 @@ class SecretsService {
     const path5 = configPath ?? "wrangler.jsonc";
     const file2 = Bun.file(path5);
     if (!await file2.exists()) {
-      throw new Error(`Config file not found: ${path5}`);
+      throw new Error(`Config file not found: ${path5}. Run 'hoox onboard' (or 'hoox init') to create one.`);
     }
     const text2 = await file2.text();
     const config2 = parse6(text2);
@@ -33453,6 +33657,8 @@ class SecretsService {
     const devVarsPath = `${worker.path}/.dev.vars`;
     try {
       await Bun.write(devVarsPath, content);
+      const { secureSecretFile: secureSecretFile2 } = await Promise.resolve().then(() => (init_fs_secure(), exports_fs_secure));
+      secureSecretFile2(devVarsPath);
       return { ok: true, value: devVarsPath };
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
@@ -33700,6 +33906,8 @@ async function updateDevVars(filePath, key, value) {
     await Bun.write(filePath, `${key}=${value}
 `);
   }
+  const { secureSecretFile: secureSecretFile2 } = await Promise.resolve().then(() => (init_fs_secure(), exports_fs_secure));
+  secureSecretFile2(filePath);
 }
 function registerSecretsSubcommands(secretsCmd, service = "config") {
   secretsCmd.command("list [worker]").summary("List secrets for all workers or a specific worker").description(`List the secrets declared in wrangler.jsonc for workers.
@@ -33773,7 +33981,7 @@ EXAMPLES:
     const svc = await SecretsService.create();
     const declared = svc.listSecrets(workerName);
     if (!declared.includes(secretName) && declared.length > 0) {
-      throw new CLIError(`Secret "${secretName}" is not declared for worker "${workerName}". ` + `Declared secrets: ${declared.join(", ")}`, 2 /* INVALID_USAGE */);
+      throw new CLIError(`Secret "${secretName}" is not declared for worker "${workerName}". Declared secrets: ${declared.join(", ")}`, 2 /* INVALID_USAGE */);
     }
     const value = await promptSecret(`Enter value for "${secretName}"`);
     if (!value) {
@@ -33956,7 +34164,8 @@ EXAMPLES:
 }
 
 // src/commands/config/keys-subcommands.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync4 } from "fs";
+import { existsSync as existsSync9 } from "fs";
+init_fs_secure();
 init_theme();
 function generateKey(bytes = 32) {
   const buf = new Uint8Array(bytes);
@@ -33982,9 +34191,7 @@ EXAMPLES:
   hoox config keys generate`).action(withErrorHandling(async (_2, cmd) => {
     const opts = getFormatOptions(cmd);
     const keysDir = ".keys";
-    if (!existsSync8(keysDir)) {
-      mkdirSync4(keysDir, { recursive: true });
-    }
+    ensureSecretDir(keysDir);
     const meshKey = generateKey();
     const keys = {
       INTERNAL_KEY_BINDING: meshKey,
@@ -33999,7 +34206,13 @@ EXAMPLES:
       const filePath = `${keysDir}/${name.toLowerCase()}.env`;
       await Bun.write(filePath, `${name}=${value}
 `);
+      secureSecretFile(filePath);
     }
+    await Bun.write(`${keysDir}/setup.env`, `# Generated by hoox keys generate
+` + Object.entries(keys).map(([k, v]) => `${k}=${v}`).join(`
+`) + `
+`);
+    secureSecretFile(`${keysDir}/setup.env`);
     formatSuccess(`Generated ${Object.keys(keys).length} keys in ${keysDir}/`, opts);
     if (!opts.quiet && !opts.json) {
       process.stdout.write(`${theme.warning("!")}  Keep these keys secret. Add ${keysDir}/ to .gitignore.
@@ -34016,7 +34229,7 @@ EXAMPLES:
   hoox config keys list`).action(withErrorHandling(async (_2, cmd) => {
     const opts = getFormatOptions(cmd);
     const keysDir = ".keys";
-    if (!existsSync8(keysDir)) {
+    if (!existsSync9(keysDir)) {
       process.stdout.write(`${theme.dim("No .keys/ directory found.")}
 `);
       return;
@@ -34657,7 +34870,7 @@ async function runSecretsChecks(secretsService, configService, cf) {
 async function runDatabaseChecks(cf, configService) {
   const checks3 = [];
   const d1Worker = configService.getWorker("d1-worker");
-  const dbName = d1Worker?.vars?.database_name ?? "my-database";
+  const dbName = d1Worker?.vars?.database_name ?? "trade-data-db";
   const d1ListResult = await cf.d1List();
   if (d1ListResult.ok) {
     const hasDb = d1ListResult.value.includes(dbName);
@@ -36282,7 +36495,7 @@ init_dist4();
 // src/services/db/db-service.ts
 init_config2();
 init_cloudflare_service();
-import { existsSync as existsSync9 } from "fs";
+import { existsSync as existsSync10 } from "fs";
 import { join as join9 } from "path";
 var D1_WRANGLER_CONFIG_CANDIDATES = [
   "workers/d1-worker/wrangler.jsonc",
@@ -36320,7 +36533,7 @@ class DbService {
       if (vars?.database_name)
         return vars.database_name;
     } catch {}
-    return "my-database";
+    return "trade-data-db";
   }
   async apply(dbName, remote, schemaPath) {
     const path6 = schemaPath ?? this.resolveDefaultSchemaPath();
@@ -36384,7 +36597,7 @@ class DbService {
     if (this.wranglerConfigPath)
       return this.wranglerConfigPath;
     for (const candidate of D1_WRANGLER_CONFIG_CANDIDATES) {
-      if (existsSync9(candidate))
+      if (existsSync10(candidate))
         return candidate;
     }
     return;
@@ -37479,8 +37692,7 @@ function registerSchemaCommand(program2) {
     const svc = new SchemaService;
     const manifest = svc.getManifest(worker);
     if (!manifest) {
-      formatError2(new CLIError(`Unknown worker "${worker}"`, 2 /* INVALID_USAGE */), fmt);
-      return;
+      throw new CLIError(`Unknown worker "${worker}"`, 2 /* INVALID_USAGE */, undefined, false, `Known workers: ${svc.getWorkerNames().join(", ") || "(none)"}. Run: hoox schema list`);
     }
     const wranglerContent = generateWranglerJsonc(manifest);
     const devVarsContent = generateDevVars(manifest);
@@ -37515,7 +37727,7 @@ import { spawn } from "child_process";
 import { createRequire } from "module";
 import { resolve as resolve6, dirname as dirname3, join as join10 } from "path";
 import { fileURLToPath } from "url";
-import { existsSync as existsSync11, realpathSync } from "fs";
+import { existsSync as existsSync12, realpathSync } from "fs";
 import { homedir as homedir5 } from "os";
 
 // src/services/perf/endpoint-resolver.ts
@@ -37579,7 +37791,7 @@ function collectTuiCandidates() {
   return [...new Set(candidates)];
 }
 function pushPackageRootEntries(candidates, root) {
-  if (!root || !existsSync11(root))
+  if (!root || !existsSync12(root))
     return;
   candidates.push(join10(root, "dist", "main.js"), join10(root, "src", "main.tsx"), join10(root, "bin", "hoox-tui.js"), join10(root, "src", "main.ts"));
 }
@@ -37607,7 +37819,7 @@ function pushFromWhich(candidates, binName) {
 function resolveTUIEntry() {
   const candidates = collectTuiCandidates();
   for (const path6 of candidates) {
-    if (existsSync11(path6))
+    if (existsSync12(path6))
       return path6;
   }
   const runtime = resolveHooxRuntimeRoot();
@@ -37826,13 +38038,13 @@ import { homedir as homedir6 } from "os";
 
 // src/services/runtime/runtime-service.ts
 init_src();
-import { existsSync as existsSync12, lstatSync as lstatSync2, readlinkSync, rmSync } from "fs";
+import { existsSync as existsSync13, lstatSync as lstatSync2, readlinkSync, rmSync } from "fs";
 import { mkdir } from "fs/promises";
 import { join as join11 } from "path";
 var DEFAULT_HOOX_RUNTIME_REPO = "https://github.com/hoox-sh/hoox.git";
 function firstExisting(paths) {
   for (const p3 of paths) {
-    if (existsSync12(p3))
+    if (existsSync13(p3))
       return p3;
   }
   return null;
@@ -37846,7 +38058,7 @@ function getRuntimeStatus(cwd = process.cwd()) {
     repoPath,
     runtime,
     tuiEntry,
-    repoPresent: existsSync12(repoPath),
+    repoPresent: existsSync13(repoPath),
     isSetupRoot: isHooxSetupRoot(repoPath)
   };
 }
@@ -37868,7 +38080,7 @@ function isBrokenSymlink(path6) {
   try {
     if (!lstatSync2(path6).isSymbolicLink())
       return false;
-    return !existsSync12(path6);
+    return !existsSync13(path6);
   } catch {
     return false;
   }
@@ -37881,7 +38093,7 @@ async function ensureGlobalRuntime(options = {}) {
   await mkdir(hooxHome, { recursive: true });
   let cloned = false;
   if (!isHooxSetupRoot(repoPath)) {
-    if (existsSync12(repoPath) || isBrokenSymlink(repoPath)) {
+    if (existsSync13(repoPath) || isBrokenSymlink(repoPath)) {
       if (isBrokenSymlink(repoPath)) {
         let target = "";
         try {
@@ -37913,8 +38125,8 @@ ${clone2.stderr || clone2.stdout}`.trim());
   if (!options.skipInstall) {
     const nodeModules = join11(repoPath, "node_modules");
     const tuiPkg = join11(repoPath, "packages", "tui", "package.json");
-    const needsInstall = !existsSync12(nodeModules) || existsSync12(tuiPkg) && !existsSync12(join11(repoPath, "packages", "tui", "node_modules")) && !existsSync12(join11(nodeModules, "@opentui"));
-    if (cloned || needsInstall || !existsSync12(nodeModules)) {
+    const needsInstall = !existsSync13(nodeModules) || existsSync13(tuiPkg) && !existsSync13(join11(repoPath, "packages", "tui", "node_modules")) && !existsSync13(join11(nodeModules, "@opentui"));
+    if (cloned || needsInstall || !existsSync13(nodeModules)) {
       log2(`Running bun install in ${repoPath}`);
       const install = await runCommand(["bun", "install"], repoPath);
       if (!install.ok) {
@@ -39070,7 +39282,7 @@ EXAMPLES:
 }
 // src/commands/pyne/pyne-command.ts
 init_config2();
-import { existsSync as existsSync13, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync8 } from "fs";
 import { resolve as resolve7 } from "path";
 init_errors4();
 var DEFAULT_TIMEOUT_MS = 30000;
@@ -39079,7 +39291,7 @@ function getPyneWorkerDir() {
 }
 function requirePyneDir() {
   const dir = getPyneWorkerDir();
-  if (!existsSync13(dir)) {
+  if (!existsSync14(dir)) {
     throw new CLIError(`pyne-worker directory not found: ${dir}
 ` + `  Clone it with: hoox clone pyne-worker
 ` + `  Or: git submodule update --init workers/pyne-worker`, 1 /* ERROR */);
@@ -39094,7 +39306,7 @@ function loadDevVars(workerDir) {
   ];
   for (const filePath of candidates) {
     try {
-      if (!existsSync13(filePath))
+      if (!existsSync14(filePath))
         continue;
       const content = readFileSync8(filePath, "utf-8");
       for (const line of content.split(`
@@ -39312,7 +39524,7 @@ EXAMPLES:
       body.script = await new Response(Bun.stdin).text();
     } else {
       const abs = resolve7(process.cwd(), scriptPath);
-      if (!existsSync13(abs)) {
+      if (!existsSync14(abs)) {
         throw new CLIError(`Script not found: ${abs}`, 1 /* ERROR */);
       }
       body.script = readFileSync8(abs, "utf-8");
@@ -39363,7 +39575,7 @@ EXAMPLES:
       throw new CLIError("API key required for authenticated endpoints", 2 /* INVALID_USAGE */);
     }
     const abs = resolve7(process.cwd(), scriptPath);
-    if (!existsSync13(abs)) {
+    if (!existsSync14(abs)) {
       throw new CLIError(`Script not found: ${abs}`, 1 /* ERROR */);
     }
     const script = readFileSync8(abs, "utf-8");
@@ -39471,7 +39683,7 @@ Pass script flags after -- :
 Required before wrangler deploy after pulling new PYNE APIs.`).action(withErrorHandling(async () => {
     const dir = requirePyneDir();
     const script = resolve7(dir, "scripts/sync_vendor.sh");
-    if (!existsSync13(script)) {
+    if (!existsSync14(script)) {
       throw new CLIError(`sync_vendor.sh not found at ${script}`, 1 /* ERROR */);
     }
     process.exitCode = await spawnInPyneDir(["bash", script], dir);
@@ -39480,7 +39692,7 @@ Required before wrangler deploy after pulling new PYNE APIs.`).action(withErrorH
     const dir = requirePyneDir();
     if (!opts.skipSync) {
       const script = resolve7(dir, "scripts/sync_vendor.sh");
-      if (existsSync13(script)) {
+      if (existsSync14(script)) {
         const code = await spawnInPyneDir(["bash", script], dir);
         if (code !== 0) {
           process.exitCode = code;
@@ -41029,7 +41241,7 @@ function registerCompletionCommand(program2) {
 // src/ui/banner.ts
 init_ansis();
 init_theme();
-import { existsSync as existsSync14, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync9 } from "fs";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { dirname as dirname4, join as join13 } from "path";
 var ORANGE = ansis_default.hex("#ff7f2a");
@@ -41045,7 +41257,7 @@ function findCliVersion() {
   let dir = dirname4(fileURLToPath2(import.meta.url));
   for (let i2 = 0;i2 < 5; i2++) {
     const pkgPath = join13(dir, "package.json");
-    if (existsSync14(pkgPath)) {
+    if (existsSync15(pkgPath)) {
       try {
         const pkg = JSON.parse(readFileSync9(pkgPath, "utf-8"));
         if (pkg.name === PKG_NAME)
@@ -41684,6 +41896,13 @@ Hoox CLI \u2014 Cloudflare Workers Platform
   styleCommandText: (str) => theme.bold(str),
   styleOptionText: (str) => str,
   styleDescriptionText: (str) => theme.dim(str)
+}).configureOutput({
+  outputError: (str, write) => {
+    if (/^error: unknown command/i.test(str) || /^error: unknown option/i.test(str) || /^error: missing required argument/i.test(str) || /^error: required option/i.test(str) || /^\(Did you mean /i.test(str)) {
+      return;
+    }
+    write(str);
+  }
 });
 program2.option("--json", "Output in JSON format");
 program2.option("--quiet", "Minimal output");
@@ -41698,10 +41917,16 @@ program2.hook("preAction", async () => {
     return;
   if (process.env.BUN_TEST === "1")
     return;
+  if (process.argv.includes("--json"))
+    return;
   try {
     const { UpdateService: UpdateService2 } = await Promise.resolve().then(() => (init_update(), exports_update));
     const service = new UpdateService2;
-    await service.checkAndPromptUpdate({ yes: true, silent: true });
+    const autoUpdate = process.env.HOOX_AUTO_UPDATE_WRANGLER === "1";
+    await service.checkAndPromptUpdate({
+      yes: autoUpdate,
+      silent: true
+    });
   } catch {}
 });
 program2.hook("postAction", (thisCmd) => {
@@ -41713,54 +41938,67 @@ program2.hook("postAction", (thisCmd) => {
   const durationMs = Date.now() - startedAt;
   const path6 = getCmdPath(thisCmd);
   const suggestion = suggestNextCommand(path6);
-  formatCompletion("Done", { durationMs, suggestion });
+  const g2 = program2.opts();
+  formatCompletion("Done", {
+    durationMs,
+    suggestion,
+    json: Boolean(g2.json),
+    quiet: Boolean(g2.quiet),
+    noColor: g2.color === false || Boolean(process.env.NO_COLOR)
+  });
 });
 program2.exitOverride((err) => {
   const globalOpts = program2.opts();
   const errFmtOpts = {
     json: Boolean(globalOpts.json),
     quiet: Boolean(globalOpts.quiet),
-    noColor: Boolean(globalOpts.noColor)
+    noColor: globalOpts.color === false || Boolean(process.env.NO_COLOR)
   };
   if (err.code === "commander.helpDisplayed" || err.code === "commander.version") {
     process.exitCode = 0 /* SUCCESS */;
-    return;
+    throw err;
   }
-  if (err.code === "commander.missingArgument" || err.message === "(outputHelp)" || err.message?.includes("outputHelp")) {
+  if ((err.message === "(outputHelp)" || err.message?.includes("outputHelp")) && err.code !== "commander.missingArgument") {
     process.exitCode = 0 /* SUCCESS */;
-    return;
+    throw err;
   }
   if (err.code === "commander.unknownCommand") {
     const match = err.message.match(/'([^']+)'/);
     const badArg = match?.[1] ?? "";
     const suggestion = suggestForCommand(program2, badArg);
-    formatError2(new CLIError(err.message, 2 /* INVALID_USAGE */, undefined, false), suggestion ? { ...errFmtOpts, suggestions: [suggestion] } : errFmtOpts);
+    const cleanMsg = err.message.replace(/\n?\(Did you mean[^)]*\)\s*/gi, "").trim();
+    formatError2(new CLIError(cleanMsg, 2 /* INVALID_USAGE */, undefined, false), suggestion ? { ...errFmtOpts, suggestions: [suggestion] } : errFmtOpts);
     process.exitCode = 2 /* INVALID_USAGE */;
-    return;
+    throw err;
   }
   if (err.code === "commander.unknownOption") {
     formatError2(new CLIError(err.message, 2 /* INVALID_USAGE */, undefined, false), errFmtOpts);
     process.exitCode = 2 /* INVALID_USAGE */;
-    return;
+    throw err;
   }
-  if (err.code === "commander.missingMandatoryOptionValue" || err.code === "commander.missingArgument") {
+  if (err.code === "commander.missingArgument" || err.code === "commander.missingMandatoryOptionValue") {
     formatError2(new CLIError(err.message, 2 /* INVALID_USAGE */, undefined, false), errFmtOpts);
     process.exitCode = 2 /* INVALID_USAGE */;
-    return;
+    throw err;
   }
   if (err instanceof CLIError) {
     formatError2(err, errFmtOpts);
     process.exitCode = err.code;
-    return;
+    throw err;
   }
   formatError2(new CLIError(err.message, 1 /* ERROR */, undefined, false), errFmtOpts);
   process.exitCode = 1 /* ERROR */;
+  throw err;
 });
 process.on("uncaughtException", (err) => {
+  if (process.exitCode !== undefined && process.exitCode !== 0)
+    return;
   formatError2(err instanceof CLIError ? err : new CLIError(`Uncaught exception: ${err.message}`, 1 /* ERROR */, err.stack, false));
   process.exitCode = 1 /* ERROR */;
 });
 process.on("unhandledRejection", (reason) => {
+  if (process.exitCode !== undefined && process.exitCode !== 0)
+    return;
   const err = reason instanceof Error ? reason : new Error(`Unhandled rejection: ${toError(reason)}`);
   formatError2(new CLIError(err.message, 1 /* ERROR */, err.stack, false));
   process.exitCode = 1 /* ERROR */;
@@ -41804,17 +42042,31 @@ async function main() {
       const configFile = Bun.file("wrangler.jsonc");
       const hasConfig = await configFile.exists();
       const wizardStateFile = Bun.file(WIZARD_STATE_PATH);
-      const hasWizardState = await wizardStateFile.exists();
+      const hasWizardState = await wizardStateFile.exists() && (await wizardStateFile.text()).trim().length > 0;
       if (!hasConfig) {
         const args = hasWizardState ? ["onboard", "--resume"] : ["onboard"];
         await program2.parseAsync(args, { from: "user" });
         return;
       }
-      if (hasWizardState) {
-        await Bun.write(WIZARD_STATE_PATH, "");
+      if (await wizardStateFile.exists()) {
+        try {
+          const { unlinkSync } = await import("fs");
+          unlinkSync(WIZARD_STATE_PATH);
+        } catch {
+          await Bun.write(WIZARD_STATE_PATH, "");
+        }
       }
       await runInteractiveTUI(program2);
     }
+  } catch (err) {
+    if (process.exitCode === undefined) {
+      const message = err instanceof Error ? err.message : `Unhandled error: ${String(err)}`;
+      const isCommander = err instanceof Error && "code" in err && typeof err.code === "string" && String(err.code).startsWith("commander.");
+      if (!isCommander) {
+        formatError2(new CLIError(message, 1 /* ERROR */, undefined, false));
+      }
+      process.exitCode = 1 /* ERROR */;
+    }
   } finally {
     if (typeof process.exit === "function" && process.exitCode !== undefined) {
       process.exit(process.exitCode);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hoox-sh/hoox-cli",
-  "version": "0.11.2",
+  "version": "0.11.4",
   "description": "Hoox CLI — manage Cloudflare Workers, infrastructure, secrets, and deployments (@hoox-sh/hoox-cli)",
   "type": "module",
   "bin": {