@hoox-sh/hoox-cli 0.11.3 → 0.11.4

package/dist/index.js

@@ -25548,6 +25548,33 @@ var init_cloudflare_service = __esm(() => {
   init_wrangler_output();
 });
 
+// src/utils/fs-secure.ts
+var exports_fs_secure = {};
+__export(exports_fs_secure, {
+  secureSecretFile: () => secureSecretFile,
+  secureChmod: () => secureChmod,
+  ensureSecretDir: () => ensureSecretDir,
+  SECRET_FILE_MODE: () => SECRET_FILE_MODE,
+  SECRET_DIR_MODE: () => SECRET_DIR_MODE
+});
+import { chmodSync as chmodSync3, mkdirSync as mkdirSync3 } from "fs";
+function secureChmod(path4, mode) {
+  try {
+    chmodSync3(path4, mode);
+  } catch {}
+}
+function ensureSecretDir(dir) {
+  try {
+    mkdirSync3(dir, { recursive: true, mode: SECRET_DIR_MODE });
+  } catch {}
+  secureChmod(dir, SECRET_DIR_MODE);
+}
+function secureSecretFile(path4) {
+  secureChmod(path4, SECRET_FILE_MODE);
+}
+var SECRET_FILE_MODE = 384, SECRET_DIR_MODE = 448;
+var init_fs_secure = () => {};
+
 // src/services/prerequisites/prerequisites-service.ts
 class PrerequisitesService {
   MINIMUM_WRANGLER = "3.88.0";
@@ -28583,6 +28610,10 @@ function formatSuccess(message, opts) {
 function formatError2(error51, opts = {}) {
   const message = typeof error51 === "string" ? error51 : error51.message;
   const cliError = error51 instanceof CLIError ? error51 : null;
+  const write = (s) => {
+    process.stderr.write(s);
+    process.stdout.write(s);
+  };
   if (opts.json) {
     const output = {
       success: false,
@@ -28596,12 +28627,12 @@ function formatError2(error51, opts = {}) {
     if (opts.suggestions && opts.suggestions.length > 0) {
       output.suggestions = opts.suggestions;
     }
-    process.stdout.write(JSON.stringify(output) + `
+    write(JSON.stringify(output) + `
 `);
     return;
   }
   if (opts.quiet) {
-    process.stdout.write(`${message}
+    write(`${message}
 `);
     return;
   }
@@ -28611,13 +28642,13 @@ function formatError2(error51, opts = {}) {
     titleParts.push(theme.textSubtle(`[${cliError.code}]`));
   }
   titleParts.push(theme.text(message));
-  process.stdout.write(`${titleParts.join(" ")}
+  write(`${titleParts.join(" ")}
 `);
   if (cliError?.details) {
     const detailLines = cliError.details.split(`
 `).filter((l) => l.length > 0);
     for (const line of detailLines) {
-      process.stdout.write(`  ${theme.textMuted(line)}
+      write(`  ${theme.textMuted(line)}
 `);
     }
   }
@@ -28625,24 +28656,24 @@ function formatError2(error51, opts = {}) {
   const hasSuggestions = !!opts.suggestions && opts.suggestions.length > 0;
   if (hasHint || hasSuggestions) {
     if (inCard) {
-      process.stdout.write(`  ${theme.border(icons.pipe)}
+      write(`  ${theme.border(icons.pipe)}
 `);
     }
     if (hasHint) {
-      process.stdout.write(`  ${inCard ? theme.border(icons.pipe) : " "}  ${theme.dim("\u21B3 hint:")} ${theme.value(cliError.hint)}
+      write(`  ${inCard ? theme.border(icons.pipe) : " "}  ${theme.dim("\u21B3 hint:")} ${theme.value(cliError.hint)}
 `);
     }
     if (hasSuggestions) {
       const sugText = opts.suggestions.map((s) => `'${s}'`).join(", ");
-      process.stdout.write(`  ${inCard ? theme.border(icons.pipe) : " "}  ${theme.dim("did you mean:")} ${theme.accent(sugText)} ${theme.dim("?")}
+      write(`  ${inCard ? theme.border(icons.pipe) : " "}  ${theme.dim("did you mean:")} ${theme.accent(sugText)} ${theme.dim("?")}
 `);
     }
     if (inCard) {
-      process.stdout.write(`  ${theme.border(icons.pipe)}
+      write(`  ${theme.border(icons.pipe)}
 `);
     }
   } else if (inCard && !cliError?.details) {
-    process.stdout.write(`  ${theme.border(icons.pipe)}
+    write(`  ${theme.border(icons.pipe)}
 `);
   }
 }
@@ -29189,6 +29220,8 @@ async function createDevVars(config2, secrets, opts) {
     const dir = `${worker.path}`;
     try {
       await Bun.write(filePath, content);
+      const { secureSecretFile: secureSecretFile2 } = await Promise.resolve().then(() => (init_fs_secure(), exports_fs_secure));
+      secureSecretFile2(filePath);
       if (!opts?.quiet) {
         formatSuccess(`Created ${filePath}`, opts);
       }
@@ -29196,6 +29229,8 @@ async function createDevVars(config2, secrets, opts) {
       const { mkdir } = await import("fs/promises");
       await mkdir(dir, { recursive: true });
       await Bun.write(filePath, content);
+      const { secureSecretFile: secureSecretFile2 } = await Promise.resolve().then(() => (init_fs_secure(), exports_fs_secure));
+      secureSecretFile2(filePath);
       if (!opts?.quiet) {
         formatSuccess(`Created ${filePath}`, opts);
       }
@@ -29586,9 +29621,10 @@ async function runInitCommand(options, globalOpts, isNonInteractive) {
 }
 // src/services/setup/setup-service.ts
 import {
-  chmodSync as chmodSync3,
+  chmodSync as chmodSync4,
   existsSync as existsSync7,
-  mkdirSync as mkdirSync3,
+  mkdirSync as mkdirSync4,
+  readdirSync as readdirSync3,
   readFileSync as readFileSync3,
   statSync as statSync2,
   writeFileSync as writeFileSync2
@@ -29663,9 +29699,38 @@ function parseEnvFile(text2) {
 }
 function safeChmod(path4, mode) {
   try {
-    chmodSync3(path4, mode);
+    chmodSync4(path4, mode);
   } catch {}
 }
+function loadExistingKeysFromDisk() {
+  const setupEnv = join7(KEYS_DIR, "setup.env");
+  if (!existsSync7(setupEnv))
+    return null;
+  let text2;
+  try {
+    text2 = readFileSync3(setupEnv, "utf-8");
+  } catch {
+    return null;
+  }
+  const map2 = parseEnvFile(text2);
+  const required2 = [
+    "INTERNAL_KEY_BINDING",
+    "AGENT_INTERNAL_KEY",
+    "SESSION_SECRET",
+    "WEBHOOK_API_KEY_BINDING",
+    "TELEGRAM_INTERNAL_KEY_BINDING",
+    "TRADE_INTERNAL_KEY",
+    "API_SERVICE_KEY_BINDING"
+  ];
+  const keys = {};
+  for (const name of required2) {
+    const v = map2.get(name);
+    if (!v)
+      return null;
+    keys[name] = v;
+  }
+  return keys;
+}
 
 class SetupService {
   onProgress;
@@ -29676,7 +29741,20 @@ class SetupService {
   }
   async generateKeys(skip = false) {
     if (skip) {
-      this.onProgress({ type: "info", step: "keys", message: "Skipped" });
+      const existing = loadExistingKeysFromDisk();
+      if (existing) {
+        this.onProgress({
+          type: "info",
+          step: "keys",
+          message: "Using existing keys from .keys/setup.env (--skip-keys)"
+        });
+        return existing;
+      }
+      this.onProgress({
+        type: "info",
+        step: "keys",
+        message: "Skipped (no existing .keys/setup.env)"
+      });
       return null;
     }
     this.onProgress({
@@ -29695,9 +29773,9 @@ class SetupService {
       API_SERVICE_KEY_BINDING: internalKey
     };
     if (!existsSync7(KEYS_DIR)) {
-      mkdirSync3(KEYS_DIR, { recursive: true });
+      mkdirSync4(KEYS_DIR, { recursive: true });
     } else if (!statSync2(KEYS_DIR).isDirectory()) {
-      mkdirSync3(KEYS_DIR, { recursive: true });
+      mkdirSync4(KEYS_DIR, { recursive: true });
     }
     safeChmod(KEYS_DIR, 448);
     const setupEnvPath = join7(KEYS_DIR, "setup.env");
@@ -30071,36 +30149,38 @@ class SetupService {
     ];
     return markers.some((p3) => existsSync7(p3));
   }
-  async ensureWorkers() {
-    this.onProgress({
-      type: "step-start",
-      step: "workers",
-      message: "Checking worker submodules..."
-    });
+  listMissingWorkers() {
     const workerDirs = [
       ...ALL_WORKERS,
       ...TOOLING_WORKERS,
       "dashboard"
     ];
     const missing = [];
-    const gitmodulesPath = ".gitmodules";
     for (const name of workerDirs) {
       const dir = `workers/${workerFsDir(name)}`;
       try {
         const gitEntry = readFileSync3(join7(dir, ".git"), "utf-8").trim();
         if (gitEntry.startsWith("gitdir:") || gitEntry.length > 0) {
-          if (!this.isWorkerTreePopulated(dir, name)) {
+          if (!this.isWorkerTreePopulated(dir, name))
             missing.push(name);
-          }
         } else if (!this.isWorkerTreePopulated(dir, name)) {
           missing.push(name);
         }
       } catch {
-        if (!this.isWorkerTreePopulated(dir, name)) {
+        if (!this.isWorkerTreePopulated(dir, name))
           missing.push(name);
-        }
       }
     }
+    return missing;
+  }
+  async ensureWorkers() {
+    this.onProgress({
+      type: "step-start",
+      step: "workers",
+      message: "Checking worker submodules..."
+    });
+    const missing = this.listMissingWorkers();
+    const gitmodulesPath = ".gitmodules";
     if (missing.length === 0) {
       this.onProgress({
         type: "step-complete",
@@ -30155,14 +30235,17 @@ class SetupService {
     ];
     const toBuild = [];
     for (const pkg of packages) {
+      let built = false;
       try {
-        const jsFiles = readFileSync3(pkg.dist, "utf-8");
-        if (!jsFiles.includes(".js")) {
-          toBuild.push(pkg.name);
+        if (existsSync7(pkg.dist) && statSync2(pkg.dist).isDirectory()) {
+          const entries = readdirSync3(pkg.dist);
+          built = entries.some((e) => e.endsWith(".js"));
         }
       } catch {
-        toBuild.push(pkg.name);
+        built = false;
       }
+      if (!built)
+        toBuild.push(pkg.name);
     }
     if (toBuild.length === 0) {
       this.onProgress({
@@ -30479,13 +30562,21 @@ class SetupService {
       results.success = false;
       return results;
     }
-    const cloned = await this.ensureWorkers();
-    if (cloned.length > 0) {
+    const missingAfterClone = await this.ensureWorkers();
+    const stillMissing = this.listMissingWorkers();
+    if (stillMissing.length > 0) {
+      steps.push({
+        step: "workers",
+        success: false,
+        message: `Missing worker trees: ${stillMissing.join(", ")}. Run: git submodule update --init --recursive`
+      });
       this.onProgress({
-        type: "warn",
+        type: "step-error",
         step: "workers",
-        message: "Run `hoox setup` again after clone completes."
+        message: missingAfterClone.length > 0 ? "Workers still missing after clone attempt \u2014 aborting setup." : "Workers missing \u2014 aborting setup."
       });
+      results.success = false;
+      return results;
     }
     const built = await this.ensurePackages();
     if (!built) {
@@ -30494,6 +30585,8 @@ class SetupService {
         success: false,
         message: "Package build failed \u2014 check dependencies"
       });
+      results.success = false;
+      return results;
     }
     this.fixWranglerConfigs();
     const keys = await this.generateKeys(options.skipKeys);
@@ -30644,6 +30737,14 @@ async function runOnboard(options, fmt) {
   if (process.exitCode && process.exitCode !== 0) {
     return;
   }
+  const configReady = await Bun.file("wrangler.jsonc").exists();
+  if (!configReady) {
+    if (!quiet) {
+      formatError2(new CLIError("Onboard stopped: workspace config was not written (init cancelled or incomplete).", 1 /* ERROR */, undefined, false, "Re-run `hoox onboard` or `hoox init` to finish configuration, then `hoox setup`."), fmt);
+    }
+    process.exitCode = 1 /* ERROR */;
+    return;
+  }
   if (options.token) {
     process.env.CLOUDFLARE_API_TOKEN = options.token;
   }
@@ -33130,6 +33231,8 @@ async function handleInit(opts) {
     await Bun.write(tmpPath, envContent);
     await Bun.write(".env.local", envContent);
     await Bun.file(tmpPath).delete().catch(() => {});
+    const { secureSecretFile: secureSecretFile2 } = await Promise.resolve().then(() => (init_fs_secure(), exports_fs_secure));
+    secureSecretFile2(".env.local");
     if (!opts.quiet)
       formatSuccess(".env.local written", opts);
     log.step("Writing .dev.vars files...");
@@ -33144,6 +33247,8 @@ async function handleInit(opts) {
       ].join(`
 `);
       await Bun.write(`${workerPath}/.dev.vars`, content);
+      const { secureSecretFile: chmodDev } = await Promise.resolve().then(() => (init_fs_secure(), exports_fs_secure));
+      chmodDev(`${workerPath}/.dev.vars`);
       if (!opts.quiet)
         formatSuccess(`Created ${workerPath}/.dev.vars`, opts);
     }
@@ -33220,6 +33325,8 @@ async function handleGenerateDevVars(opts) {
     ].join(`
 `);
     await Bun.write(`${workerPath}/.dev.vars`, content);
+    const { secureSecretFile: secureSecretFile2 } = await Promise.resolve().then(() => (init_fs_secure(), exports_fs_secure));
+    secureSecretFile2(`${workerPath}/.dev.vars`);
     count++;
   }
   formatSuccess(`Generated .dev.vars for ${count} worker(s)`, opts);
@@ -33467,7 +33574,7 @@ class SecretsService {
     const path5 = configPath ?? "wrangler.jsonc";
     const file2 = Bun.file(path5);
     if (!await file2.exists()) {
-      throw new Error(`Config file not found: ${path5}`);
+      throw new Error(`Config file not found: ${path5}. Run 'hoox onboard' (or 'hoox init') to create one.`);
     }
     const text2 = await file2.text();
     const config2 = parse6(text2);
@@ -33550,6 +33657,8 @@ class SecretsService {
     const devVarsPath = `${worker.path}/.dev.vars`;
     try {
       await Bun.write(devVarsPath, content);
+      const { secureSecretFile: secureSecretFile2 } = await Promise.resolve().then(() => (init_fs_secure(), exports_fs_secure));
+      secureSecretFile2(devVarsPath);
       return { ok: true, value: devVarsPath };
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
@@ -33797,6 +33906,8 @@ async function updateDevVars(filePath, key, value) {
     await Bun.write(filePath, `${key}=${value}
 `);
   }
+  const { secureSecretFile: secureSecretFile2 } = await Promise.resolve().then(() => (init_fs_secure(), exports_fs_secure));
+  secureSecretFile2(filePath);
 }
 function registerSecretsSubcommands(secretsCmd, service = "config") {
   secretsCmd.command("list [worker]").summary("List secrets for all workers or a specific worker").description(`List the secrets declared in wrangler.jsonc for workers.
@@ -33870,7 +33981,7 @@ EXAMPLES:
     const svc = await SecretsService.create();
     const declared = svc.listSecrets(workerName);
     if (!declared.includes(secretName) && declared.length > 0) {
-      throw new CLIError(`Secret "${secretName}" is not declared for worker "${workerName}". ` + `Declared secrets: ${declared.join(", ")}`, 2 /* INVALID_USAGE */);
+      throw new CLIError(`Secret "${secretName}" is not declared for worker "${workerName}". Declared secrets: ${declared.join(", ")}`, 2 /* INVALID_USAGE */);
     }
     const value = await promptSecret(`Enter value for "${secretName}"`);
     if (!value) {
@@ -34053,7 +34164,8 @@ EXAMPLES:
 }
 
 // src/commands/config/keys-subcommands.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync4 } from "fs";
+import { existsSync as existsSync9 } from "fs";
+init_fs_secure();
 init_theme();
 function generateKey(bytes = 32) {
   const buf = new Uint8Array(bytes);
@@ -34079,9 +34191,7 @@ EXAMPLES:
   hoox config keys generate`).action(withErrorHandling(async (_2, cmd) => {
     const opts = getFormatOptions(cmd);
     const keysDir = ".keys";
-    if (!existsSync9(keysDir)) {
-      mkdirSync4(keysDir, { recursive: true });
-    }
+    ensureSecretDir(keysDir);
     const meshKey = generateKey();
     const keys = {
       INTERNAL_KEY_BINDING: meshKey,
@@ -34096,7 +34206,13 @@ EXAMPLES:
       const filePath = `${keysDir}/${name.toLowerCase()}.env`;
       await Bun.write(filePath, `${name}=${value}
 `);
+      secureSecretFile(filePath);
     }
+    await Bun.write(`${keysDir}/setup.env`, `# Generated by hoox keys generate
+` + Object.entries(keys).map(([k, v]) => `${k}=${v}`).join(`
+`) + `
+`);
+    secureSecretFile(`${keysDir}/setup.env`);
     formatSuccess(`Generated ${Object.keys(keys).length} keys in ${keysDir}/`, opts);
     if (!opts.quiet && !opts.json) {
       process.stdout.write(`${theme.warning("!")}  Keep these keys secret. Add ${keysDir}/ to .gitignore.
@@ -41850,7 +41966,8 @@ program2.exitOverride((err) => {
     const match = err.message.match(/'([^']+)'/);
     const badArg = match?.[1] ?? "";
     const suggestion = suggestForCommand(program2, badArg);
-    formatError2(new CLIError(err.message, 2 /* INVALID_USAGE */, undefined, false), suggestion ? { ...errFmtOpts, suggestions: [suggestion] } : errFmtOpts);
+    const cleanMsg = err.message.replace(/\n?\(Did you mean[^)]*\)\s*/gi, "").trim();
+    formatError2(new CLIError(cleanMsg, 2 /* INVALID_USAGE */, undefined, false), suggestion ? { ...errFmtOpts, suggestions: [suggestion] } : errFmtOpts);
     process.exitCode = 2 /* INVALID_USAGE */;
     throw err;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hoox-sh/hoox-cli",
-  "version": "0.11.3",
+  "version": "0.11.4",
   "description": "Hoox CLI — manage Cloudflare Workers, infrastructure, secrets, and deployments (@hoox-sh/hoox-cli)",
   "type": "module",
   "bin": {