@hoox-sh/hoox-cli 0.11.4 → 0.11.6

package/README.md

@@ -6,10 +6,11 @@
 
 > **Runtime requirement:** Bun ≥ 1.2. The bin shebang and bundle target are Bun-only; `npm install -g` will install the package but the CLI will not run under Node.js.
 
-**v0.11.x** — operator security plane (`doctor --security`, `tunnel check`, transport profile Bearer + Access), PYNE edge ops (`hoox pyne`), schema validate/generate, and wrangler **4.x**. **v0.10.x** hardened fail-closed remote TUI / management `/v1/*`. **v0.9.x** shipped hop-level `perf fastpath` observability.
+**v0.11.x** — monorepo auto-detect + remember (run `hx` from any directory), Linear Rail banner, quieter secrets check, operator security plane (`doctor --security`, `tunnel check`), PYNE (`hoox pyne`), schema validate/generate, wrangler **4.x**.
 
 ## Features
 
+- **Monorepo auto-detect & remember**: On every start the CLI finds the hoox monorepo (`HOOX_REPO` → walk up from cwd → `~/.hoox/config/monorepo.json` → `~/.hoox/repo`), saves the path, and `chdir`s into it so `hx` / `hoox` work from `~/Videos` or any other folder after you have run once from the monorepo.
 - **One-shot Onboarding** (`hoox onboard`): Full bootstrap from a fresh clone — collects credentials, configures workers, provisions D1/KV, generates keys, pushes secrets, deploys dashboard. The recommended entry point for new users.
 - **Config & Setup Wizards** (`hoox init`, `hoox setup`): Split into two steps — `init` writes `wrangler.jsonc` and collects integration secrets; `setup` generates keys, applies D1 schema, and pushes secrets to Cloudflare. Run separately when you need fine-grained control.
 - **Infrastructure as Code**: Manage D1, KV, R2, Queues, Vectorize, and Analytics via `hoox infra`.
@@ -56,6 +57,10 @@ bun run build   # produces dist/index.js — required for `hoox` after global in
 ## Quick Start
 
 ```bash
+# From the monorepo root (first time — path is remembered)
+cd /path/to/hoox
+hoox doctor                    # shows Remembered + Runtime root
+
 # One-shot onboarding (collects credentials, provisions, deploys)
 hoox onboard
 
@@ -70,8 +75,42 @@ hoox check health
 # Deploy to Cloudflare
 hoox deploy all --auto
 
-# Measure fast-path latency
-hoox perf fastpath run --n 50
+# Later: works from any directory (uses remembered monorepo)
+cd ~/Videos
+hx check health
+hx doctor                      # Source: remembered
+```
+
+## Monorepo resolution (any cwd)
+
+Resolution order at CLI startup:
+
+1. **`HOOX_REPO`** — absolute path override (highest priority)
+2. **Walk up from cwd** — discovers a local checkout (`packages/cli` + repo markers)
+3. **Remembered path** — `~/.hoox/config/monorepo.json` (written when discovered via cwd/env)
+4. **Global clone** — `~/.hoox/repo` (create with `hoox doctor --fix-runtime`)
+
+When a root is found, the CLI:
+
+- refreshes the remembered path (when source is `cwd` / `env` / `remembered`)
+- sets session `HOOX_REPO` for child processes
+- `chdir`s into the monorepo so relative paths (`wrangler.jsonc`, `workers/`, …) work
+
+Markers for a valid monorepo: `packages/cli/package.json` **plus** one of `wrangler.jsonc`, `wrangler.jsonc.example`, `workers/`, or `.gitmodules`.
+
+| Env / path                     | Purpose                                                |
+| ------------------------------ | ------------------------------------------------------ |
+| `HOOX_REPO`                    | Force monorepo root                                    |
+| `HOOX_HOME`                    | Override `~/.hoox` (default home for config/data/repo) |
+| `HOOX_CLI_SILENT=1`            | Suppress “using monorepo at …” notice                  |
+| `~/.hoox/config/monorepo.json` | Persisted root `{ "root", "updatedAt" }`               |
+
+```bash
+# Inspect layout
+hoox doctor
+# Remembered   /home/you/Git/hoox
+# Runtime root /home/you/Git/hoox
+# Source       remembered
 ```
 
 ## Available Commands
@@ -358,8 +397,9 @@ hoox perf fastpath report --from 1h
 ### Operator Security & Private Ingress
 
 ```bash
-# Paths, TUI entry, and runtime layout
+# Paths, TUI entry, remembered monorepo, runtime layout
 hoox doctor
+hoox doctor --fix-runtime   # clone monorepo into ~/.hoox/repo if needed
 
 # Hygiene + optional management /v1/health probes
 hoox doctor --security
@@ -504,8 +544,9 @@ packages/cli/
 │   │   ├── perf/             # Percentile, probe-sender, observability-reader
 │   │   ├── prerequisites/    # Tool version checks
 │   │   ├── runtime/          # Global ~/.hoox layout
+│   │   ├── workspace/        # Monorepo detect, remember, chdir
 │   │   └── secrets/          # Secret management
-│   ├── ui/                   # Interactive menu (clack)
+│   ├── ui/                   # Interactive menu + Linear Rail banner
 │   └── utils/                # Errors, formatters, theme
 ├── bin/
 │   └── hoox.js              # CLI binary entry point

package/dist/index.js

@@ -16200,7 +16200,13 @@ var init_sse = __esm(() => {
 });
 
 // ../shared/src/path-utils.ts
-import { existsSync as existsSync2 } from "fs";
+import {
+  existsSync as existsSync2,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync2,
+  writeFileSync as writeFileSync2,
+  chmodSync as chmodSync2
+} from "fs";
 import { homedir as homedir2 } from "os";
 import { dirname, join as join2, resolve } from "path";
 function createHooxPath(path2) {
@@ -16226,7 +16232,55 @@ function isHooxSetupRoot(dir) {
     return false;
   try {
     const root = resolve(dir);
-    return existsSync2(join2(root, "wrangler.jsonc")) && existsSync2(join2(root, "packages", "cli", "package.json"));
+    if (!existsSync2(join2(root, "packages", "cli", "package.json"))) {
+      return false;
+    }
+    return existsSync2(join2(root, "wrangler.jsonc")) || existsSync2(join2(root, "wrangler.jsonc.example")) || existsSync2(join2(root, "workers")) || existsSync2(join2(root, ".gitmodules"));
+  } catch {
+    return false;
+  }
+}
+function getRememberedMonorepoPath() {
+  return resolveHooxPath("config/monorepo.json");
+}
+function getRememberedMonorepoRoot() {
+  try {
+    const path2 = getRememberedMonorepoPath();
+    if (!existsSync2(path2))
+      return null;
+    const raw = readFileSync2(path2, "utf-8");
+    const data = JSON.parse(raw);
+    if (!data.root || typeof data.root !== "string")
+      return null;
+    const resolved = resolve(data.root);
+    return isHooxSetupRoot(resolved) ? resolved : null;
+  } catch {
+    return null;
+  }
+}
+function rememberMonorepoRoot(root) {
+  try {
+    const resolved = resolve(root);
+    if (!isHooxSetupRoot(resolved))
+      return false;
+    const configDir = getHooxConfigDir();
+    mkdirSync2(configDir, { recursive: true, mode: 448 });
+    try {
+      chmodSync2(configDir, 448);
+    } catch {}
+    const payload = {
+      root: resolved,
+      updatedAt: new Date().toISOString()
+    };
+    const path2 = getRememberedMonorepoPath();
+    writeFileSync2(path2, JSON.stringify(payload, null, 2) + `
+`, {
+      mode: 384
+    });
+    try {
+      chmodSync2(path2, 384);
+    } catch {}
+    return true;
   } catch {
     return false;
   }
@@ -16246,6 +16300,7 @@ function resolveHooxRuntimeRoot(options) {
   const env = options?.env ?? process.env;
   const cwd = resolve(options?.cwd ?? process.cwd());
   const globalRepo = getHooxRepoPath();
+  const remembered = options?.skipRemembered ? null : getRememberedMonorepoRoot();
   const envRepo = env.HOOX_REPO?.trim();
   if (envRepo) {
     const resolved = resolve(envRepo);
@@ -16256,6 +16311,7 @@ function resolveHooxRuntimeRoot(options) {
         checked: {
           env: resolved,
           cwd: findHooxSetupRoot(cwd),
+          remembered,
           global: globalRepo
         }
       };
@@ -16266,6 +16322,7 @@ function resolveHooxRuntimeRoot(options) {
       checked: {
         env: resolved,
         cwd: findHooxSetupRoot(cwd),
+        remembered,
         global: globalRepo
       }
     };
@@ -16275,20 +16332,27 @@ function resolveHooxRuntimeRoot(options) {
     return {
       root: local,
       source: "cwd",
-      checked: { cwd: local, global: globalRepo }
+      checked: { cwd: local, remembered, global: globalRepo }
+    };
+  }
+  if (remembered) {
+    return {
+      root: remembered,
+      source: "remembered",
+      checked: { cwd: null, remembered, global: globalRepo }
     };
   }
   if (isHooxSetupRoot(globalRepo)) {
     return {
       root: globalRepo,
       source: "global",
-      checked: { cwd: null, global: globalRepo }
+      checked: { cwd: null, remembered: null, global: globalRepo }
     };
   }
   return {
     root: null,
     source: "none",
-    checked: { cwd: null, global: globalRepo }
+    checked: { cwd: null, remembered: null, global: globalRepo }
   };
 }
 function getTuiEntryCandidates(runtimeRoot) {
@@ -16468,7 +16532,7 @@ function formatRelativeTime2(timestampMs, nowMs) {
 }
 
 // ../shared/src/dashboard-manifest.ts
-import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync2 } from "fs";
+import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync3 } from "fs";
 import { join as join3 } from "path";
 function isDashboardSectionFlatKv(sectionId) {
   return !DASHBOARD_SECTIONS_NOT_FLAT_KV.has(sectionId);
@@ -16702,7 +16766,7 @@ function tryReadFile(path2) {
   try {
     if (!existsSync3(path2))
       return null;
-    return readFileSync2(path2, "utf-8");
+    return readFileSync3(path2, "utf-8");
   } catch {
     return null;
   }
@@ -21897,7 +21961,7 @@ var init_middleware = __esm(() => {
 });
 
 // ../shared/src/stores/config-store.ts
-import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, existsSync as existsSync4 } from "fs";
+import { chmodSync as chmodSync3, mkdirSync as mkdirSync3, existsSync as existsSync4 } from "fs";
 import { homedir as homedir3 } from "os";
 import { join as join4 } from "path";
 var bunConfigStorage, DEFAULT_SHORTCUTS, DEFAULT_LOG_FILTER, DEFAULT_NOTIFICATIONS, defaults, useConfigStore;
@@ -21921,15 +21985,15 @@ var init_config_store = __esm(() => {
     setItem: async (_name, value) => {
       const dir = join4(homedir3(), ".hoox");
       if (!existsSync4(dir)) {
-        mkdirSync2(dir, { recursive: true, mode: HOOX_DIR_MODE });
+        mkdirSync3(dir, { recursive: true, mode: HOOX_DIR_MODE });
       }
       try {
-        chmodSync2(dir, HOOX_DIR_MODE);
+        chmodSync3(dir, HOOX_DIR_MODE);
       } catch {}
       const filePath = join4(dir, "config.json");
       await Bun.write(filePath, value);
       try {
-        chmodSync2(filePath, HOOX_CONFIG_FILE_MODE);
+        chmodSync3(filePath, HOOX_CONFIG_FILE_MODE);
       } catch {}
     },
     removeItem: async (_name) => {}
@@ -22049,6 +22113,7 @@ __export(exports_src, {
   resolveHooxRuntimeRoot: () => resolveHooxRuntimeRoot,
   resolveHooxPath: () => resolveHooxPath,
   resolveDependencies: () => resolveDependencies,
+  rememberMonorepoRoot: () => rememberMonorepoRoot,
   readConfigSync: () => readConfigSync,
   readConfig: () => readConfig,
   parseDashboardManifest: () => parseDashboardManifest,
@@ -22073,6 +22138,8 @@ __export(exports_src, {
   headersToObject: () => headersToObject,
   hasOperatorClientCredentials: () => hasOperatorClientCredentials,
   getTuiEntryCandidates: () => getTuiEntryCandidates,
+  getRememberedMonorepoRoot: () => getRememberedMonorepoRoot,
+  getRememberedMonorepoPath: () => getRememberedMonorepoPath,
   getRelativeHooxPath: () => getRelativeHooxPath,
   getHooxWranglerPath: () => getHooxWranglerPath,
   getHooxStatePath: () => getHooxStatePath,
@@ -25557,15 +25624,15 @@ __export(exports_fs_secure, {
   SECRET_FILE_MODE: () => SECRET_FILE_MODE,
   SECRET_DIR_MODE: () => SECRET_DIR_MODE
 });
-import { chmodSync as chmodSync3, mkdirSync as mkdirSync3 } from "fs";
+import { chmodSync as chmodSync4, mkdirSync as mkdirSync4 } from "fs";
 function secureChmod(path4, mode) {
   try {
-    chmodSync3(path4, mode);
+    chmodSync4(path4, mode);
   } catch {}
 }
 function ensureSecretDir(dir) {
   try {
-    mkdirSync3(dir, { recursive: true, mode: SECRET_DIR_MODE });
+    mkdirSync4(dir, { recursive: true, mode: SECRET_DIR_MODE });
   } catch {}
   secureChmod(dir, SECRET_DIR_MODE);
 }
@@ -26171,7 +26238,7 @@ var exports_schema_service = {};
 __export(exports_schema_service, {
   SchemaService: () => SchemaService
 });
-import { readFileSync as readFileSync5, existsSync as existsSync11 } from "fs";
+import { readFileSync as readFileSync6, existsSync as existsSync11 } from "fs";
 import { resolve as resolve4 } from "path";
 
 class SchemaService {
@@ -26207,7 +26274,7 @@ class SchemaService {
     const errors4 = [];
     const isHooxProject = existsSync11(resolve4(this.projectRoot, "wrangler.jsonc")) || existsSync11(resolve4(this.projectRoot, "workers"));
     try {
-      const wranglerContent = readFileSync5(workerWranglerPath, "utf-8");
+      const wranglerContent = readFileSync6(workerWranglerPath, "utf-8");
       errors4.push(...validateWranglerJsonc(name, manifest, wranglerContent));
     } catch (e) {
       const isErrnoException = e instanceof Error && "code" in e;
@@ -26221,7 +26288,7 @@ class SchemaService {
       });
     }
     try {
-      const rootContent = readFileSync5(rootWranglerPath, "utf-8");
+      const rootContent = readFileSync6(rootWranglerPath, "utf-8");
       errors4.push(...validateRootSecrets(name, manifest, rootContent));
     } catch (e) {
       const errMessage = e instanceof Error ? e.message : String(e);
@@ -26232,7 +26299,7 @@ class SchemaService {
       });
     }
     try {
-      const devVarsContent = readFileSync5(devVarsPath, "utf-8");
+      const devVarsContent = readFileSync6(devVarsPath, "utf-8");
       errors4.push(...validateDevVars(name, manifest, devVarsContent));
     } catch (e) {
       const errMessage = e instanceof Error ? e.message : String(e);
@@ -26491,7 +26558,7 @@ var init_trace_service = __esm(() => {
 });
 
 // src/index.ts
-import { readFileSync as readFileSync10 } from "fs";
+import { readFileSync as readFileSync11 } from "fs";
 
 // ../../node_modules/.bun/commander@15.0.0/node_modules/commander/lib/error.js
 class CommanderError extends Error {
@@ -29621,13 +29688,13 @@ async function runInitCommand(options, globalOpts, isNonInteractive) {
 }
 // src/services/setup/setup-service.ts
 import {
-  chmodSync as chmodSync4,
+  chmodSync as chmodSync5,
   existsSync as existsSync7,
-  mkdirSync as mkdirSync4,
+  mkdirSync as mkdirSync5,
   readdirSync as readdirSync3,
-  readFileSync as readFileSync3,
+  readFileSync as readFileSync4,
   statSync as statSync2,
-  writeFileSync as writeFileSync2
+  writeFileSync as writeFileSync3
 } from "fs";
 import { homedir as homedir4 } from "os";
 import { join as join7 } from "path";
@@ -29699,7 +29766,7 @@ function parseEnvFile(text2) {
 }
 function safeChmod(path4, mode) {
   try {
-    chmodSync4(path4, mode);
+    chmodSync5(path4, mode);
   } catch {}
 }
 function loadExistingKeysFromDisk() {
@@ -29708,7 +29775,7 @@ function loadExistingKeysFromDisk() {
     return null;
   let text2;
   try {
-    text2 = readFileSync3(setupEnv, "utf-8");
+    text2 = readFileSync4(setupEnv, "utf-8");
   } catch {
     return null;
   }
@@ -29773,9 +29840,9 @@ class SetupService {
       API_SERVICE_KEY_BINDING: internalKey
     };
     if (!existsSync7(KEYS_DIR)) {
-      mkdirSync4(KEYS_DIR, { recursive: true });
+      mkdirSync5(KEYS_DIR, { recursive: true });
     } else if (!statSync2(KEYS_DIR).isDirectory()) {
-      mkdirSync4(KEYS_DIR, { recursive: true });
+      mkdirSync5(KEYS_DIR, { recursive: true });
     }
     safeChmod(KEYS_DIR, 448);
     const setupEnvPath = join7(KEYS_DIR, "setup.env");
@@ -29798,7 +29865,7 @@ class SetupService {
       const path4 = `workers/${workerFsDir(worker)}/.dev.vars`;
       const meshNames = secretNames;
       const meshSet = new Set(meshNames);
-      const existing = existsSync7(path4) ? parseEnvFile(readFileSync3(path4, "utf-8")) : new Map;
+      const existing = existsSync7(path4) ? parseEnvFile(readFileSync4(path4, "utf-8")) : new Map;
       for (const secretName of meshNames) {
         existing.set(secretName, keys[secretName]);
       }
@@ -29958,7 +30025,7 @@ class SetupService {
     const wranglerPath = join7("workers", workerFsDir(worker), "wrangler.jsonc");
     let wranglerContent;
     try {
-      wranglerContent = readFileSync3(wranglerPath, "utf-8");
+      wranglerContent = readFileSync4(wranglerPath, "utf-8");
     } catch {
       return { ok: false, error: errMsg };
     }
@@ -29976,7 +30043,7 @@ class SetupService {
     let fixed = wranglerContent.replace(new RegExp(`(\\s*//[^\\n]*\\n)?\\s*"${escapeRegex2(secretName)}"\\s*:\\s*null\\s*,?\\s*\\n?`, "g"), `
 `);
     fixed = fixed.replace(/"vars"\s*:\s*\{\s*\}/, '"vars": {}');
-    writeFileSync2(wranglerPath, fixed, "utf-8");
+    writeFileSync3(wranglerPath, fixed, "utf-8");
     this.onProgress({
       type: "info",
       step: "secrets",
@@ -30159,7 +30226,7 @@ class SetupService {
     for (const name of workerDirs) {
       const dir = `workers/${workerFsDir(name)}`;
       try {
-        const gitEntry = readFileSync3(join7(dir, ".git"), "utf-8").trim();
+        const gitEntry = readFileSync4(join7(dir, ".git"), "utf-8").trim();
         if (gitEntry.startsWith("gitdir:") || gitEntry.length > 0) {
           if (!this.isWorkerTreePopulated(dir, name))
             missing.push(name);
@@ -30308,7 +30375,7 @@ class SetupService {
       const wranglerPath = `workers/${workerFsDir(worker)}/wrangler.jsonc`;
       let content;
       try {
-        content = readFileSync3(wranglerPath, "utf-8");
+        content = readFileSync4(wranglerPath, "utf-8");
       } catch {
         continue;
       }
@@ -30340,7 +30407,7 @@ class SetupService {
       }
       if (modified) {
         content = content.replace(/"vars"\s*:\s*\{\s*\}/, '"vars": {}');
-        writeFileSync2(wranglerPath, content, "utf-8");
+        writeFileSync3(wranglerPath, content, "utf-8");
         fixed.push(worker);
       }
     }
@@ -30495,7 +30562,7 @@ class SetupService {
       const devVarsPath = `workers/${workerFsDir(worker)}/.dev.vars`;
       let devVarsContent;
       try {
-        devVarsContent = readFileSync3(devVarsPath, "utf-8");
+        devVarsContent = readFileSync4(devVarsPath, "utf-8");
       } catch {
         missing.push(`${worker}:.dev.vars (missing file)`);
         continue;
@@ -31300,8 +31367,8 @@ init_errors4();
 import {
   statSync as statSync3,
   existsSync as existsSync8,
-  readFileSync as readFileSync4,
-  writeFileSync as writeFileSync3,
+  readFileSync as readFileSync5,
+  writeFileSync as writeFileSync4,
   renameSync
 } from "fs";
 import { resolve as resolve2 } from "path";
@@ -32082,7 +32149,7 @@ async function doUpdateInternalUrls(fmt) {
       process.exitCode = 1 /* ERROR */;
       return;
     }
-    const content = readFileSync4(filePath, "utf-8");
+    const content = readFileSync5(filePath, "utf-8");
     const errors4 = [];
     const parsed = parse6(content, errors4);
     if (errors4.length > 0) {
@@ -32108,12 +32175,12 @@ async function doUpdateInternalUrls(fmt) {
       formatSuccess("All service URLs already up to date.", fmt);
       return;
     }
-    const fresh = readFileSync4(filePath, "utf-8");
+    const fresh = readFileSync5(filePath, "utf-8");
     const edits = modify(fresh, ["vars"], vars, {
       formattingOptions: { tabSize: 2, insertSpaces: true }
     });
     const tmpPath = `${filePath}.tmp-${process.pid}`;
-    writeFileSync3(tmpPath, applyEdits(fresh, edits), "utf-8");
+    writeFileSync4(tmpPath, applyEdits(fresh, edits), "utf-8");
     renameSync(tmpPath, filePath);
     formatSuccess(`Updated ${changesCount} service URL(s) in dashboard wrangler.jsonc`, fmt);
   } catch (err) {
@@ -34824,6 +34891,22 @@ async function runInfraChecks(cf) {
   });
   return { name: "Infrastructure", checks: checks3 };
 }
+function parseRemoteSecretNames(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed))
+      return null;
+    const names = new Set;
+    for (const item of parsed) {
+      if (item && typeof item === "object" && typeof item.name === "string") {
+        names.add(item.name);
+      }
+    }
+    return names;
+  } catch {
+    return null;
+  }
+}
 async function runSecretsChecks(secretsService, configService, cf) {
   const checks3 = [];
   const enabledWorkers = configService.listEnabledWorkers();
@@ -34832,11 +34915,11 @@ async function runSecretsChecks(secretsService, configService, cf) {
   for (const workerName of enabledWorkers) {
     const result = await secretsService.checkLocalSecrets(workerName);
     if (result.missing.length > 0) {
-      errors4.push(`Worker "${workerName}" missing secrets: ${result.missing.join(", ")}`);
+      errors4.push(`Worker "${workerName}" missing secrets: ${result.missing.join(", ")}. ` + `Fix: hoox setup --skip-db --skip-dashboard (mesh keys) or ` + `hoox secrets set ${workerName} <NAME>`);
     }
     for (const secret of result.secrets) {
-      if (secret.set && secret.source) {
-        warnings.push(`Worker "${workerName}": ${secret.name} is set locally (source: ${secret.source})`);
+      if (!secret.set && secret.source) {
+        warnings.push(`Worker "${workerName}": ${secret.name} is present in ${secret.source} but empty/placeholder`);
       }
     }
   }
@@ -34849,14 +34932,22 @@ async function runSecretsChecks(secretsService, configService, cf) {
   const remoteErrors = [];
   const remoteWarnings = [];
   for (const workerName of enabledWorkers) {
-    const secrets = secretsService.listSecrets(workerName);
-    if (secrets.length === 0)
+    const expected = secretsService.listSecrets(workerName);
+    if (expected.length === 0)
       continue;
     const result = await cf.secretList(workerName);
     if (!result.ok) {
       remoteErrors.push(`Worker "${workerName}": ${result.error}`);
-    } else {
-      remoteWarnings.push(`Worker "${workerName}": remote secrets listed OK (${secrets.length} expected)`);
+      continue;
+    }
+    const remoteNames = parseRemoteSecretNames(result.value);
+    if (!remoteNames) {
+      remoteWarnings.push(`Worker "${workerName}": could not parse remote secret list (raw length ${result.value.length})`);
+      continue;
+    }
+    const missingRemote = expected.filter((n3) => !remoteNames.has(n3));
+    if (missingRemote.length > 0) {
+      remoteErrors.push(`Worker "${workerName}" missing on Cloudflare: ${missingRemote.join(", ")}. ` + `Fix: hoox secrets sync ${workerName}`);
     }
   }
   checks3.push({
@@ -37731,10 +37822,10 @@ import { existsSync as existsSync12, realpathSync } from "fs";
 import { homedir as homedir5 } from "os";
 
 // src/services/perf/endpoint-resolver.ts
-import { readFileSync as readFileSync6 } from "fs";
+import { readFileSync as readFileSync7 } from "fs";
 function readSubdomainPrefix() {
   try {
-    const raw = readFileSync6("wrangler.jsonc", "utf8");
+    const raw = readFileSync7("wrangler.jsonc", "utf8");
     const stripped = raw.replace(/\/\*[\s\S]*?\*\//g, "").replace(/^\s*\/\/.*$/gm, "");
     const parsed = JSON.parse(stripped);
     const prefix = parsed.global?.subdomain_prefix;
@@ -38139,6 +38230,62 @@ ${install.stderr || install.stdout}`.trim());
   const tuiEntry = firstExisting(getTuiEntryCandidates(repoPath));
   return { repoPath, cloned, installed, tuiEntry };
 }
+// src/commands/doctor/doctor-command.ts
+init_src();
+
+// src/services/workspace/workspace-context.ts
+init_src();
+import { resolve as resolve7 } from "path";
+var lastWorkspaceContext = null;
+function getLastWorkspaceContext() {
+  return lastWorkspaceContext;
+}
+function ensureWorkspaceContext(options) {
+  const previousCwd = resolve7(options?.cwd ?? process.cwd());
+  const inTest = process.env.BUN_TEST === "1" || false || typeof process.env.BUN_TEST !== "undefined";
+  const allowChdir = options?.force === true || !inTest;
+  const runtime = resolveHooxRuntimeRoot({ cwd: previousCwd });
+  const quiet = options?.quiet === true || process.env.HOOX_CLI_SILENT === "1" || process.argv.includes("--json") || process.argv.includes("--quiet");
+  if (!runtime.root) {
+    const empty = {
+      root: null,
+      source: runtime.source,
+      chdir: false,
+      previousCwd,
+      runtime
+    };
+    lastWorkspaceContext = empty;
+    return empty;
+  }
+  if (runtime.source === "cwd" || runtime.source === "env") {
+    rememberMonorepoRoot(runtime.root);
+  } else if (runtime.source === "remembered") {
+    rememberMonorepoRoot(runtime.root);
+  }
+  if (!process.env.HOOX_REPO) {
+    process.env.HOOX_REPO = runtime.root;
+  }
+  let didChdir = false;
+  const target = resolve7(runtime.root);
+  if (allowChdir && resolve7(process.cwd()) !== target) {
+    process.chdir(target);
+    didChdir = true;
+    if (!quiet) {
+      const label = runtime.source === "remembered" ? "remembered monorepo" : runtime.source === "global" ? "global runtime" : runtime.source === "env" ? "HOOX_REPO" : "monorepo";
+      process.stderr.write(`hoox: using ${label} at ${target}
+`);
+    }
+  }
+  const ctx = {
+    root: target,
+    source: runtime.source,
+    chdir: didChdir,
+    previousCwd,
+    runtime
+  };
+  lastWorkspaceContext = ctx;
+  return ctx;
+}
 // src/services/operator-security/operator-security-service.ts
 init_src();
 function collectSecurityHygiene(env = process.env, options) {
@@ -38389,14 +38536,19 @@ function printCheckIcon(severity) {
 function printStatus() {
   const status = getRuntimeStatus();
   const { runtime } = status;
+  const remembered = getRememberedMonorepoRoot();
+  const session = getLastWorkspaceContext();
+  const sourceLabel = session?.source ?? runtime.source;
+  const rootLabel = session?.root ?? runtime.root;
   process.stdout.write(theme.heading(`
 Hoox doctor
 
 `));
   process.stdout.write(`${theme.dim("HOOX_HOME")}     ${status.hooxHome}
 ` + `${theme.dim("Global repo")}  ${status.repoPath}
-` + `${theme.dim("Runtime root")} ${runtime.root ?? theme.warning("(none)")}
-` + `${theme.dim("Source")}       ${runtime.source}
+` + `${theme.dim("Remembered")}   ${remembered ?? theme.dim("(none \u2014 run hx once from the monorepo)")}
+` + `${theme.dim("Runtime root")} ${rootLabel ?? theme.warning("(none)")}
+` + `${theme.dim("Source")}       ${sourceLabel}
 ` + `${theme.dim("TUI entry")}    ${status.tuiEntry ?? theme.warning("(not found)")}
 
 `);
@@ -38415,10 +38567,10 @@ Hoox doctor
       detail: status.isSetupRoot ? "monorepo markers present" : status.repoPresent ? "path exists but is not a setup monorepo" : runtime.root ? "optional (runtime resolved elsewhere)" : "missing \u2014 run: hoox doctor --fix-runtime"
     },
     {
-      ok: runtime.root !== null,
+      ok: rootLabel !== null,
       required: true,
       label: "Resolved runtime root",
-      detail: runtime.root === null ? "set HOOX_REPO, cd into the hoox monorepo, or fix-runtime" : `${runtime.source}: ${runtime.root}`
+      detail: rootLabel === null ? "set HOOX_REPO, run hx once inside the monorepo (remembers path), or: hoox doctor --fix-runtime" : `${sourceLabel}: ${rootLabel}`
     },
     {
       ok: status.tuiEntry !== null,
@@ -38717,7 +38869,7 @@ function registerDisclaimerCommand(program2) {
   }));
 }
 // src/commands/agent/agent-command.ts
-import { readFileSync as readFileSync7 } from "fs";
+import { readFileSync as readFileSync8 } from "fs";
 init_errors4();
 var PROVIDERS = [
   {
@@ -38751,7 +38903,7 @@ function checkDevVars() {
   const candidates = ["workers/agent-worker/.dev.vars", ".dev.vars"];
   for (const filePath of candidates) {
     try {
-      const content = readFileSync7(filePath, "utf-8");
+      const content = readFileSync8(filePath, "utf-8");
       for (const line of content.split(`
 `)) {
         const trimmed = line.trim();
@@ -39282,12 +39434,12 @@ EXAMPLES:
 }
 // src/commands/pyne/pyne-command.ts
 init_config2();
-import { existsSync as existsSync14, readFileSync as readFileSync8 } from "fs";
-import { resolve as resolve7 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync9 } from "fs";
+import { resolve as resolve8 } from "path";
 init_errors4();
 var DEFAULT_TIMEOUT_MS = 30000;
 function getPyneWorkerDir() {
-  return resolve7(process.cwd(), "workers/pyne-worker");
+  return resolve8(process.cwd(), "workers/pyne-worker");
 }
 function requirePyneDir() {
   const dir = getPyneWorkerDir();
@@ -39301,14 +39453,14 @@ function requirePyneDir() {
 function loadDevVars(workerDir) {
   const out = {};
   const candidates = [
-    resolve7(workerDir, ".dev.vars"),
-    resolve7(process.cwd(), ".dev.vars")
+    resolve8(workerDir, ".dev.vars"),
+    resolve8(process.cwd(), ".dev.vars")
   ];
   for (const filePath of candidates) {
     try {
       if (!existsSync14(filePath))
         continue;
-      const content = readFileSync8(filePath, "utf-8");
+      const content = readFileSync9(filePath, "utf-8");
       for (const line of content.split(`
 `)) {
         const trimmed = line.trim();
@@ -39523,11 +39675,11 @@ EXAMPLES:
     } else if (scriptPath === "-") {
       body.script = await new Response(Bun.stdin).text();
     } else {
-      const abs = resolve7(process.cwd(), scriptPath);
+      const abs = resolve8(process.cwd(), scriptPath);
       if (!existsSync14(abs)) {
         throw new CLIError(`Script not found: ${abs}`, 1 /* ERROR */);
       }
-      body.script = readFileSync8(abs, "utf-8");
+      body.script = readFileSync9(abs, "utf-8");
     }
     const res = await pyneFetch(baseUrl, "/run", {
       method: "POST",
@@ -39574,11 +39726,11 @@ EXAMPLES:
     if (!apiKey) {
       throw new CLIError("API key required for authenticated endpoints", 2 /* INVALID_USAGE */);
     }
-    const abs = resolve7(process.cwd(), scriptPath);
+    const abs = resolve8(process.cwd(), scriptPath);
     if (!existsSync14(abs)) {
       throw new CLIError(`Script not found: ${abs}`, 1 /* ERROR */);
     }
-    const script = readFileSync8(abs, "utf-8");
+    const script = readFileSync9(abs, "utf-8");
     const baseName = abs.split(/[/\\]/).pop() ?? "script.pine";
     const scriptId = opts.id ?? baseName.replace(/\.pine$/i, "").replace(/[^a-zA-Z0-9_-]/g, "_");
     const res = await pyneFetch(baseUrl, "/scripts", {
@@ -39682,7 +39834,7 @@ Pass script flags after -- :
   pyneCmd.command("sync-vendor").summary("Sync pynescript into python_modules/ for Cloudflare deploy").description(`Runs workers/pyne-worker/scripts/sync_vendor.sh.
 Required before wrangler deploy after pulling new PYNE APIs.`).action(withErrorHandling(async () => {
     const dir = requirePyneDir();
-    const script = resolve7(dir, "scripts/sync_vendor.sh");
+    const script = resolve8(dir, "scripts/sync_vendor.sh");
     if (!existsSync14(script)) {
       throw new CLIError(`sync_vendor.sh not found at ${script}`, 1 /* ERROR */);
     }
@@ -39691,7 +39843,7 @@ Required before wrangler deploy after pulling new PYNE APIs.`).action(withErrorH
   pyneCmd.command("deploy").summary("sync-vendor then wrangler deploy pyne-worker").option("--skip-sync", "Skip scripts/sync_vendor.sh").action(withErrorHandling(async (opts) => {
     const dir = requirePyneDir();
     if (!opts.skipSync) {
-      const script = resolve7(dir, "scripts/sync_vendor.sh");
+      const script = resolve8(dir, "scripts/sync_vendor.sh");
       if (existsSync14(script)) {
         const code = await spawnInPyneDir(["bash", script], dir);
         if (code !== 0) {
@@ -40253,7 +40405,7 @@ ${theme.dim("Live tail duration reached. Exiting.")}
 `);
       }
     } catch {}
-    await new Promise((resolve8) => setTimeout(resolve8, pollInterval));
+    await new Promise((resolve9) => setTimeout(resolve9, pollInterval));
     await poll();
   };
   await poll();
@@ -41241,7 +41393,7 @@ function registerCompletionCommand(program2) {
 // src/ui/banner.ts
 init_ansis();
 init_theme();
-import { existsSync as existsSync15, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync10 } from "fs";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { dirname as dirname4, join as join13 } from "path";
 var ORANGE = ansis_default.hex("#ff7f2a");
@@ -41259,7 +41411,7 @@ function findCliVersion() {
     const pkgPath = join13(dir, "package.json");
     if (existsSync15(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync9(pkgPath, "utf-8"));
+        const pkg = JSON.parse(readFileSync10(pkgPath, "utf-8"));
         if (pkg.name === PKG_NAME)
           return pkg.version;
       } catch {}
@@ -41273,68 +41425,78 @@ function findCliVersion() {
 }
 var VERSION = findCliVersion();
 var DISCLAIMER2 = "DISCLAIMER: Trading cryptocurrencies involves substantial risk of loss. Use at your own risk.";
-var WORDMARK = [
-  " _   _  ___   _____  _  ",
-  "| | | |/ _ \\ / _ \\ \\/ / ",
-  "| |_| | (_) | (_) >  <  ",
-  " \\___/ \\___/ \\___/_/\\_\\ "
-];
-var WORD_W = WORDMARK[0].length;
-function colorWordmark(phase, mode) {
-  return WORDMARK.map((line, row) => {
-    if (mode === "assemble") {
-      const local = Math.max(0, Math.min(1, phase));
-      const cut = Math.floor(local * line.length);
-      let out = "";
-      for (let col = 0;col < line.length; col++) {
-        const ch = line[col];
-        if (ch === " ") {
-          out += " ";
-          continue;
-        }
-        if (col > cut)
-          out += ZINC_FAINT("\xB7");
-        else if (local < 0.85)
-          out += ZINC(ch);
-        else
-          out += theme.heading(ch);
-      }
-      return out;
-    }
-    if (mode === "pulse") {
-      let out = "";
-      for (let col = 0;col < line.length; col++) {
-        const ch = line[col];
-        if (ch === " ") {
-          out += " ";
-          continue;
-        }
-        const t2 = (phase * 1.5 + col * 0.05 + row * 0.06) % 1;
-        if (t2 < 0.12)
-          out += AMBER(ch);
-        else if (t2 < 0.25)
-          out += ORANGE(ch);
-        else if (t2 < 0.4)
-          out += INDIGO_SOFT(ch);
-        else
-          out += INDIGO.bold(ch);
-      }
-      return out;
-    }
-    return theme.heading(line);
-  });
-}
+var LETTERS = ["H", "O", "O", "X"];
+var RULE_W = 38;
 var PAD = " ";
+function colorDiamond(phase, mode) {
+  if (mode === "assemble") {
+    if (phase < 0.05)
+      return " ";
+    if (phase < 0.2)
+      return ZINC_FAINT("\u25C6");
+    return AMBER("\u25C6");
+  }
+  if (mode === "pulse") {
+    const t2 = phase * 2 % 1;
+    return t2 < 0.5 ? AMBER("\u25C6") : ORANGE("\u25C6");
+  }
+  return AMBER("\u25C6");
+}
+function colorLetter(letter, index, phase, mode) {
+  if (mode === "assemble") {
+    const start = 0.12;
+    const span = 0.88;
+    const letterPhase = (phase - start) / span;
+    const revealAt = index / LETTERS.length;
+    if (letterPhase < revealAt)
+      return " ";
+    if (letterPhase < revealAt + 0.12)
+      return ZINC(letter);
+    return INDIGO.bold(letter);
+  }
+  if (mode === "pulse") {
+    const t2 = (phase * 1.4 + index * 0.18) % 1;
+    if (t2 < 0.15)
+      return INDIGO_SOFT(letter);
+    if (t2 < 0.3)
+      return AMBER(letter);
+    return INDIGO.bold(letter);
+  }
+  return INDIGO.bold(letter);
+}
+function colorDot(afterLetterIndex, phase, mode) {
+  if (mode === "assemble") {
+    const start = 0.12;
+    const span = 0.88;
+    const letterPhase = (phase - start) / span;
+    const revealAt = (afterLetterIndex + 1) / LETTERS.length;
+    if (letterPhase < revealAt - 0.02)
+      return " ";
+    return ZINC_FAINT("\xB7");
+  }
+  return ZINC_FAINT("\xB7");
+}
+function composeTitleLine(phase, mode) {
+  const diamond = colorDiamond(phase, mode);
+  const parts = [diamond, "  "];
+  for (let i2 = 0;i2 < LETTERS.length; i2++) {
+    parts.push(colorLetter(LETTERS[i2], i2, phase, mode));
+    if (i2 < LETTERS.length - 1) {
+      parts.push(" ");
+      parts.push(colorDot(i2, phase, mode));
+      parts.push(" ");
+    }
+  }
+  return PAD + parts.join("");
+}
+function composeMetaLine() {
+  return PAD + ZINC_SOFT(TAGLINE) + " " + ZINC_FAINT("\xB7") + " " + INDIGO_SOFT(`v${VERSION}`);
+}
 function composeFrame(phase, mode) {
-  const word = colorWordmark(phase, mode);
-  const contentW = WORD_W;
-  const body = word.map((line) => PAD + line);
-  const rule = PAD + ZINC_FAINT("\u2500".repeat(contentW));
-  const metaInner = ZINC_SOFT(TAGLINE) + "  " + ZINC_FAINT("\xB7") + "  " + INDIGO_SOFT(`v${VERSION}`);
-  const metaVis = stripAnsi(metaInner).length;
-  const metaPad = Math.max(0, Math.floor((contentW - metaVis) / 2));
-  const meta3 = PAD + " ".repeat(metaPad) + metaInner;
-  return [rule, ...body, rule, meta3].join(`
+  const title = composeTitleLine(phase, mode);
+  const rule = PAD + ZINC_SOFT("\xB7") + " " + ZINC_FAINT("\u2500".repeat(RULE_W - 2));
+  const meta3 = composeMetaLine();
+  return [title, rule, meta3].join(`
 `);
 }
 function canAnimate() {
@@ -41884,7 +42046,7 @@ if (typeof Bun === "undefined") {
 `);
   process.exit(1);
 }
-var pkgVersion = JSON.parse(readFileSync10(new URL("../package.json", import.meta.url), "utf-8")).version;
+var pkgVersion = JSON.parse(readFileSync11(new URL("../package.json", import.meta.url), "utf-8")).version;
 var program2 = new Command;
 program2.name("hoox").description("Hoox CLI \u2014 manage Cloudflare Workers, infrastructure, secrets, and deployments").version(`${pkgVersion}
 
@@ -42035,6 +42197,7 @@ registerPerfCommand(program2);
 registerCompletionCommand(program2);
 async function main() {
   try {
+    ensureWorkspaceContext();
     const hasArgs = process.argv.slice(2).length > 0;
     if (hasArgs) {
       await program2.parseAsync(process.argv);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hoox-sh/hoox-cli",
-  "version": "0.11.4",
+  "version": "0.11.6",
   "description": "Hoox CLI — manage Cloudflare Workers, infrastructure, secrets, and deployments (@hoox-sh/hoox-cli)",
   "type": "module",
   "bin": {