@hoox-sh/hoox-cli 0.11.5 → 0.11.7

package/README.md

@@ -6,10 +6,11 @@
 
 > **Runtime requirement:** Bun ≥ 1.2. The bin shebang and bundle target are Bun-only; `npm install -g` will install the package but the CLI will not run under Node.js.
 
-**v0.11.x** — operator security plane (`doctor --security`, `tunnel check`, transport profile Bearer + Access), PYNE edge ops (`hoox pyne`), schema validate/generate, and wrangler **4.x**. **v0.10.x** hardened fail-closed remote TUI / management `/v1/*`. **v0.9.x** shipped hop-level `perf fastpath` observability.
+**v0.11.x** — monorepo auto-detect + remember (run `hx` from any directory), Linear Rail banner, quieter secrets check, operator security plane (`doctor --security`, `tunnel check`), PYNE (`hoox pyne`), schema validate/generate, wrangler **4.x**.
 
 ## Features
 
+- **Monorepo auto-detect & remember**: On every start the CLI finds the hoox monorepo (`HOOX_REPO` → walk up from cwd → `~/.hoox/config/monorepo.json` → `~/.hoox/repo`), saves the path, and `chdir`s into it so `hx` / `hoox` work from `~/Videos` or any other folder after you have run once from the monorepo.
 - **One-shot Onboarding** (`hoox onboard`): Full bootstrap from a fresh clone — collects credentials, configures workers, provisions D1/KV, generates keys, pushes secrets, deploys dashboard. The recommended entry point for new users.
 - **Config & Setup Wizards** (`hoox init`, `hoox setup`): Split into two steps — `init` writes `wrangler.jsonc` and collects integration secrets; `setup` generates keys, applies D1 schema, and pushes secrets to Cloudflare. Run separately when you need fine-grained control.
 - **Infrastructure as Code**: Manage D1, KV, R2, Queues, Vectorize, and Analytics via `hoox infra`.
@@ -56,6 +57,10 @@ bun run build   # produces dist/index.js — required for `hoox` after global in
 ## Quick Start
 
 ```bash
+# From the monorepo root (first time — path is remembered)
+cd /path/to/hoox
+hoox doctor                    # shows Remembered + Runtime root
+
 # One-shot onboarding (collects credentials, provisions, deploys)
 hoox onboard
 
@@ -70,8 +75,42 @@ hoox check health
 # Deploy to Cloudflare
 hoox deploy all --auto
 
-# Measure fast-path latency
-hoox perf fastpath run --n 50
+# Later: works from any directory (uses remembered monorepo)
+cd ~/Videos
+hx check health
+hx doctor                      # Source: remembered
+```
+
+## Monorepo resolution (any cwd)
+
+Resolution order at CLI startup:
+
+1. **`HOOX_REPO`** — absolute path override (highest priority)
+2. **Walk up from cwd** — discovers a local checkout (`packages/cli` + repo markers)
+3. **Remembered path** — `~/.hoox/config/monorepo.json` (written when discovered via cwd/env)
+4. **Global clone** — `~/.hoox/repo` (create with `hoox doctor --fix-runtime`)
+
+When a root is found, the CLI:
+
+- refreshes the remembered path (when source is `cwd` / `env` / `remembered`)
+- sets session `HOOX_REPO` for child processes
+- `chdir`s into the monorepo so relative paths (`wrangler.jsonc`, `workers/`, …) work
+
+Markers for a valid monorepo: `packages/cli/package.json` **plus** one of `wrangler.jsonc`, `wrangler.jsonc.example`, `workers/`, or `.gitmodules`.
+
+| Env / path                     | Purpose                                                |
+| ------------------------------ | ------------------------------------------------------ |
+| `HOOX_REPO`                    | Force monorepo root                                    |
+| `HOOX_HOME`                    | Override `~/.hoox` (default home for config/data/repo) |
+| `HOOX_CLI_SILENT=1`            | Suppress “using monorepo at …” notice                  |
+| `~/.hoox/config/monorepo.json` | Persisted root `{ "root", "updatedAt" }`               |
+
+```bash
+# Inspect layout
+hoox doctor
+# Remembered   /home/you/Git/hoox
+# Runtime root /home/you/Git/hoox
+# Source       remembered
 ```
 
 ## Available Commands
@@ -358,8 +397,9 @@ hoox perf fastpath report --from 1h
 ### Operator Security & Private Ingress
 
 ```bash
-# Paths, TUI entry, and runtime layout
+# Paths, TUI entry, remembered monorepo, runtime layout
 hoox doctor
+hoox doctor --fix-runtime   # clone monorepo into ~/.hoox/repo if needed
 
 # Hygiene + optional management /v1/health probes
 hoox doctor --security
@@ -504,8 +544,9 @@ packages/cli/
 │   │   ├── perf/             # Percentile, probe-sender, observability-reader
 │   │   ├── prerequisites/    # Tool version checks
 │   │   ├── runtime/          # Global ~/.hoox layout
+│   │   ├── workspace/        # Monorepo detect, remember, chdir
 │   │   └── secrets/          # Secret management
-│   ├── ui/                   # Interactive menu (clack)
+│   ├── ui/                   # Interactive menu + Linear Rail banner
 │   └── utils/                # Errors, formatters, theme
 ├── bin/
 │   └── hoox.js              # CLI binary entry point

package/dist/index.js

@@ -16200,7 +16200,13 @@ var init_sse = __esm(() => {
 });
 
 // ../shared/src/path-utils.ts
-import { existsSync as existsSync2 } from "fs";
+import {
+  existsSync as existsSync2,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync2,
+  writeFileSync as writeFileSync2,
+  chmodSync as chmodSync2
+} from "fs";
 import { homedir as homedir2 } from "os";
 import { dirname, join as join2, resolve } from "path";
 function createHooxPath(path2) {
@@ -16226,7 +16232,55 @@ function isHooxSetupRoot(dir) {
     return false;
   try {
     const root = resolve(dir);
-    return existsSync2(join2(root, "wrangler.jsonc")) && existsSync2(join2(root, "packages", "cli", "package.json"));
+    if (!existsSync2(join2(root, "packages", "cli", "package.json"))) {
+      return false;
+    }
+    return existsSync2(join2(root, "wrangler.jsonc")) || existsSync2(join2(root, "wrangler.jsonc.example")) || existsSync2(join2(root, "workers")) || existsSync2(join2(root, ".gitmodules"));
+  } catch {
+    return false;
+  }
+}
+function getRememberedMonorepoPath() {
+  return resolveHooxPath("config/monorepo.json");
+}
+function getRememberedMonorepoRoot() {
+  try {
+    const path2 = getRememberedMonorepoPath();
+    if (!existsSync2(path2))
+      return null;
+    const raw = readFileSync2(path2, "utf-8");
+    const data = JSON.parse(raw);
+    if (!data.root || typeof data.root !== "string")
+      return null;
+    const resolved = resolve(data.root);
+    return isHooxSetupRoot(resolved) ? resolved : null;
+  } catch {
+    return null;
+  }
+}
+function rememberMonorepoRoot(root) {
+  try {
+    const resolved = resolve(root);
+    if (!isHooxSetupRoot(resolved))
+      return false;
+    const configDir = getHooxConfigDir();
+    mkdirSync2(configDir, { recursive: true, mode: 448 });
+    try {
+      chmodSync2(configDir, 448);
+    } catch {}
+    const payload = {
+      root: resolved,
+      updatedAt: new Date().toISOString()
+    };
+    const path2 = getRememberedMonorepoPath();
+    writeFileSync2(path2, JSON.stringify(payload, null, 2) + `
+`, {
+      mode: 384
+    });
+    try {
+      chmodSync2(path2, 384);
+    } catch {}
+    return true;
   } catch {
     return false;
   }
@@ -16246,6 +16300,7 @@ function resolveHooxRuntimeRoot(options) {
   const env = options?.env ?? process.env;
   const cwd = resolve(options?.cwd ?? process.cwd());
   const globalRepo = getHooxRepoPath();
+  const remembered = options?.skipRemembered ? null : getRememberedMonorepoRoot();
   const envRepo = env.HOOX_REPO?.trim();
   if (envRepo) {
     const resolved = resolve(envRepo);
@@ -16256,6 +16311,7 @@ function resolveHooxRuntimeRoot(options) {
         checked: {
           env: resolved,
           cwd: findHooxSetupRoot(cwd),
+          remembered,
           global: globalRepo
         }
       };
@@ -16266,6 +16322,7 @@ function resolveHooxRuntimeRoot(options) {
       checked: {
         env: resolved,
         cwd: findHooxSetupRoot(cwd),
+        remembered,
         global: globalRepo
       }
     };
@@ -16275,20 +16332,27 @@ function resolveHooxRuntimeRoot(options) {
     return {
       root: local,
       source: "cwd",
-      checked: { cwd: local, global: globalRepo }
+      checked: { cwd: local, remembered, global: globalRepo }
+    };
+  }
+  if (remembered) {
+    return {
+      root: remembered,
+      source: "remembered",
+      checked: { cwd: null, remembered, global: globalRepo }
     };
   }
   if (isHooxSetupRoot(globalRepo)) {
     return {
       root: globalRepo,
       source: "global",
-      checked: { cwd: null, global: globalRepo }
+      checked: { cwd: null, remembered: null, global: globalRepo }
     };
   }
   return {
     root: null,
     source: "none",
-    checked: { cwd: null, global: globalRepo }
+    checked: { cwd: null, remembered: null, global: globalRepo }
   };
 }
 function getTuiEntryCandidates(runtimeRoot) {
@@ -16468,7 +16532,7 @@ function formatRelativeTime2(timestampMs, nowMs) {
 }
 
 // ../shared/src/dashboard-manifest.ts
-import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync2 } from "fs";
+import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync3 } from "fs";
 import { join as join3 } from "path";
 function isDashboardSectionFlatKv(sectionId) {
   return !DASHBOARD_SECTIONS_NOT_FLAT_KV.has(sectionId);
@@ -16702,7 +16766,7 @@ function tryReadFile(path2) {
   try {
     if (!existsSync3(path2))
       return null;
-    return readFileSync2(path2, "utf-8");
+    return readFileSync3(path2, "utf-8");
   } catch {
     return null;
   }
@@ -21424,7 +21488,8 @@ var init_ui_store = __esm(() => {
     sidebarExpanded: true,
     modal: null,
     commandPaletteOpen: false,
-    previousView: null
+    previousView: null,
+    statusErrorExpanded: false
   };
   useUIStore = create()(immer2((set3) => ({
     ...initialState,
@@ -21455,6 +21520,12 @@ var init_ui_store = __esm(() => {
         state.activeView = state.previousView;
         state.previousView = null;
       }
+    }),
+    toggleStatusErrorExpanded: () => set3((state) => {
+      state.statusErrorExpanded = !state.statusErrorExpanded;
+    }),
+    setStatusErrorExpanded: (expanded) => set3((state) => {
+      state.statusErrorExpanded = expanded;
     })
   })));
 });
@@ -21471,13 +21542,28 @@ function ringPush(arr, item, max) {
   const next = [...arr, item];
   return next.length > max ? next.slice(next.length - max) : next;
 }
+function clearReconnectTimer() {
+  if (reconnectTimer !== null) {
+    clearTimeout(reconnectTimer);
+    reconnectTimer = null;
+  }
+}
+function scheduleReconnect(delayMs) {
+  clearReconnectTimer();
+  if (delayMs < 0)
+    return;
+  reconnectTimer = setTimeout(() => {
+    reconnectTimer = null;
+    scheduledReconnectTick();
+  }, delayMs);
+}
 function getBackoffDelay(retryCount) {
   if (retryCount <= 0)
     return 0;
   const index = Math.min(retryCount - 1, BACKOFF_SEQUENCE.length - 1);
   return BACKOFF_SEQUENCE[index];
 }
-var BACKOFF_SEQUENCE, MAX_RETRIES2 = 5, tradeStreamAbort = null, logStreamAbort = null, fetchWorkersGeneration = 0, MAX_TRADES = 500, MAX_ALERTS = 100, MAX_LOGS = 1000, initialState2, useServiceStore;
+var BACKOFF_SEQUENCE, MAX_RETRIES2 = 5, tradeStreamAbort = null, logStreamAbort = null, fetchWorkersGeneration = 0, reconnectTimer = null, scheduledReconnectTick = async () => {}, MAX_TRADES = 500, MAX_ALERTS = 100, MAX_LOGS = 1000, initialState2, useServiceStore;
 var init_service_store = __esm(() => {
   init_esm();
   init_immer2();
@@ -21507,6 +21593,7 @@ var init_service_store = __esm(() => {
         const data = await hooxFetch2("/v1/workers");
         if (gen !== fetchWorkersGeneration)
           return;
+        clearReconnectTimer();
         set3((state) => {
           state.workers = data;
           state.lastUpdated = Date.now();
@@ -21532,6 +21619,7 @@ var init_service_store = __esm(() => {
           timestamp: Date.now(),
           acknowledged: false
         });
+        let nextDelay = 0;
         set3((state) => {
           state.lastError = msg;
           state.disconnectedAt = state.disconnectedAt ?? Date.now();
@@ -21540,21 +21628,26 @@ var init_service_store = __esm(() => {
             state.retryCount = state.retryCount + 1;
             if (state.retryCount >= MAX_RETRIES2) {
               state.connectionStatus = "offline";
-              state.lastError = `Connection lost after ${MAX_RETRIES2} retries`;
+              state.lastError = `${msg} (gave up after ${MAX_RETRIES2} retries)`;
+              state.reconnectDelay = 0;
             } else {
               state.reconnectDelay = getBackoffDelay(state.retryCount);
+              nextDelay = state.reconnectDelay;
             }
           } else if (state.connectionStatus === "reconnecting") {
             state.retryCount = state.retryCount + 1;
             if (state.retryCount >= MAX_RETRIES2) {
               state.connectionStatus = "offline";
-              state.lastError = `Connection lost after ${MAX_RETRIES2} retries`;
+              state.lastError = `${msg} (gave up after ${MAX_RETRIES2} retries)`;
               state.reconnectDelay = 0;
             } else {
               state.reconnectDelay = getBackoffDelay(state.retryCount);
+              nextDelay = state.reconnectDelay;
             }
           }
         });
+        if (nextDelay > 0)
+          scheduleReconnect(nextDelay);
       }
     },
     streamTrades: async () => {
@@ -21616,6 +21709,17 @@ var init_service_store = __esm(() => {
       const merged = [...state.alerts, ...alerts];
       state.alerts = merged.length > MAX_ALERTS ? merged.slice(merged.length - MAX_ALERTS) : merged;
     }),
+    acknowledgeAlert: (id) => set3((state) => {
+      const hit = state.alerts.find((a) => a.id === id);
+      if (hit)
+        hit.acknowledged = true;
+    }),
+    dismissAlert: (id) => set3((state) => {
+      state.alerts = state.alerts.filter((a) => a.id !== id);
+    }),
+    clearLogs: () => set3((state) => {
+      state.logs = [];
+    }),
     setConnectionStatus: (status) => set3((state) => {
       if (status === "connected") {
         state.retryCount = 0;
@@ -21646,49 +21750,69 @@ var init_service_store = __esm(() => {
       state.metrics = metrics;
       state.lastUpdated = metrics.lastUpdated;
     }),
-    handleConnectionSuccess: () => set3((state) => {
-      state.lastSuccessfulFetch = Date.now();
-      state.retryCount = 0;
-      state.lastError = null;
-      state.lastErrorDetails = null;
-      state.reconnectDelay = 0;
-      state.disconnectedAt = null;
-      state.connectionStatus = "connected";
-    }),
-    handleConnectionFailure: (errorMessage) => set3((state) => {
-      state.lastError = errorMessage;
-      state.disconnectedAt = state.disconnectedAt ?? Date.now();
-      if (state.connectionStatus === "connected" || state.connectionStatus === "polling") {
-        state.connectionStatus = "reconnecting";
-        state.retryCount = 1;
-        state.reconnectDelay = getBackoffDelay(1);
-      } else if (state.connectionStatus === "reconnecting") {
-        state.retryCount = state.retryCount + 1;
-        if (state.retryCount >= MAX_RETRIES2) {
-          state.connectionStatus = "offline";
-          state.lastError = `Connection lost after ${MAX_RETRIES2} retries`;
-          state.reconnectDelay = 0;
-        } else {
-          state.reconnectDelay = getBackoffDelay(state.retryCount);
+    handleConnectionSuccess: () => {
+      clearReconnectTimer();
+      set3((state) => {
+        state.lastSuccessfulFetch = Date.now();
+        state.retryCount = 0;
+        state.lastError = null;
+        state.lastErrorDetails = null;
+        state.reconnectDelay = 0;
+        state.disconnectedAt = null;
+        state.connectionStatus = "connected";
+      });
+    },
+    handleConnectionFailure: (errorMessage) => {
+      let nextDelay = 0;
+      set3((state) => {
+        state.lastError = errorMessage;
+        state.disconnectedAt = state.disconnectedAt ?? Date.now();
+        if (state.connectionStatus === "connected" || state.connectionStatus === "polling") {
+          state.connectionStatus = "reconnecting";
+          state.retryCount = 1;
+          state.reconnectDelay = getBackoffDelay(1);
+          nextDelay = state.reconnectDelay;
+        } else if (state.connectionStatus === "reconnecting") {
+          state.retryCount = state.retryCount + 1;
+          if (state.retryCount >= MAX_RETRIES2) {
+            state.connectionStatus = "offline";
+            state.lastError = `${errorMessage} (gave up after ${MAX_RETRIES2} retries)`;
+            state.reconnectDelay = 0;
+          } else {
+            state.reconnectDelay = getBackoffDelay(state.retryCount);
+            nextDelay = state.reconnectDelay;
+          }
         }
-      }
-    }),
-    resetRetries: () => set3((state) => {
-      state.retryCount = 0;
-      state.lastError = null;
-      state.lastErrorDetails = null;
-      state.reconnectDelay = 0;
-      state.disconnectedAt = null;
-    }),
-    forceRetry: () => set3((state) => {
-      if (state.connectionStatus === "offline") {
-        state.connectionStatus = "polling";
+      });
+      if (nextDelay > 0)
+        scheduleReconnect(nextDelay);
+    },
+    resetRetries: () => {
+      clearReconnectTimer();
+      set3((state) => {
         state.retryCount = 0;
         state.lastError = null;
         state.lastErrorDetails = null;
         state.reconnectDelay = 0;
+        state.disconnectedAt = null;
+      });
+    },
+    forceRetry: () => {
+      clearReconnectTimer();
+      const wasOffline = get2().connectionStatus === "offline";
+      set3((state) => {
+        if (state.connectionStatus === "offline") {
+          state.connectionStatus = "polling";
+          state.retryCount = 0;
+          state.lastError = null;
+          state.lastErrorDetails = null;
+          state.reconnectDelay = 0;
+        }
+      });
+      if (wasOffline) {
+        scheduleReconnect(0);
       }
-    }),
+    },
     setLastErrorDetails: (details) => set3((state) => {
       state.lastErrorDetails = details;
       state.lastError = details === null ? null : summarizeCliError(details);
@@ -21711,6 +21835,12 @@ var init_service_store = __esm(() => {
       }, MAX_ALERTS);
     })
   })));
+  scheduledReconnectTick = async () => {
+    const status = useServiceStore.getState().connectionStatus;
+    if (status === "reconnecting" || status === "polling") {
+      await useServiceStore.getState().fetchWorkers();
+    }
+  };
 });
 
 // ../../node_modules/.bun/zustand@5.0.14+158594928fb811b4/node_modules/zustand/esm/middleware.mjs
@@ -21897,39 +22027,69 @@ var init_middleware = __esm(() => {
 });
 
 // ../shared/src/stores/config-store.ts
-import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, existsSync as existsSync4 } from "fs";
-import { homedir as homedir3 } from "os";
+import { chmodSync as chmodSync3, mkdirSync as mkdirSync3, existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
 import { join as join4 } from "path";
+function getTuiPreferencesPath() {
+  return join4(getHooxHome(), ".tui-state", "preferences.json");
+}
+function getLegacyConfigJsonPath() {
+  return join4(getHooxHome(), "config.json");
+}
+function extractZustandPrefsPayload(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed === "object" && parsed.state && typeof parsed.state === "object" && !Array.isArray(parsed.state) && (("theme" in parsed.state) || ("refreshIntervalMs" in parsed.state)) && !("apiToken" in parsed)) {
+      return raw;
+    }
+  } catch {}
+  return null;
+}
 var bunConfigStorage, DEFAULT_SHORTCUTS, DEFAULT_LOG_FILTER, DEFAULT_NOTIFICATIONS, defaults, useConfigStore;
 var init_config_store = __esm(() => {
   init_esm();
   init_immer2();
   init_middleware();
   init_config();
+  init_path_utils();
   bunConfigStorage = {
     getItem: async (_name) => {
       try {
-        const file2 = Bun.file(join4(homedir3(), ".hoox", "config.json"));
-        const exists = await file2.exists();
-        if (!exists)
-          return null;
-        return await file2.text();
+        const prefsPath = getTuiPreferencesPath();
+        const prefsFile = Bun.file(prefsPath);
+        if (await prefsFile.exists()) {
+          return await prefsFile.text();
+        }
+        const legacyPath = getLegacyConfigJsonPath();
+        if (existsSync4(legacyPath)) {
+          const legacyRaw = readFileSync4(legacyPath, "utf-8");
+          const envelope = extractZustandPrefsPayload(legacyRaw);
+          if (envelope) {
+            await bunConfigStorage.setItem(_name, envelope);
+            return envelope;
+          }
+        }
+        return null;
       } catch {
         return null;
       }
     },
     setItem: async (_name, value) => {
-      const dir = join4(homedir3(), ".hoox");
-      if (!existsSync4(dir)) {
-        mkdirSync2(dir, { recursive: true, mode: HOOX_DIR_MODE });
+      const home = getHooxHome();
+      const stateDir = join4(home, ".tui-state");
+      if (!existsSync4(home)) {
+        mkdirSync3(home, { recursive: true, mode: HOOX_DIR_MODE });
+      }
+      if (!existsSync4(stateDir)) {
+        mkdirSync3(stateDir, { recursive: true, mode: HOOX_DIR_MODE });
       }
       try {
-        chmodSync2(dir, HOOX_DIR_MODE);
+        chmodSync3(home, HOOX_DIR_MODE);
+        chmodSync3(stateDir, HOOX_DIR_MODE);
       } catch {}
-      const filePath = join4(dir, "config.json");
+      const filePath = getTuiPreferencesPath();
       await Bun.write(filePath, value);
       try {
-        chmodSync2(filePath, HOOX_CONFIG_FILE_MODE);
+        chmodSync3(filePath, HOOX_CONFIG_FILE_MODE);
       } catch {}
     },
     removeItem: async (_name) => {}
@@ -22001,7 +22161,7 @@ var init_config_store = __esm(() => {
       state.notifications[channel] = !state.notifications[channel];
     })
   })), {
-    name: "hoox-config",
+    name: "hoox-tui-prefs",
     storage: createJSONStorage(() => bunConfigStorage),
     partialize: (state) => ({
       theme: state.theme,
@@ -22049,6 +22209,7 @@ __export(exports_src, {
   resolveHooxRuntimeRoot: () => resolveHooxRuntimeRoot,
   resolveHooxPath: () => resolveHooxPath,
   resolveDependencies: () => resolveDependencies,
+  rememberMonorepoRoot: () => rememberMonorepoRoot,
   readConfigSync: () => readConfigSync,
   readConfig: () => readConfig,
   parseDashboardManifest: () => parseDashboardManifest,
@@ -22073,6 +22234,8 @@ __export(exports_src, {
   headersToObject: () => headersToObject,
   hasOperatorClientCredentials: () => hasOperatorClientCredentials,
   getTuiEntryCandidates: () => getTuiEntryCandidates,
+  getRememberedMonorepoRoot: () => getRememberedMonorepoRoot,
+  getRememberedMonorepoPath: () => getRememberedMonorepoPath,
   getRelativeHooxPath: () => getRelativeHooxPath,
   getHooxWranglerPath: () => getHooxWranglerPath,
   getHooxStatePath: () => getHooxStatePath,
@@ -25557,15 +25720,15 @@ __export(exports_fs_secure, {
   SECRET_FILE_MODE: () => SECRET_FILE_MODE,
   SECRET_DIR_MODE: () => SECRET_DIR_MODE
 });
-import { chmodSync as chmodSync3, mkdirSync as mkdirSync3 } from "fs";
+import { chmodSync as chmodSync4, mkdirSync as mkdirSync4 } from "fs";
 function secureChmod(path4, mode) {
   try {
-    chmodSync3(path4, mode);
+    chmodSync4(path4, mode);
   } catch {}
 }
 function ensureSecretDir(dir) {
   try {
-    mkdirSync3(dir, { recursive: true, mode: SECRET_DIR_MODE });
+    mkdirSync4(dir, { recursive: true, mode: SECRET_DIR_MODE });
   } catch {}
   secureChmod(dir, SECRET_DIR_MODE);
 }
@@ -26171,7 +26334,7 @@ var exports_schema_service = {};
 __export(exports_schema_service, {
   SchemaService: () => SchemaService
 });
-import { readFileSync as readFileSync5, existsSync as existsSync11 } from "fs";
+import { readFileSync as readFileSync7, existsSync as existsSync11 } from "fs";
 import { resolve as resolve4 } from "path";
 
 class SchemaService {
@@ -26207,7 +26370,7 @@ class SchemaService {
     const errors4 = [];
     const isHooxProject = existsSync11(resolve4(this.projectRoot, "wrangler.jsonc")) || existsSync11(resolve4(this.projectRoot, "workers"));
     try {
-      const wranglerContent = readFileSync5(workerWranglerPath, "utf-8");
+      const wranglerContent = readFileSync7(workerWranglerPath, "utf-8");
       errors4.push(...validateWranglerJsonc(name, manifest, wranglerContent));
     } catch (e) {
       const isErrnoException = e instanceof Error && "code" in e;
@@ -26221,7 +26384,7 @@ class SchemaService {
       });
     }
     try {
-      const rootContent = readFileSync5(rootWranglerPath, "utf-8");
+      const rootContent = readFileSync7(rootWranglerPath, "utf-8");
       errors4.push(...validateRootSecrets(name, manifest, rootContent));
     } catch (e) {
       const errMessage = e instanceof Error ? e.message : String(e);
@@ -26232,7 +26395,7 @@ class SchemaService {
       });
     }
     try {
-      const devVarsContent = readFileSync5(devVarsPath, "utf-8");
+      const devVarsContent = readFileSync7(devVarsPath, "utf-8");
       errors4.push(...validateDevVars(name, manifest, devVarsContent));
     } catch (e) {
       const errMessage = e instanceof Error ? e.message : String(e);
@@ -26491,7 +26654,7 @@ var init_trace_service = __esm(() => {
 });
 
 // src/index.ts
-import { readFileSync as readFileSync10 } from "fs";
+import { readFileSync as readFileSync12 } from "fs";
 
 // ../../node_modules/.bun/commander@15.0.0/node_modules/commander/lib/error.js
 class CommanderError extends Error {
@@ -29621,15 +29784,15 @@ async function runInitCommand(options, globalOpts, isNonInteractive) {
 }
 // src/services/setup/setup-service.ts
 import {
-  chmodSync as chmodSync4,
+  chmodSync as chmodSync5,
   existsSync as existsSync7,
-  mkdirSync as mkdirSync4,
+  mkdirSync as mkdirSync5,
   readdirSync as readdirSync3,
-  readFileSync as readFileSync3,
+  readFileSync as readFileSync5,
   statSync as statSync2,
-  writeFileSync as writeFileSync2
+  writeFileSync as writeFileSync3
 } from "fs";
-import { homedir as homedir4 } from "os";
+import { homedir as homedir3 } from "os";
 import { join as join7 } from "path";
 var ALL_WORKERS = [
   "d1-worker",
@@ -29699,7 +29862,7 @@ function parseEnvFile(text2) {
 }
 function safeChmod(path4, mode) {
   try {
-    chmodSync4(path4, mode);
+    chmodSync5(path4, mode);
   } catch {}
 }
 function loadExistingKeysFromDisk() {
@@ -29708,7 +29871,7 @@ function loadExistingKeysFromDisk() {
     return null;
   let text2;
   try {
-    text2 = readFileSync3(setupEnv, "utf-8");
+    text2 = readFileSync5(setupEnv, "utf-8");
   } catch {
     return null;
   }
@@ -29773,9 +29936,9 @@ class SetupService {
       API_SERVICE_KEY_BINDING: internalKey
     };
     if (!existsSync7(KEYS_DIR)) {
-      mkdirSync4(KEYS_DIR, { recursive: true });
+      mkdirSync5(KEYS_DIR, { recursive: true });
     } else if (!statSync2(KEYS_DIR).isDirectory()) {
-      mkdirSync4(KEYS_DIR, { recursive: true });
+      mkdirSync5(KEYS_DIR, { recursive: true });
     }
     safeChmod(KEYS_DIR, 448);
     const setupEnvPath = join7(KEYS_DIR, "setup.env");
@@ -29798,7 +29961,7 @@ class SetupService {
       const path4 = `workers/${workerFsDir(worker)}/.dev.vars`;
       const meshNames = secretNames;
       const meshSet = new Set(meshNames);
-      const existing = existsSync7(path4) ? parseEnvFile(readFileSync3(path4, "utf-8")) : new Map;
+      const existing = existsSync7(path4) ? parseEnvFile(readFileSync5(path4, "utf-8")) : new Map;
       for (const secretName of meshNames) {
         existing.set(secretName, keys[secretName]);
       }
@@ -29958,7 +30121,7 @@ class SetupService {
     const wranglerPath = join7("workers", workerFsDir(worker), "wrangler.jsonc");
     let wranglerContent;
     try {
-      wranglerContent = readFileSync3(wranglerPath, "utf-8");
+      wranglerContent = readFileSync5(wranglerPath, "utf-8");
     } catch {
       return { ok: false, error: errMsg };
     }
@@ -29976,7 +30139,7 @@ class SetupService {
     let fixed = wranglerContent.replace(new RegExp(`(\\s*//[^\\n]*\\n)?\\s*"${escapeRegex2(secretName)}"\\s*:\\s*null\\s*,?\\s*\\n?`, "g"), `
 `);
     fixed = fixed.replace(/"vars"\s*:\s*\{\s*\}/, '"vars": {}');
-    writeFileSync2(wranglerPath, fixed, "utf-8");
+    writeFileSync3(wranglerPath, fixed, "utf-8");
     this.onProgress({
       type: "info",
       step: "secrets",
@@ -30095,7 +30258,7 @@ class SetupService {
     }
     const fallbacks = [
       "/usr/local/bin/wrangler",
-      join7(homedir4(), ".bun", "bin", "wrangler")
+      join7(homedir3(), ".bun", "bin", "wrangler")
     ];
     for (const fb of fallbacks) {
       try {
@@ -30159,7 +30322,7 @@ class SetupService {
     for (const name of workerDirs) {
       const dir = `workers/${workerFsDir(name)}`;
       try {
-        const gitEntry = readFileSync3(join7(dir, ".git"), "utf-8").trim();
+        const gitEntry = readFileSync5(join7(dir, ".git"), "utf-8").trim();
         if (gitEntry.startsWith("gitdir:") || gitEntry.length > 0) {
           if (!this.isWorkerTreePopulated(dir, name))
             missing.push(name);
@@ -30308,7 +30471,7 @@ class SetupService {
       const wranglerPath = `workers/${workerFsDir(worker)}/wrangler.jsonc`;
       let content;
       try {
-        content = readFileSync3(wranglerPath, "utf-8");
+        content = readFileSync5(wranglerPath, "utf-8");
       } catch {
         continue;
       }
@@ -30340,7 +30503,7 @@ class SetupService {
       }
       if (modified) {
         content = content.replace(/"vars"\s*:\s*\{\s*\}/, '"vars": {}');
-        writeFileSync2(wranglerPath, content, "utf-8");
+        writeFileSync3(wranglerPath, content, "utf-8");
         fixed.push(worker);
       }
     }
@@ -30495,7 +30658,7 @@ class SetupService {
       const devVarsPath = `workers/${workerFsDir(worker)}/.dev.vars`;
       let devVarsContent;
       try {
-        devVarsContent = readFileSync3(devVarsPath, "utf-8");
+        devVarsContent = readFileSync5(devVarsPath, "utf-8");
       } catch {
         missing.push(`${worker}:.dev.vars (missing file)`);
         continue;
@@ -31300,8 +31463,8 @@ init_errors4();
 import {
   statSync as statSync3,
   existsSync as existsSync8,
-  readFileSync as readFileSync4,
-  writeFileSync as writeFileSync3,
+  readFileSync as readFileSync6,
+  writeFileSync as writeFileSync4,
   renameSync
 } from "fs";
 import { resolve as resolve2 } from "path";
@@ -32082,7 +32245,7 @@ async function doUpdateInternalUrls(fmt) {
       process.exitCode = 1 /* ERROR */;
       return;
     }
-    const content = readFileSync4(filePath, "utf-8");
+    const content = readFileSync6(filePath, "utf-8");
     const errors4 = [];
     const parsed = parse6(content, errors4);
     if (errors4.length > 0) {
@@ -32108,12 +32271,12 @@ async function doUpdateInternalUrls(fmt) {
       formatSuccess("All service URLs already up to date.", fmt);
       return;
     }
-    const fresh = readFileSync4(filePath, "utf-8");
+    const fresh = readFileSync6(filePath, "utf-8");
     const edits = modify(fresh, ["vars"], vars, {
       formattingOptions: { tabSize: 2, insertSpaces: true }
     });
     const tmpPath = `${filePath}.tmp-${process.pid}`;
-    writeFileSync3(tmpPath, applyEdits(fresh, edits), "utf-8");
+    writeFileSync4(tmpPath, applyEdits(fresh, edits), "utf-8");
     renameSync(tmpPath, filePath);
     formatSuccess(`Updated ${changesCount} service URL(s) in dashboard wrangler.jsonc`, fmt);
   } catch (err) {
@@ -37752,13 +37915,13 @@ import { createRequire } from "module";
 import { resolve as resolve6, dirname as dirname3, join as join10 } from "path";
 import { fileURLToPath } from "url";
 import { existsSync as existsSync12, realpathSync } from "fs";
-import { homedir as homedir5 } from "os";
+import { homedir as homedir4 } from "os";
 
 // src/services/perf/endpoint-resolver.ts
-import { readFileSync as readFileSync6 } from "fs";
+import { readFileSync as readFileSync8 } from "fs";
 function readSubdomainPrefix() {
   try {
-    const raw = readFileSync6("wrangler.jsonc", "utf8");
+    const raw = readFileSync8("wrangler.jsonc", "utf8");
     const stripped = raw.replace(/\/\*[\s\S]*?\*\//g, "").replace(/^\s*\/\/.*$/gm, "");
     const parsed = JSON.parse(stripped);
     const prefix = parsed.global?.subdomain_prefix;
@@ -37805,7 +37968,7 @@ function collectTuiCandidates() {
     const cwdRequire = createRequire(join10(process.cwd(), "package.json"));
     pushPackageEntries(candidates, cwdRequire);
   } catch {}
-  const bunGlobal = join10(homedir5(), ".bun", "install", "global", "node_modules", TUI_PKG);
+  const bunGlobal = join10(homedir4(), ".bun", "install", "global", "node_modules", TUI_PKG);
   pushPackageRootEntries(candidates, bunGlobal);
   const npmGlobal = process.env.npm_config_prefix?.trim();
   if (npmGlobal) {
@@ -38058,7 +38221,7 @@ TUI exited with code ${code}
 init_dist4();
 init_src();
 import { join as join12 } from "path";
-import { homedir as homedir6 } from "os";
+import { homedir as homedir5 } from "os";
 
 // src/services/runtime/runtime-service.ts
 init_src();
@@ -38163,6 +38326,62 @@ ${install.stderr || install.stdout}`.trim());
   const tuiEntry = firstExisting(getTuiEntryCandidates(repoPath));
   return { repoPath, cloned, installed, tuiEntry };
 }
+// src/commands/doctor/doctor-command.ts
+init_src();
+
+// src/services/workspace/workspace-context.ts
+init_src();
+import { resolve as resolve7 } from "path";
+var lastWorkspaceContext = null;
+function getLastWorkspaceContext() {
+  return lastWorkspaceContext;
+}
+function ensureWorkspaceContext(options) {
+  const previousCwd = resolve7(options?.cwd ?? process.cwd());
+  const inTest = process.env.BUN_TEST === "1" || false || typeof process.env.BUN_TEST !== "undefined";
+  const allowChdir = options?.force === true || !inTest;
+  const runtime = resolveHooxRuntimeRoot({ cwd: previousCwd });
+  const quiet = options?.quiet === true || process.env.HOOX_CLI_SILENT === "1" || process.argv.includes("--json") || process.argv.includes("--quiet");
+  if (!runtime.root) {
+    const empty = {
+      root: null,
+      source: runtime.source,
+      chdir: false,
+      previousCwd,
+      runtime
+    };
+    lastWorkspaceContext = empty;
+    return empty;
+  }
+  if (runtime.source === "cwd" || runtime.source === "env") {
+    rememberMonorepoRoot(runtime.root);
+  } else if (runtime.source === "remembered") {
+    rememberMonorepoRoot(runtime.root);
+  }
+  if (!process.env.HOOX_REPO) {
+    process.env.HOOX_REPO = runtime.root;
+  }
+  let didChdir = false;
+  const target = resolve7(runtime.root);
+  if (allowChdir && resolve7(process.cwd()) !== target) {
+    process.chdir(target);
+    didChdir = true;
+    if (!quiet) {
+      const label = runtime.source === "remembered" ? "remembered monorepo" : runtime.source === "global" ? "global runtime" : runtime.source === "env" ? "HOOX_REPO" : "monorepo";
+      process.stderr.write(`hoox: using ${label} at ${target}
+`);
+    }
+  }
+  const ctx = {
+    root: target,
+    source: runtime.source,
+    chdir: didChdir,
+    previousCwd,
+    runtime
+  };
+  lastWorkspaceContext = ctx;
+  return ctx;
+}
 // src/services/operator-security/operator-security-service.ts
 init_src();
 function collectSecurityHygiene(env = process.env, options) {
@@ -38413,14 +38632,19 @@ function printCheckIcon(severity) {
 function printStatus() {
   const status = getRuntimeStatus();
   const { runtime } = status;
+  const remembered = getRememberedMonorepoRoot();
+  const session = getLastWorkspaceContext();
+  const sourceLabel = session?.source ?? runtime.source;
+  const rootLabel = session?.root ?? runtime.root;
   process.stdout.write(theme.heading(`
 Hoox doctor
 
 `));
   process.stdout.write(`${theme.dim("HOOX_HOME")}     ${status.hooxHome}
 ` + `${theme.dim("Global repo")}  ${status.repoPath}
-` + `${theme.dim("Runtime root")} ${runtime.root ?? theme.warning("(none)")}
-` + `${theme.dim("Source")}       ${runtime.source}
+` + `${theme.dim("Remembered")}   ${remembered ?? theme.dim("(none \u2014 run hx once from the monorepo)")}
+` + `${theme.dim("Runtime root")} ${rootLabel ?? theme.warning("(none)")}
+` + `${theme.dim("Source")}       ${sourceLabel}
 ` + `${theme.dim("TUI entry")}    ${status.tuiEntry ?? theme.warning("(not found)")}
 
 `);
@@ -38439,10 +38663,10 @@ Hoox doctor
       detail: status.isSetupRoot ? "monorepo markers present" : status.repoPresent ? "path exists but is not a setup monorepo" : runtime.root ? "optional (runtime resolved elsewhere)" : "missing \u2014 run: hoox doctor --fix-runtime"
     },
     {
-      ok: runtime.root !== null,
+      ok: rootLabel !== null,
       required: true,
       label: "Resolved runtime root",
-      detail: runtime.root === null ? "set HOOX_REPO, cd into the hoox monorepo, or fix-runtime" : `${runtime.source}: ${runtime.root}`
+      detail: rootLabel === null ? "set HOOX_REPO, run hx once inside the monorepo (remembers path), or: hoox doctor --fix-runtime" : `${sourceLabel}: ${rootLabel}`
     },
     {
       ok: status.tuiEntry !== null,
@@ -38478,7 +38702,7 @@ Hoox doctor
   return failed === 0 ? 0 /* SUCCESS */ : 1 /* ERROR */;
 }
 function printSecurityHygieneSection(env = process.env) {
-  const configPath = join12(homedir6(), ".hoox", "config.json");
+  const configPath = join12(homedir5(), ".hoox", "config.json");
   const lines = collectSecurityHygiene(env, { configPath });
   process.stdout.write(theme.heading(`Security hygiene
 `));
@@ -38496,7 +38720,7 @@ async function runSecurityDoctor(options) {
     env.HOOX_API_URL = options.apiUrl;
   }
   const profile = resolveOperatorTransportProfile(env);
-  const configPath = join12(homedir6(), ".hoox", "config.json");
+  const configPath = join12(homedir5(), ".hoox", "config.json");
   const hygiene = collectSecurityHygiene(env, { configPath });
   const isLocal = profile.apiBase.includes("localhost") || profile.apiBase.includes("127.0.0.1");
   const shouldProbe = options.probe === true || options.probe !== false && !isLocal;
@@ -38741,7 +38965,7 @@ function registerDisclaimerCommand(program2) {
   }));
 }
 // src/commands/agent/agent-command.ts
-import { readFileSync as readFileSync7 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 init_errors4();
 var PROVIDERS = [
   {
@@ -38775,7 +38999,7 @@ function checkDevVars() {
   const candidates = ["workers/agent-worker/.dev.vars", ".dev.vars"];
   for (const filePath of candidates) {
     try {
-      const content = readFileSync7(filePath, "utf-8");
+      const content = readFileSync9(filePath, "utf-8");
       for (const line of content.split(`
 `)) {
         const trimmed = line.trim();
@@ -39306,12 +39530,12 @@ EXAMPLES:
 }
 // src/commands/pyne/pyne-command.ts
 init_config2();
-import { existsSync as existsSync14, readFileSync as readFileSync8 } from "fs";
-import { resolve as resolve7 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync10 } from "fs";
+import { resolve as resolve8 } from "path";
 init_errors4();
 var DEFAULT_TIMEOUT_MS = 30000;
 function getPyneWorkerDir() {
-  return resolve7(process.cwd(), "workers/pyne-worker");
+  return resolve8(process.cwd(), "workers/pyne-worker");
 }
 function requirePyneDir() {
   const dir = getPyneWorkerDir();
@@ -39325,14 +39549,14 @@ function requirePyneDir() {
 function loadDevVars(workerDir) {
   const out = {};
   const candidates = [
-    resolve7(workerDir, ".dev.vars"),
-    resolve7(process.cwd(), ".dev.vars")
+    resolve8(workerDir, ".dev.vars"),
+    resolve8(process.cwd(), ".dev.vars")
   ];
   for (const filePath of candidates) {
     try {
       if (!existsSync14(filePath))
         continue;
-      const content = readFileSync8(filePath, "utf-8");
+      const content = readFileSync10(filePath, "utf-8");
       for (const line of content.split(`
 `)) {
         const trimmed = line.trim();
@@ -39547,11 +39771,11 @@ EXAMPLES:
     } else if (scriptPath === "-") {
       body.script = await new Response(Bun.stdin).text();
     } else {
-      const abs = resolve7(process.cwd(), scriptPath);
+      const abs = resolve8(process.cwd(), scriptPath);
       if (!existsSync14(abs)) {
         throw new CLIError(`Script not found: ${abs}`, 1 /* ERROR */);
       }
-      body.script = readFileSync8(abs, "utf-8");
+      body.script = readFileSync10(abs, "utf-8");
     }
     const res = await pyneFetch(baseUrl, "/run", {
       method: "POST",
@@ -39598,11 +39822,11 @@ EXAMPLES:
     if (!apiKey) {
       throw new CLIError("API key required for authenticated endpoints", 2 /* INVALID_USAGE */);
     }
-    const abs = resolve7(process.cwd(), scriptPath);
+    const abs = resolve8(process.cwd(), scriptPath);
     if (!existsSync14(abs)) {
       throw new CLIError(`Script not found: ${abs}`, 1 /* ERROR */);
     }
-    const script = readFileSync8(abs, "utf-8");
+    const script = readFileSync10(abs, "utf-8");
     const baseName = abs.split(/[/\\]/).pop() ?? "script.pine";
     const scriptId = opts.id ?? baseName.replace(/\.pine$/i, "").replace(/[^a-zA-Z0-9_-]/g, "_");
     const res = await pyneFetch(baseUrl, "/scripts", {
@@ -39706,7 +39930,7 @@ Pass script flags after -- :
   pyneCmd.command("sync-vendor").summary("Sync pynescript into python_modules/ for Cloudflare deploy").description(`Runs workers/pyne-worker/scripts/sync_vendor.sh.
 Required before wrangler deploy after pulling new PYNE APIs.`).action(withErrorHandling(async () => {
     const dir = requirePyneDir();
-    const script = resolve7(dir, "scripts/sync_vendor.sh");
+    const script = resolve8(dir, "scripts/sync_vendor.sh");
     if (!existsSync14(script)) {
       throw new CLIError(`sync_vendor.sh not found at ${script}`, 1 /* ERROR */);
     }
@@ -39715,7 +39939,7 @@ Required before wrangler deploy after pulling new PYNE APIs.`).action(withErrorH
   pyneCmd.command("deploy").summary("sync-vendor then wrangler deploy pyne-worker").option("--skip-sync", "Skip scripts/sync_vendor.sh").action(withErrorHandling(async (opts) => {
     const dir = requirePyneDir();
     if (!opts.skipSync) {
-      const script = resolve7(dir, "scripts/sync_vendor.sh");
+      const script = resolve8(dir, "scripts/sync_vendor.sh");
       if (existsSync14(script)) {
         const code = await spawnInPyneDir(["bash", script], dir);
         if (code !== 0) {
@@ -40277,7 +40501,7 @@ ${theme.dim("Live tail duration reached. Exiting.")}
 `);
       }
     } catch {}
-    await new Promise((resolve8) => setTimeout(resolve8, pollInterval));
+    await new Promise((resolve9) => setTimeout(resolve9, pollInterval));
     await poll();
   };
   await poll();
@@ -41265,7 +41489,7 @@ function registerCompletionCommand(program2) {
 // src/ui/banner.ts
 init_ansis();
 init_theme();
-import { existsSync as existsSync15, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync11 } from "fs";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { dirname as dirname4, join as join13 } from "path";
 var ORANGE = ansis_default.hex("#ff7f2a");
@@ -41283,7 +41507,7 @@ function findCliVersion() {
     const pkgPath = join13(dir, "package.json");
     if (existsSync15(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync9(pkgPath, "utf-8"));
+        const pkg = JSON.parse(readFileSync11(pkgPath, "utf-8"));
         if (pkg.name === PKG_NAME)
           return pkg.version;
       } catch {}
@@ -41918,7 +42142,7 @@ if (typeof Bun === "undefined") {
 `);
   process.exit(1);
 }
-var pkgVersion = JSON.parse(readFileSync10(new URL("../package.json", import.meta.url), "utf-8")).version;
+var pkgVersion = JSON.parse(readFileSync12(new URL("../package.json", import.meta.url), "utf-8")).version;
 var program2 = new Command;
 program2.name("hoox").description("Hoox CLI \u2014 manage Cloudflare Workers, infrastructure, secrets, and deployments").version(`${pkgVersion}
 
@@ -42069,6 +42293,7 @@ registerPerfCommand(program2);
 registerCompletionCommand(program2);
 async function main() {
   try {
+    ensureWorkspaceContext();
     const hasArgs = process.argv.slice(2).length > 0;
     if (hasArgs) {
       await program2.parseAsync(process.argv);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hoox-sh/hoox-cli",
-  "version": "0.11.5",
+  "version": "0.11.7",
   "description": "Hoox CLI — manage Cloudflare Workers, infrastructure, secrets, and deployments (@hoox-sh/hoox-cli)",
   "type": "module",
   "bin": {
@@ -26,7 +26,7 @@
     "@hoox-sh/hoox-tui": "workspace:*"
   },
   "devDependencies": {
-    "@hoox-sh/hoox-shared": "^1.2.1",
+    "@hoox-sh/hoox-shared": "^1.3.0",
     "@types/node": "^26.1.1",
     "bun-types": "^1.3.14",
     "typescript": "^6.0.3"