@jango-blockchained/hoox-shared 1.0.8 → 1.1.0

package/dist/index.js

@@ -15,6 +15,69 @@ var __export = (target, all) => {
 };
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 
+// src/operator-transport.ts
+function stripTrailingSlashes(url) {
+  return url.replace(/\/+$/, "");
+}
+function parseTransport(raw) {
+  if (!raw)
+    return null;
+  const v = raw.trim().toLowerCase();
+  if (VALID_TRANSPORTS.has(v)) {
+    return v;
+  }
+  return null;
+}
+function resolveOperatorTransportProfile(env = process.env, options = {}) {
+  const accessClientId = env.CF_ACCESS_CLIENT_ID?.trim() ?? "";
+  const accessClientSecret = env.CF_ACCESS_CLIENT_SECRET?.trim() ?? "";
+  const hasAccess = Boolean(accessClientId && accessClientSecret);
+  const explicit = parseTransport(env.HOOX_TRANSPORT) ?? parseTransport(options.configTransport);
+  const transport = explicit ?? (hasAccess ? "access" : "public");
+  const apiFromEnv = env.HOOX_API_URL?.trim();
+  const apiFromConfig = options.configApiUrl?.trim();
+  const tokenFromEnv = env.HOOX_API_TOKEN?.trim();
+  const tokenFromConfig = options.configApiToken?.trim();
+  return {
+    transport,
+    apiBase: stripTrailingSlashes(apiFromEnv || apiFromConfig || DEFAULT_API_BASE),
+    bearerToken: tokenFromEnv || tokenFromConfig || "",
+    accessClientId,
+    accessClientSecret
+  };
+}
+function buildOperatorAuthHeaders(profile) {
+  const headers = {};
+  if (profile.bearerToken) {
+    headers.Authorization = `Bearer ${profile.bearerToken}`;
+  }
+  const useAccessHeaders = profile.transport === "access" || Boolean(profile.accessClientId) && Boolean(profile.accessClientSecret);
+  if (useAccessHeaders && profile.accessClientId && profile.accessClientSecret) {
+    headers["CF-Access-Client-Id"] = profile.accessClientId;
+    headers["CF-Access-Client-Secret"] = profile.accessClientSecret;
+  }
+  return headers;
+}
+function hasOperatorClientCredentials(profile) {
+  if (profile.bearerToken)
+    return true;
+  return Boolean(profile.accessClientId && profile.accessClientSecret);
+}
+function operatorUrl(profile, path) {
+  const base = profile.apiBase.replace(/\/+$/, "");
+  const p = path.startsWith("/") ? path : `/${path}`;
+  return `${base}${p}`;
+}
+var DEFAULT_API_BASE = "http://localhost:8787", VALID_TRANSPORTS;
+var init_operator_transport = __esm(() => {
+  VALID_TRANSPORTS = new Set([
+    "public",
+    "access",
+    "mtls",
+    "tunnel"
+  ]);
+});
+
 // src/api-client.ts
 var exports_api_client = {};
 __export(exports_api_client, {
@@ -40,20 +103,25 @@ function isNetworkError(error) {
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
+function activeProfile(override) {
+  return override ?? resolveOperatorTransportProfile();
+}
 async function hooxFetch(path, options) {
+  const profile = options?.transport ?? (options?.transportEnv ? resolveOperatorTransportProfile(options.transportEnv) : activeProfile());
+  const { transport: _t, transportEnv: _e, ...fetchInit } = options ?? {};
   let lastError;
   for (let attempt = 0;attempt <= MAX_RETRIES; attempt++) {
     const controller = new AbortController;
     const timeoutId = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
     try {
-      const url = `${API_BASE}${path}`;
+      const url = operatorUrl(profile, path);
       const headers = {
         "Content-Type": "application/json",
-        ...API_TOKEN ? { Authorization: `Bearer ${API_TOKEN}` } : {},
-        ...options?.headers
+        ...buildOperatorAuthHeaders(profile),
+        ...fetchInit.headers
       };
       const response = await fetch(url, {
-        ...options,
+        ...fetchInit,
         headers,
         signal: controller.signal
       });
@@ -101,10 +169,9 @@ async function hooxFetch(path, options) {
     retryable: false
   });
 }
-var API_BASE, API_TOKEN, FETCH_TIMEOUT_MS = 5000, MAX_RETRIES = 3, BASE_RETRY_DELAY_MS = 1000, MAX_RETRY_DELAY_MS = 16000, WorkerAPIError;
+var FETCH_TIMEOUT_MS = 5000, MAX_RETRIES = 3, BASE_RETRY_DELAY_MS = 1000, MAX_RETRY_DELAY_MS = 16000, WorkerAPIError;
 var init_api_client = __esm(() => {
-  API_BASE = process.env.HOOX_API_URL || "http://localhost:8787";
-  API_TOKEN = process.env.HOOX_API_TOKEN || "";
+  init_operator_transport();
   WorkerAPIError = class WorkerAPIError extends Error {
     status;
     retryable;
@@ -122,17 +189,18 @@ var exports_sse = {};
 __export(exports_sse, {
   subscribeSSE: () => subscribeSSE
 });
-function subscribeSSE(path, callback, onStatus) {
+function subscribeSSE(path, callback, onStatus, options) {
   let aborted = false;
+  const profile = options?.transport ?? (options?.transportEnv ? resolveOperatorTransportProfile(options.transportEnv) : resolveOperatorTransportProfile());
   const run = async () => {
     let attempt = 0;
     while (!aborted && attempt < MAX_RECONNECT_ATTEMPTS) {
       try {
-        const url = `${API_BASE2}${path}`;
+        const url = operatorUrl(profile, path);
         const response = await fetch(url, {
           headers: {
             Accept: "text/event-stream",
-            ...API_TOKEN2 ? { Authorization: `Bearer ${API_TOKEN2}` } : {}
+            ...buildOperatorAuthHeaders(profile)
           }
         });
         if (!response.ok || !response.body) {
@@ -161,7 +229,7 @@ function subscribeSSE(path, callback, onStatus) {
             }
           }
         }
-      } catch (error) {
+      } catch {
         if (aborted)
           break;
         onStatus?.("reconnecting");
@@ -181,21 +249,31 @@ function subscribeSSE(path, callback, onStatus) {
     }
   };
 }
-var API_BASE2, API_TOKEN2, RECONNECT_BASE_MS = 1000, RECONNECT_MAX_MS = 16000, MAX_RECONNECT_ATTEMPTS = 10;
+var RECONNECT_BASE_MS = 1000, RECONNECT_MAX_MS = 16000, MAX_RECONNECT_ATTEMPTS = 10;
 var init_sse = __esm(() => {
-  API_BASE2 = process.env.HOOX_API_URL || "http://localhost:8787";
-  API_TOKEN2 = process.env.HOOX_API_TOKEN || "";
+  init_operator_transport();
 });
 
 // src/analytics.ts
-async function trackAnalytics(env, endpoint, body) {
+async function trackAnalytics(env, endpoint, body, options) {
   if (!env.ANALYTICS_SERVICE)
     return;
   try {
+    const payload = {
+      ...body,
+      ...options?.indexes ? { indexes: [...options.indexes] } : {}
+    };
+    const headers = {
+      "Content-Type": "application/json"
+    };
+    const internalKey = env.INTERNAL_KEY_BINDING;
+    if (internalKey) {
+      headers["X-Internal-Auth-Key"] = internalKey;
+    }
     await env.ANALYTICS_SERVICE.fetch(new Request(`http://localhost${endpoint}`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(body)
+      headers,
+      body: JSON.stringify(payload)
     }));
   } catch (e) {
     console.error("Analytics tracking failed:", e);
@@ -204,36 +282,81 @@ async function trackAnalytics(env, endpoint, body) {
 
 // src/colors.ts
 var Colors = {
-  background: "#0D1117",
-  foreground: "#EEEEEE",
-  card: "#1C1C1F",
-  border: "#484848",
-  muted: "#A0A0A0",
-  "muted-foreground": "#6E6E6E",
-  dim: "#3B3B3D",
-  accent: "#E8780A",
-  "accent-dim": "#B85E08",
-  success: "#00FF88",
-  warning: "#FFAA00",
-  error: "#FF4444",
-  info: "#4488FF",
-  text: "#EEEEEE",
-  "text-muted": "#A0A0A0",
-  "text-dim": "#6E6E6E",
-  panel: "#1C1C1F",
-  divider: "#484848",
-  highlight: "#E8780A"
+  background: "#050508",
+  foreground: "#E8E8F0",
+  card: "#0A0A0F",
+  border: "#232330",
+  muted: "#8B8B9E",
+  "muted-foreground": "#6E6E84",
+  dim: "#3C3C50",
+  accent: "#818CF8",
+  "accent-dim": "#6366F1",
+  success: "#34D399",
+  warning: "#FBBF24",
+  error: "#FB7185",
+  info: "#38BDF8",
+  text: "#E8E8F0",
+  "text-muted": "#8B8B9E",
+  panel: "#0A0A0F",
+  divider: "#232330",
+  highlight: "#22D3EE",
+  backdrop: "#000000"
+};
+var CoolBracketPalette = [
+  "#22D3EE",
+  "#38BDF8",
+  "#60A5FA",
+  "#818CF8",
+  "#A78BFA",
+  "#C084FC",
+  "#E879F9",
+  "#A78BFA",
+  "#818CF8",
+  "#38BDF8"
+];
+var ConnectionStatusColor = {
+  connected: Colors.success,
+  polling: Colors.highlight,
+  reconnecting: Colors.warning,
+  offline: Colors.error
+};
+var WorkerStatusColor = {
+  operational: Colors.success,
+  degraded: Colors.warning,
+  down: Colors.error
+};
+var LogLevelColor = {
+  error: Colors.error,
+  warn: Colors.warning,
+  info: Colors.foreground,
+  debug: Colors.muted
+};
+var AlertSeverityColor = {
+  info: Colors.info,
+  warning: Colors.warning,
+  error: Colors.error,
+  critical: Colors.error
 };
 
 // src/config.ts
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
+import {
+  readFileSync,
+  writeFileSync,
+  existsSync,
+  mkdirSync,
+  chmodSync,
+  statSync
+} from "fs";
 import { join } from "path";
 import { homedir } from "os";
 var HOX_DIR = join(homedir(), ".hoox");
 var CONFIG_PATH = join(HOX_DIR, "config.json");
+var HOOX_DIR_MODE = 448;
+var HOOX_CONFIG_FILE_MODE = 384;
 var DEFAULT_CONFIG = {
   apiUrl: "http://localhost:8787",
   apiToken: "",
+  transport: "public",
   refreshIntervalMs: 500,
   theme: "dark",
   activeExchanges: ["binance", "bybit", "mexc"],
@@ -266,12 +389,41 @@ function readConfigSync() {
 async function readConfig() {
   return readConfigSync();
 }
+function ensureHooxDirSecure(dir = HOX_DIR) {
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true, mode: HOOX_DIR_MODE });
+  }
+  try {
+    chmodSync(dir, HOOX_DIR_MODE);
+  } catch {}
+}
+function writeSecureFileSync(filePath, contents, mode = HOOX_CONFIG_FILE_MODE) {
+  writeFileSync(filePath, contents, { encoding: "utf-8", mode });
+  try {
+    chmodSync(filePath, mode);
+  } catch {}
+}
+function isUnixModeGroupOrWorldAccessible(mode) {
+  return (mode & 63) !== 0;
+}
+function isConfigWorldOrGroupReadable(filePath = CONFIG_PATH) {
+  try {
+    if (!existsSync(filePath))
+      return false;
+    return isUnixModeGroupOrWorldAccessible(statSync(filePath).mode & 511);
+  } catch {
+    return false;
+  }
+}
+function formatConfigPermissionWarning(filePath = CONFIG_PATH) {
+  if (!isConfigWorldOrGroupReadable(filePath))
+    return null;
+  return `Warning: ${filePath} is group/world-accessible. ` + `Run: chmod 600 ${filePath}  (and chmod 700 on the parent dir). ` + `This file may contain apiToken / operator secrets.`;
+}
 function writeConfigSync(config) {
   try {
-    if (!existsSync(HOX_DIR)) {
-      mkdirSync(HOX_DIR, { recursive: true });
-    }
-    writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2), "utf-8");
+    ensureHooxDirSecure(HOX_DIR);
+    writeSecureFileSync(CONFIG_PATH, JSON.stringify(config, null, 2), HOOX_CONFIG_FILE_MODE);
   } catch (err) {
     console.error("Failed to write config:", err);
   }
@@ -279,6 +431,12 @@ function writeConfigSync(config) {
 async function writeConfig(config) {
   writeConfigSync(config);
 }
+var VALID_TRANSPORTS2 = new Set([
+  "public",
+  "access",
+  "mtls",
+  "tunnel"
+]);
 function validateConfig(config) {
   const errors = [];
   if (config.apiUrl && !config.apiUrl.startsWith("http")) {
@@ -290,9 +448,41 @@ function validateConfig(config) {
   if (config.theme && !["dark", "light"].includes(config.theme)) {
     errors.push('theme must be "dark" or "light"');
   }
+  if (config.transport !== undefined && !VALID_TRANSPORTS2.has(config.transport)) {
+    errors.push('transport must be "public" | "access" | "mtls" | "tunnel"');
+  }
   return errors;
 }
 
+// src/cron-handler.ts
+function createCronHandler(options) {
+  const { name, handler, logger } = options;
+  return async (event, env, ctx) => {
+    const startTime = Date.now();
+    logger?.info(`${name} cron triggered`, {
+      cron: event.cron,
+      scheduledTime: event.scheduledTime
+    });
+    try {
+      await handler(event, env, ctx);
+      const durationMs = Date.now() - startTime;
+      logger?.info(`${name} cron handler completed successfully`, {
+        cron: event.cron,
+        durationMs
+      });
+    } catch (error) {
+      const durationMs = Date.now() - startTime;
+      const errorMsg = error instanceof Error ? error.message : String(error);
+      logger?.error(`${name} cron handler failed`, {
+        cron: event.cron,
+        durationMs,
+        error: errorMsg
+      });
+      throw error;
+    }
+  };
+}
+
 // src/errors.ts
 function toError(err, fallback = "Unknown error") {
   if (err instanceof Error)
@@ -310,22 +500,65 @@ function toError(err, fallback = "Unknown error") {
     return fallback;
   }
 }
+var SENSITIVE_FIELDS = new Set([
+  "password",
+  "token",
+  "secret",
+  "api_key",
+  "apiKey",
+  "authorization"
+]);
+function hasSensitiveFields(obj) {
+  for (const key of Object.keys(obj)) {
+    if (SENSITIVE_FIELDS.has(key))
+      return true;
+  }
+  return false;
+}
+function hasErrorValues(obj) {
+  for (const v of Object.values(obj)) {
+    if (v instanceof Error)
+      return true;
+  }
+  return false;
+}
 function sanitizeOutput(data) {
+  if (data === null || data === undefined)
+    return data;
+  const t = typeof data;
+  if (t === "string" || t === "number" || t === "boolean")
+    return data;
   if (data instanceof Error) {
     return { name: data.name, message: data.message };
   }
-  if (data && typeof data === "object" && !Array.isArray(data)) {
+  if (Array.isArray(data)) {
+    return data.map(sanitizeOutput);
+  }
+  if (t === "object") {
+    const obj = data;
+    const keys = Object.keys(obj);
+    if (keys.length < 10) {
+      const sanitized2 = {};
+      for (const k of keys) {
+        if (k === "stack" || k === "cause")
+          continue;
+        const v = obj[k];
+        sanitized2[k] = v instanceof Error ? { name: v.name, message: v.message } : sanitizeOutput(v);
+      }
+      return sanitized2;
+    }
+    if (!hasSensitiveFields(obj) && !hasErrorValues(obj)) {
+      return obj;
+    }
     const sanitized = {};
-    for (const [k, v] of Object.entries(data)) {
+    for (const k of keys) {
       if (k === "stack" || k === "cause")
         continue;
+      const v = obj[k];
       sanitized[k] = v instanceof Error ? { name: v.name, message: v.message } : sanitizeOutput(v);
     }
     return sanitized;
   }
-  if (Array.isArray(data)) {
-    return data.map(sanitizeOutput);
-  }
   return data;
 }
 function createJsonResponse(data, status = 200) {
@@ -421,7 +654,7 @@ class D1Repository {
   async batch(statements) {
     try {
       const prepared = statements.map((s) => s.params && s.params.length > 0 ? this.db.prepare(s.query).bind(...s.params) : this.db.prepare(s.query));
-      const results = await this.db.batch(...prepared);
+      const results = await this.db.batch(prepared);
       return results.map((r) => ({
         success: r.success,
         meta: r.meta ? { last_row_id: r.meta.last_row_id, changes: r.meta.changes } : undefined,
@@ -527,6 +760,7 @@ class D1Repository {
     }
   }
 }
+
 // src/d1/schemas.ts
 import { z } from "zod";
 var TradeRecordSchema = z.object({
@@ -668,6 +902,106 @@ class BaseExchangeClient {
   }
 }
 
+// src/exchanges/base-exchange-client.ts
+class BaseExchangeClient2 {
+  apiKey;
+  apiSecret;
+  baseUrl;
+  isTestnet;
+  importedKeyPromise;
+  constructor(apiKey, apiSecret) {
+    if (!apiKey || !apiSecret) {
+      throw new Error(this.getErrorMessagePrefix() + "API key and secret are required.");
+    }
+    this.apiKey = apiKey;
+    this.apiSecret = apiSecret;
+    this.baseUrl = this.getDefaultBaseUrl();
+    this.isTestnet = false;
+    this.importedKeyPromise = this.importKey();
+  }
+  getErrorMessagePrefix() {
+    return "";
+  }
+  generateSignature(_params) {
+    throw new Error("generateSignature must be implemented by subclass");
+  }
+  buildHeaders(_method, _path, _params) {
+    return new Headers;
+  }
+  async importKey() {
+    const encoder = new TextEncoder;
+    return crypto.subtle.importKey("raw", encoder.encode(this.apiSecret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  }
+  async cryptoSign(data) {
+    const encoder = new TextEncoder;
+    const key = await this.importedKeyPromise;
+    const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(data));
+    return Array.from(new Uint8Array(signature)).map((b) => b.toString(16).padStart(2, "0")).join("");
+  }
+  async fetch(method, path, params) {
+    const url = `${this.baseUrl}${path}`;
+    const headers = this.buildHeaders(method, path, params);
+    const body = params ? new URLSearchParams(params).toString() : undefined;
+    const response = await fetch(url, {
+      method,
+      headers,
+      body: method !== "GET" ? body : undefined
+    });
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Exchange API error: ${response.status} - ${error}`);
+    }
+    return response.json();
+  }
+  setLeverage(_symbol, _leverage) {
+    throw new Error("setLeverage must be implemented by subclass");
+  }
+  executeTrade(_params) {
+    throw new Error("executeTrade must be implemented by subclass");
+  }
+  getAccountInfo() {
+    throw new Error("getAccountInfo must be implemented by subclass");
+  }
+  getPositions(_symbol) {
+    throw new Error("getPositions must be implemented by subclass");
+  }
+  async openLong(symbol, quantity, price, orderType = "MARKET") {
+    return this.executeTrade({
+      symbol,
+      side: "BUY",
+      orderType,
+      quantity,
+      price
+    });
+  }
+  async openShort(symbol, quantity, price, orderType = "MARKET") {
+    return this.executeTrade({
+      symbol,
+      side: "SELL",
+      orderType,
+      quantity,
+      price
+    });
+  }
+  async closeLong(symbol, quantity) {
+    return this.executeTrade({
+      symbol,
+      side: "SELL",
+      orderType: "MARKET",
+      quantity,
+      reduceOnly: true
+    });
+  }
+  async closeShort(symbol, quantity) {
+    return this.executeTrade({
+      symbol,
+      side: "BUY",
+      orderType: "MARKET",
+      quantity,
+      reduceOnly: true
+    });
+  }
+}
 // src/format-time.ts
 function formatRelativeTime(timestampMs, nowMs) {
   const now = nowMs ?? Date.now();
@@ -877,6 +1211,16 @@ var WebhookPayloadSchema = z2.object({
   orderType: z2.string().optional(),
   leverage: z2.number().int().positive().optional()
 }).strict();
+var TradeQueueMessageSchema = z2.object({
+  requestId: z2.string().min(1).max(128),
+  exchange: z2.string().min(1).max(64),
+  action: TradeActionSchema,
+  symbol: z2.string().min(1).max(32),
+  quantity: z2.number().positive().finite(),
+  price: z2.number().positive().finite().optional(),
+  leverage: z2.number().int().positive().max(125).optional(),
+  queuedAt: z2.string().min(1).max(64)
+}).strict();
 var TradeSignalSchema = z2.object({
   id: z2.number().int().positive().optional(),
   source: z2.string().min(1),
@@ -991,22 +1335,525 @@ function headersToObject(headers) {
   return result;
 }
 
+// src/queue-handler.ts
+function createQueueHandler(options) {
+  const { maxRetries, backoffDelays, onMessage, onRetry, onDLQ, logger } = options;
+  return async (batch) => {
+    for (const msg of batch.messages) {
+      const attemptNumber = msg.attempts || 0;
+      const logId = `[${msg.id}]`;
+      try {
+        logger?.info(`${logId} Processing message (attempt ${attemptNumber + 1})`);
+        await onMessage(msg.body, attemptNumber);
+        logger?.info(`${logId} Message processed successfully`);
+      } catch (error) {
+        const errorMsg = error instanceof Error ? error.message : String(error);
+        if (attemptNumber < maxRetries) {
+          const delaySeconds = backoffDelays[attemptNumber] ?? backoffDelays[backoffDelays.length - 1];
+          logger?.info(`${logId} Retrying in ${delaySeconds}s (attempt ${attemptNumber + 2}/${maxRetries + 1})`);
+          await onRetry?.(msg.body, attemptNumber, errorMsg, delaySeconds);
+          msg.retry({ delaySeconds });
+        } else {
+          logger?.error(`${logId} Max retries exceeded (${maxRetries + 1} attempts), moving to DLQ`);
+          await onDLQ?.(msg.body, attemptNumber, errorMsg);
+        }
+      }
+    }
+  };
+}
+
+// src/middleware/auth.ts
+function timingSafeEqual(a, b) {
+  const encoder = new TextEncoder;
+  const aBuf = encoder.encode(a);
+  const bBuf = encoder.encode(b);
+  const len = Math.max(aBuf.length, bBuf.length);
+  let result = aBuf.length === bBuf.length ? 0 : 1;
+  for (let i = 0;i < len; i++) {
+    const av = i < aBuf.length ? aBuf[i] : 0;
+    const bv = i < bBuf.length ? bBuf[i] : 0;
+    result |= av ^ bv;
+  }
+  return result === 0;
+}
+function resolveOperatorApiKey(env) {
+  const preferred = env.OPERATOR_API_KEY;
+  if (typeof preferred === "string" && preferred.length > 0) {
+    return preferred;
+  }
+  const legacy = env.INTERNAL_API_KEY;
+  if (typeof legacy === "string" && legacy.length > 0) {
+    return legacy;
+  }
+  return;
+}
+async function requireAuth(request, env) {
+  return requireOperatorAuth(request, env);
+}
+async function requireOperatorAuth(request, env) {
+  const apiKey = resolveOperatorApiKey(env);
+  if (!apiKey) {
+    return new Response(JSON.stringify({
+      error: "Operator API key not configured",
+      hint: "Set OPERATOR_API_KEY (preferred) or INTERNAL_API_KEY on the Worker"
+    }), { status: 401, headers: { "Content-Type": "application/json" } });
+  }
+  const authHeader = request.headers.get("Authorization");
+  const expectedHeader = `Bearer ${apiKey}`;
+  if (!authHeader || !timingSafeEqual(authHeader, expectedHeader)) {
+    return new Response(JSON.stringify({ error: "Unauthorized" }), {
+      status: 401,
+      headers: { "Content-Type": "application/json" }
+    });
+  }
+  return null;
+}
+function createOperatorAuthMiddleware() {
+  return async (request, env, _ctx) => {
+    const denied = await requireOperatorAuth(request, env);
+    if (denied)
+      return denied;
+    return;
+  };
+}
+function normalizeKeyNames(keyName) {
+  if (typeof keyName === "string") {
+    return [keyName];
+  }
+  return [...keyName];
+}
+function collectInternalAuthKeys(env, keyNames) {
+  const keys = [];
+  for (const name of normalizeKeyNames(keyNames)) {
+    const value = env[name];
+    if (typeof value === "string" && value.length > 0) {
+      keys.push(value);
+    }
+  }
+  return keys;
+}
+function matchesAnyInternalAuthKey(providedKey, expectedKeys) {
+  for (const expected of expectedKeys) {
+    if (timingSafeEqual(providedKey, expected)) {
+      return true;
+    }
+  }
+  return false;
+}
+function internalAuthNotConfiguredResponse(keyNames) {
+  const label = normalizeKeyNames(keyNames).join(" | ");
+  return new Response(JSON.stringify({
+    success: false,
+    error: `Internal auth key(s) not configured: ${label}`
+  }), { status: 401, headers: { "Content-Type": "application/json" } });
+}
+function requireInternalAuth(request, env, keyName = "INTERNAL_KEY_BINDING") {
+  const expectedKeys = collectInternalAuthKeys(env, keyName);
+  if (expectedKeys.length === 0) {
+    return internalAuthNotConfiguredResponse(keyName);
+  }
+  const providedKey = request.headers.get("X-Internal-Auth-Key");
+  if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
+    return new Response(JSON.stringify({ success: false, error: "Unauthorized" }), { status: 401, headers: { "Content-Type": "application/json" } });
+  }
+  return null;
+}
+function createInternalAuthMiddleware(keyName = "INTERNAL_KEY_BINDING") {
+  return async (request, env, _ctx) => {
+    const expectedKeys = collectInternalAuthKeys(env, keyName);
+    if (expectedKeys.length === 0) {
+      return internalAuthNotConfiguredResponse(keyName);
+    }
+    const providedKey = request.headers.get("X-Internal-Auth-Key");
+    if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
+      return new Response(JSON.stringify({ success: false, error: "Unauthorized" }), { status: 401, headers: { "Content-Type": "application/json" } });
+    }
+    return;
+  };
+}
+function checkInternalAuth(request, env, keyName = "INTERNAL_KEY_BINDING") {
+  const expectedKeys = collectInternalAuthKeys(env, keyName);
+  if (expectedKeys.length === 0) {
+    return {
+      authorized: false,
+      error: `${normalizeKeyNames(keyName).join(" | ")} not configured`
+    };
+  }
+  const providedKey = request.headers.get("X-Internal-Auth-Key");
+  if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
+    return { authorized: false, error: "Unauthorized" };
+  }
+  return { authorized: true };
+}
+
 // src/service-bindings.ts
+var InternalAuthKeyFields = {
+  DEFAULT: "INTERNAL_KEY_BINDING",
+  D1_READ: "D1_READ_KEY_BINDING",
+  D1_WRITE: "D1_WRITE_KEY_BINDING",
+  TRADE_EXECUTE: "TRADE_EXECUTE_KEY_BINDING",
+  TRADE_READ: "TRADE_READ_KEY_BINDING",
+  TELEGRAM_ALERT: "TELEGRAM_INTERNAL_KEY_BINDING",
+  WALLET_EXECUTE: "WALLET_EXECUTE_KEY_BINDING",
+  AGENT: "AGENT_INTERNAL_KEY",
+  D1_INTERNAL_ALIAS: "D1_INTERNAL_KEY",
+  TRADE_INTERNAL_ALIAS: "TRADE_INTERNAL_KEY",
+  TELEGRAM_INTERNAL_ALIAS: "TELEGRAM_INTERNAL_KEY"
+};
+var D1_READ_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.D1_READ,
+  InternalAuthKeyFields.DEFAULT
+];
+var D1_WRITE_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.D1_WRITE,
+  InternalAuthKeyFields.DEFAULT
+];
+var TRADE_EXECUTE_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.TRADE_EXECUTE,
+  InternalAuthKeyFields.DEFAULT,
+  InternalAuthKeyFields.AGENT
+];
+var TRADE_READ_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.TRADE_READ,
+  InternalAuthKeyFields.DEFAULT
+];
+var TELEGRAM_ALERT_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.TELEGRAM_ALERT,
+  InternalAuthKeyFields.DEFAULT
+];
+var WALLET_EXECUTE_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.WALLET_EXECUTE,
+  InternalAuthKeyFields.DEFAULT
+];
+var DASHBOARD_D1_READ_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.D1_READ,
+  InternalAuthKeyFields.D1_INTERNAL_ALIAS,
+  InternalAuthKeyFields.DEFAULT
+];
+var DASHBOARD_TRADE_EXECUTE_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.TRADE_EXECUTE,
+  InternalAuthKeyFields.TRADE_INTERNAL_ALIAS,
+  InternalAuthKeyFields.DEFAULT
+];
+var DASHBOARD_TELEGRAM_ALERT_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.TELEGRAM_ALERT,
+  InternalAuthKeyFields.TELEGRAM_INTERNAL_ALIAS,
+  InternalAuthKeyFields.DEFAULT
+];
+function resolveInternalAuthKey(env, keyFields) {
+  return collectInternalAuthKeys(env, keyFields)[0];
+}
+
+class ServiceAuthError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ServiceAuthError";
+  }
+}
+function authenticatedServiceFetch(binding, env, path, body, options) {
+  const key = options?.internalKey ?? (options?.internalKeyFields ? resolveInternalAuthKey(env, options.internalKeyFields) : env.INTERNAL_KEY_BINDING);
+  if (!key) {
+    const label = options?.internalKeyFields ? Array.isArray(options.internalKeyFields) ? options.internalKeyFields.join(" | ") : options.internalKeyFields : "INTERNAL_KEY_BINDING";
+    return Promise.reject(new ServiceAuthError(`${label} not configured`));
+  }
+  return serviceFetch(binding, path, body, {
+    method: options?.method,
+    timeout: options?.timeout,
+    headers: {
+      ...options?.headers,
+      "X-Internal-Auth-Key": key
+    }
+  });
+}
 function serviceFetch(binding, path, body, options) {
+  const timeout = options?.timeout ?? 30000;
   return binding.fetch(`http://internal${path}`, {
     method: options?.method ?? "POST",
     headers: {
       "Content-Type": "application/json",
       ...options?.headers
     },
-    body: body != null ? JSON.stringify(body) : undefined
+    body: body != null ? JSON.stringify(body) : undefined,
+    signal: AbortSignal.timeout(timeout)
   });
 }
 
-// src/session.ts
+// src/test-utils.ts
+function createMockKV(overrides) {
+  return {
+    get: async (_key) => null,
+    put: async (_key, _value, _options) => {},
+    delete: async (_key) => {},
+    list: async (_options) => ({
+      keys: []
+    }),
+    ...overrides
+  };
+}
+function createMockR2(overrides) {
+  return {
+    put: async (key, _value, _options) => ({
+      key
+    }),
+    get: async (_key) => null,
+    delete: async (_key) => {},
+    list: async (_options) => ({
+      objects: []
+    }),
+    ...overrides
+  };
+}
+function createMockPreparedStatement() {
+  return {
+    bind: (..._params) => createMockPreparedStatement(),
+    run: async () => ({ success: true }),
+    all: async () => ({ success: true, results: [] }),
+    first: async () => null
+  };
+}
+function createMockD1(overrides) {
+  return {
+    prepare: (_sql) => createMockPreparedStatement(),
+    dump: async () => new ArrayBuffer(0),
+    batch: async (_statements) => [],
+    exec: async (_sql) => ({ success: true }),
+    ...overrides
+  };
+}
+function createMockFetcher(response) {
+  const defaultResponse = response ?? new Response("OK", { status: 200 });
+  return {
+    fetch: async (_request, _init) => defaultResponse
+  };
+}
+function createMockAnalyticsEngine() {
+  return {
+    writeDataPoint: (_data) => {}
+  };
+}
+function createMockAnalyticsEngineDataset() {
+  return createMockAnalyticsEngine();
+}
+function createMockQueue() {
+  return {
+    send: async (_body, _options) => {},
+    sendBatch: async (_messages) => {}
+  };
+}
+function createMockVectorizeIndex(overrides) {
+  return {
+    query: async (_vector, _options) => ({
+      matches: []
+    }),
+    upsert: async (_vectors) => {},
+    deleteByIds: async (_ids) => {},
+    describe: async () => ({ dimension: 384, totalVectors: 0 }),
+    ...overrides
+  };
+}
+function createMockAi(overrides) {
+  return {
+    run: async (_model, _input) => ({}),
+    ...overrides
+  };
+}
+function createMockExecutionContext(overrides) {
+  return {
+    waitUntil: (_promise) => {},
+    passThroughOnException: () => {},
+    ...overrides
+  };
+}
+function createMockSecretsStore(overrides) {
+  return {
+    get: async (_key) => null,
+    put: async (_key, _value) => {},
+    delete: async (_key) => {},
+    ...overrides
+  };
+}
+function createMockEnv(overrides) {
+  return overrides;
+}
+
+// src/path-utils.ts
+import { existsSync as existsSync2 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join2 } from "path";
-var SESSION_FILE = join2(homedir2(), ".hoox", "session.json");
+import { dirname, join as join2, resolve } from "path";
+function createHooxPath(path) {
+  return path;
+}
+function getHooxHome() {
+  try {
+    const override = process.env.HOOX_HOME?.trim();
+    if (override) {
+      return createHooxPath(resolve(override));
+    }
+    const home = homedir2();
+    if (!home || home.length === 0) {
+      return createHooxPath(resolve(process.cwd(), ".hoox"));
+    }
+    return createHooxPath(join2(home, ".hoox"));
+  } catch {
+    return createHooxPath(resolve(process.cwd(), ".hoox"));
+  }
+}
+function isHooxSetupRoot(dir) {
+  if (!dir)
+    return false;
+  try {
+    const root = resolve(dir);
+    return existsSync2(join2(root, "wrangler.jsonc")) && existsSync2(join2(root, "packages", "cli", "package.json"));
+  } catch {
+    return false;
+  }
+}
+function findHooxSetupRoot(startDir = process.cwd()) {
+  let dir = resolve(startDir);
+  for (;; ) {
+    if (isHooxSetupRoot(dir))
+      return dir;
+    const parent = dirname(dir);
+    if (parent === dir)
+      return null;
+    dir = parent;
+  }
+}
+function resolveHooxRuntimeRoot(options) {
+  const env = options?.env ?? process.env;
+  const cwd = resolve(options?.cwd ?? process.cwd());
+  const globalRepo = getHooxRepoPath();
+  const envRepo = env.HOOX_REPO?.trim();
+  if (envRepo) {
+    const resolved = resolve(envRepo);
+    if (isHooxSetupRoot(resolved)) {
+      return {
+        root: resolved,
+        source: "env",
+        checked: {
+          env: resolved,
+          cwd: findHooxSetupRoot(cwd),
+          global: globalRepo
+        }
+      };
+    }
+    return {
+      root: null,
+      source: "env",
+      checked: {
+        env: resolved,
+        cwd: findHooxSetupRoot(cwd),
+        global: globalRepo
+      }
+    };
+  }
+  const local = findHooxSetupRoot(cwd);
+  if (local) {
+    return {
+      root: local,
+      source: "cwd",
+      checked: { cwd: local, global: globalRepo }
+    };
+  }
+  if (isHooxSetupRoot(globalRepo)) {
+    return {
+      root: globalRepo,
+      source: "global",
+      checked: { cwd: null, global: globalRepo }
+    };
+  }
+  return {
+    root: null,
+    source: "none",
+    checked: { cwd: null, global: globalRepo }
+  };
+}
+function getTuiEntryCandidates(runtimeRoot) {
+  const root = resolve(runtimeRoot);
+  return [
+    join2(root, "packages", "tui", "src", "main.tsx"),
+    join2(root, "packages", "tui", "dist", "main.js"),
+    join2(root, "packages", "tui", "src", "main.ts")
+  ];
+}
+function resolveHooxPath(relativePath) {
+  if (!relativePath || typeof relativePath !== "string") {
+    throw new Error("relativePath must be a non-empty string");
+  }
+  if (relativePath.includes("..")) {
+    throw new Error(`Path traversal detected in relativePath: "${relativePath}"`);
+  }
+  const normalizedPath = relativePath.replace(/\\/g, "/");
+  const hooxHome = getHooxHome();
+  const fullPath = join2(hooxHome, normalizedPath);
+  const resolvedPath = resolve(fullPath);
+  const resolvedHome = resolve(hooxHome);
+  if (!resolvedPath.startsWith(resolvedHome)) {
+    throw new Error(`Resolved path "${resolvedPath}" is outside Hoox home directory`);
+  }
+  return createHooxPath(resolvedPath);
+}
+function isWithinHooxHome(path) {
+  try {
+    const hooxHome = getHooxHome();
+    const resolvedPath = resolve(path);
+    const resolvedHome = resolve(hooxHome);
+    return resolvedPath.startsWith(resolvedHome);
+  } catch {
+    return false;
+  }
+}
+function getRelativeHooxPath(absolutePath) {
+  try {
+    if (!isWithinHooxHome(absolutePath)) {
+      return null;
+    }
+    const hooxHome = getHooxHome();
+    const resolvedPath = resolve(absolutePath);
+    const resolvedHome = resolve(hooxHome);
+    const relativePath = resolvedPath.slice(resolvedHome.length);
+    return relativePath.startsWith("/") || relativePath.startsWith("\\") ? relativePath.slice(1) : relativePath;
+  } catch {
+    return null;
+  }
+}
+function getHooxRepoPath() {
+  return resolveHooxPath("repo");
+}
+function getHooxConfigDir() {
+  return resolveHooxPath("config");
+}
+function getHooxDataDir() {
+  return resolveHooxPath("data");
+}
+function getHooxWranglerPath() {
+  return resolveHooxPath("config/wrangler.jsonc");
+}
+function getHooxStatePath() {
+  return resolveHooxPath("data/state.json");
+}
+
+// src/session.ts
+import { z as z3 } from "zod";
+var SessionStateFileSchema = z3.object({
+  activeView: z3.string().optional(),
+  sidebarExpanded: z3.boolean().optional(),
+  windowSize: z3.object({
+    cols: z3.number().int().positive(),
+    rows: z3.number().int().positive()
+  }).optional(),
+  lastData: z3.number().nonnegative().optional(),
+  savedAt: z3.string().optional()
+}).strict();
+var TUI_STATE_DIR = ".tui-state";
+var SESSION_FILE = (() => {
+  try {
+    const hooxHome = getHooxHome();
+    return `${hooxHome}/${TUI_STATE_DIR}/session.json`;
+  } catch {
+    return `${process.cwd()}/${TUI_STATE_DIR}/session.json`;
+  }
+})();
 var DEFAULT_SESSION = {
   activeView: "dashboard",
   sidebarExpanded: true,
@@ -1035,7 +1882,8 @@ async function restoreSession() {
     if (!exists)
       return { ...DEFAULT_SESSION };
     const raw = await file.text();
-    const parsed = JSON.parse(raw);
+    const result = SessionStateFileSchema.safeParse(JSON.parse(raw));
+    const parsed = result.success ? result.data : {};
     return {
       activeView: validateViewId(parsed.activeView) ? parsed.activeView : DEFAULT_SESSION.activeView,
       sidebarExpanded: typeof parsed.sidebarExpanded === "boolean" ? parsed.sidebarExpanded : DEFAULT_SESSION.sidebarExpanded,
@@ -1223,7 +2071,7 @@ var BASE_WORKERS = {
     path: "workers/d1-worker",
     vars: { database_name: "hoox-db" }
   },
-  hoox: { enabled: true, path: "workers/hoox", vars: {} },
+  hoox: { enabled: true, path: "workers/hoox-worker", vars: {} },
   "agent-worker": { enabled: true, path: "workers/agent-worker", vars: {} },
   "analytics-worker": {
     enabled: true,
@@ -1543,6 +2391,7 @@ class WizardEngine {
     }
   }
 }
+
 // src/wizard/persistence.ts
 function serializeState(state) {
   return JSON.stringify(state, null, 2);
@@ -1573,7 +2422,7 @@ function deriveCalledBy(manifests) {
 var manifests = {
   hoox: {
     name: "hoox",
-    path: "workers/hoox",
+    path: "workers/hoox-worker",
     vars: {
       WEBHOOK_API_KEY_BINDING: {
         type: "secret",
@@ -1917,6 +2766,7 @@ var manifests = {
 var CALLED_BY = deriveCalledBy(manifests);
 var WORKER_MANIFESTS = manifests;
 var WORKER_NAMES = Object.keys(manifests).sort();
+
 // src/schemas/validators.ts
 import { parse } from "jsonc-parser";
 function validateWranglerJsonc(workerName, manifest, jsoncContent) {
@@ -1942,7 +2792,8 @@ function validateWranglerJsonc(workerName, manifest, jsoncContent) {
     });
     return errors;
   }
-  const declaredVars = parsed?.vars ?? {};
+  const wrangler = parsed;
+  const declaredVars = wrangler.vars ?? {};
   for (const [name, def] of Object.entries(manifest.vars)) {
     if (!(name in declaredVars)) {
       errors.push({
@@ -1963,7 +2814,7 @@ function validateWranglerJsonc(workerName, manifest, jsoncContent) {
       });
     }
   }
-  const declaredServices = parsed?.services ?? [];
+  const declaredServices = wrangler.services ?? [];
   for (const expected of manifest.services) {
     const match = declaredServices.find((s) => s.binding === expected.binding && s.service === expected.service);
     if (!match) {
@@ -2019,7 +2870,8 @@ function validateRootSecrets(workerName, manifest, rootJsoncContent) {
     });
     return errors;
   }
-  const rootSecrets = parsed?.workers?.[workerName]?.secrets ?? [];
+  const rootWrangler = parsed;
+  const rootSecrets = rootWrangler.workers?.[workerName]?.secrets ?? [];
   const expectedSecrets = Object.entries(manifest.vars).filter(([_, def]) => def.type === "secret").map(([name]) => name);
   for (const expected of expectedSecrets) {
     if (!rootSecrets.includes(expected)) {
@@ -2226,6 +3078,13 @@ var useUIStore = create()(immer((set) => ({
 // src/stores/service-store.ts
 import { create as create2 } from "zustand";
 import { immer as immer2 } from "zustand/middleware/immer";
+function summarizeCliError(details) {
+  const raw = details.stderr.trim() || details.stdout.trim() || details.command || "Unknown CLI error";
+  const firstLine = raw.split(`
+`, 1)[0] ?? "";
+  const trimmed = firstLine.slice(0, 120).trimEnd();
+  return trimmed.length > 0 ? trimmed : details.command;
+}
 var BACKOFF_SEQUENCE = [1000, 2000, 4000, 8000, 16000];
 var MAX_RETRIES2 = 5;
 function ringPush(arr, item, max) {
@@ -2246,6 +3105,7 @@ var initialState2 = {
   selectedWorkerId: null,
   retryCount: 0,
   lastError: null,
+  lastErrorDetails: null,
   lastSuccessfulFetch: 0,
   reconnectDelay: 0,
   disconnectedAt: null
@@ -2261,7 +3121,7 @@ var useServiceStore = create2()(immer2((set, get) => ({
   fetchWorkers: async () => {
     const { hooxFetch: hooxFetch2 } = await Promise.resolve().then(() => (init_api_client(), exports_api_client));
     try {
-      const data = await hooxFetch2("/workers");
+      const data = await hooxFetch2("/v1/workers");
       set((state) => {
         state.workers = data;
         state.lastUpdated = Date.now();
@@ -2270,27 +3130,42 @@ var useServiceStore = create2()(immer2((set, get) => ({
           state.connectionStatus = "connected";
           state.retryCount = 0;
           state.lastError = null;
+          state.lastErrorDetails = null;
           state.reconnectDelay = 0;
           state.disconnectedAt = null;
         }
       });
     } catch (error) {
       const msg = error instanceof Error ? error.message : "Unknown fetch error";
+      get().addAlert({
+        id: crypto.randomUUID(),
+        type: "connection",
+        severity: "error",
+        message: msg,
+        timestamp: Date.now(),
+        acknowledged: false
+      });
       set((state) => {
+        state.lastError = msg;
+        state.disconnectedAt = state.disconnectedAt ?? Date.now();
         if (state.connectionStatus === "connected" || state.connectionStatus === "polling") {
           state.connectionStatus = "reconnecting";
           state.retryCount = state.retryCount + 1;
-          state.lastError = msg;
-          state.disconnectedAt = state.disconnectedAt ?? Date.now();
           if (state.retryCount >= MAX_RETRIES2) {
             state.connectionStatus = "offline";
             state.lastError = `Connection lost after ${MAX_RETRIES2} retries`;
           } else {
             state.reconnectDelay = getBackoffDelay(state.retryCount);
           }
-        }
-        if (state.connectionStatus === "reconnecting") {
-          state.lastError = msg;
+        } else if (state.connectionStatus === "reconnecting") {
+          state.retryCount = state.retryCount + 1;
+          if (state.retryCount >= MAX_RETRIES2) {
+            state.connectionStatus = "offline";
+            state.lastError = `Connection lost after ${MAX_RETRIES2} retries`;
+            state.reconnectDelay = 0;
+          } else {
+            state.reconnectDelay = getBackoffDelay(state.retryCount);
+          }
         }
       });
     }
@@ -2298,18 +3173,40 @@ var useServiceStore = create2()(immer2((set, get) => ({
   streamTrades: async () => {
     const { subscribeSSE: subscribeSSE2 } = await Promise.resolve().then(() => (init_sse(), exports_sse));
     try {
-      await subscribeSSE2("/trades/stream", (trade) => {
+      await subscribeSSE2("/v1/trades/stream", (trade) => {
         get().pushTrade(trade);
       });
-    } catch {}
+    } catch (error) {
+      const msg = error instanceof Error ? error.message : "SSE trade stream failed";
+      get().addAlert({
+        id: crypto.randomUUID(),
+        type: "connection",
+        severity: "error",
+        message: msg,
+        timestamp: Date.now(),
+        acknowledged: false
+      });
+      get().handleConnectionFailure(msg);
+    }
   },
   streamLogs: async () => {
     const { subscribeSSE: subscribeSSE2 } = await Promise.resolve().then(() => (init_sse(), exports_sse));
     try {
-      await subscribeSSE2("/logs/stream", (log) => {
+      await subscribeSSE2("/v1/logs/stream", (log) => {
         get().pushLog(log);
       });
-    } catch {}
+    } catch (error) {
+      const msg = error instanceof Error ? error.message : "SSE log stream failed";
+      get().addAlert({
+        id: crypto.randomUUID(),
+        type: "connection",
+        severity: "error",
+        message: msg,
+        timestamp: Date.now(),
+        acknowledged: false
+      });
+      get().handleConnectionFailure(msg);
+    }
   },
   addAlert: (alert) => set((state) => {
     state.alerts = ringPush(state.alerts, alert, MAX_ALERTS);
@@ -2322,6 +3219,7 @@ var useServiceStore = create2()(immer2((set, get) => ({
     if (status === "connected") {
       state.retryCount = 0;
       state.lastError = null;
+      state.lastErrorDetails = null;
       state.reconnectDelay = 0;
       state.disconnectedAt = null;
     }
@@ -2351,11 +3249,10 @@ var useServiceStore = create2()(immer2((set, get) => ({
     state.lastSuccessfulFetch = Date.now();
     state.retryCount = 0;
     state.lastError = null;
+    state.lastErrorDetails = null;
     state.reconnectDelay = 0;
     state.disconnectedAt = null;
-    if (state.connectionStatus === "reconnecting" || state.connectionStatus === "polling") {
-      state.connectionStatus = "connected";
-    }
+    state.connectionStatus = "connected";
   }),
   handleConnectionFailure: (errorMessage) => set((state) => {
     state.lastError = errorMessage;
@@ -2378,6 +3275,7 @@ var useServiceStore = create2()(immer2((set, get) => ({
   resetRetries: () => set((state) => {
     state.retryCount = 0;
     state.lastError = null;
+    state.lastErrorDetails = null;
     state.reconnectDelay = 0;
     state.disconnectedAt = null;
   }),
@@ -2386,8 +3284,30 @@ var useServiceStore = create2()(immer2((set, get) => ({
       state.connectionStatus = "polling";
       state.retryCount = 0;
       state.lastError = null;
+      state.lastErrorDetails = null;
       state.reconnectDelay = 0;
     }
+  }),
+  setLastErrorDetails: (details) => set((state) => {
+    state.lastErrorDetails = details;
+    state.lastError = details === null ? null : summarizeCliError(details);
+  }),
+  clearError: () => set((state) => {
+    state.lastError = null;
+    state.lastErrorDetails = null;
+  }),
+  addCliErrorAlert: (details) => set((state) => {
+    state.lastErrorDetails = details;
+    state.lastError = summarizeCliError(details);
+    const summary = summarizeCliError(details);
+    state.alerts = ringPush(state.alerts, {
+      id: crypto.randomUUID(),
+      type: "connection",
+      severity: "error",
+      message: `CLI failure: ${summary}`,
+      timestamp: Date.now(),
+      acknowledged: false
+    }, MAX_ALERTS);
   })
 })));
 
@@ -2395,6 +3315,7 @@ var useServiceStore = create2()(immer2((set, get) => ({
 import { create as create3 } from "zustand";
 import { immer as immer3 } from "zustand/middleware/immer";
 import { persist, createJSONStorage } from "zustand/middleware";
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, existsSync as existsSync3 } from "fs";
 import { homedir as homedir3 } from "os";
 import { join as join3 } from "path";
 var bunConfigStorage = {
@@ -2411,11 +3332,17 @@ var bunConfigStorage = {
   },
   setItem: async (_name, value) => {
     const dir = join3(homedir3(), ".hoox");
+    if (!existsSync3(dir)) {
+      mkdirSync2(dir, { recursive: true, mode: HOOX_DIR_MODE });
+    }
     try {
-      await Bun.file(dir).exists();
+      chmodSync2(dir, HOOX_DIR_MODE);
     } catch {}
     const filePath = join3(dir, "config.json");
     await Bun.write(filePath, value);
+    try {
+      chmodSync2(filePath, HOOX_CONFIG_FILE_MODE);
+    } catch {}
   },
   removeItem: async (_name) => {}
 };
@@ -2507,7 +3434,9 @@ var useConfigStore = create3()(persist(immer3((set) => ({
 // src/index.ts
 init_api_client();
 init_sse();
+init_operator_transport();
 export {
+  writeSecureFileSync,
   writeConfigSync,
   writeConfig,
   validateWranglerJsonc,
@@ -2525,13 +3454,31 @@ export {
   serializeState,
   saveSession,
   restoreSession,
+  resolveOperatorTransportProfile,
+  resolveInternalAuthKey,
+  resolveHooxRuntimeRoot,
+  resolveHooxPath,
   resolveDependencies,
   readConfigSync,
   readConfig,
+  operatorUrl,
   logKvTimestamp,
+  isWithinHooxHome,
+  isUnixModeGroupOrWorldAccessible,
+  isHooxSetupRoot,
+  isConfigWorldOrGroupReadable,
   hooxFetch,
   healthCheck,
   headersToObject,
+  hasOperatorClientCredentials,
+  getTuiEntryCandidates,
+  getRelativeHooxPath,
+  getHooxWranglerPath,
+  getHooxStatePath,
+  getHooxRepoPath,
+  getHooxHome,
+  getHooxDataDir,
+  getHooxConfigDir,
   generateWranglerJsonc,
   generateDevVars,
   formatUptime,
@@ -2547,11 +3494,31 @@ export {
   formatDuration2 as formatDuration,
   formatCurrency,
   formatCpu,
+  formatConfigPermissionWarning,
   formatCompactCurrency,
+  findHooxSetupRoot,
+  ensureHooxDirSecure,
   deserializeState,
   createSuccessResponse,
+  createQueueHandler,
+  createMockVectorizeIndex,
+  createMockSecretsStore,
+  createMockR2,
+  createMockQueue,
+  createMockKV,
+  createMockFetcher,
+  createMockExecutionContext,
+  createMockEnv,
+  createMockD1,
+  createMockAnalyticsEngineDataset,
+  createMockAnalyticsEngine,
+  createMockAi,
   createJsonResponse,
   createErrorResponse,
+  createCronHandler,
+  buildOperatorAuthHeaders,
+  authenticatedServiceFetch,
+  WorkerStatusColor,
   WorkerAPIError,
   WizardEngine,
   WebhookPayloadSchema,
@@ -2559,23 +3526,41 @@ export {
   WORKER_MANIFESTS,
   WORKER_DEPENDENCIES,
   WIZARD_STATE_PATH,
+  WALLET_EXECUTE_AUTH_KEY_FIELDS,
   TradeSignalSchema,
+  TradeQueueMessageSchema,
   TradeActionSchema,
+  TRADE_READ_AUTH_KEY_FIELDS,
+  TRADE_EXECUTE_AUTH_KEY_FIELDS,
   TRADEMARK_NOTICE,
   TRADEMARKS,
+  TELEGRAM_ALERT_AUTH_KEY_FIELDS,
+  ServiceAuthError,
   PositionSchema,
   PRESETS,
+  LogLevelColor,
   KVKeys,
+  InternalAuthKeyFields,
   INTEGRATIONS,
+  HOOX_DIR_MODE,
+  HOOX_CONFIG_FILE_MODE,
   FULL_LEGAL_NOTICE,
   ExchangeRouter,
   Errors,
   DISCLAIMER_HEADER,
   DISCLAIMER,
+  DASHBOARD_TRADE_EXECUTE_AUTH_KEY_FIELDS,
+  DASHBOARD_TELEGRAM_ALERT_AUTH_KEY_FIELDS,
+  DASHBOARD_D1_READ_AUTH_KEY_FIELDS,
+  D1_WRITE_AUTH_KEY_FIELDS,
+  D1_READ_AUTH_KEY_FIELDS,
   D1Repository,
+  CoolBracketPalette,
+  ConnectionStatusColor,
   Colors,
   COPYRIGHT,
   CALLED_BY,
-  BaseExchangeClient,
-  BalanceSchema
+  BaseExchangeClient2 as BaseExchangeClient,
+  BalanceSchema,
+  AlertSeverityColor
 };