@jango-blockchained/hoox-shared 1.0.9 → 1.1.0

package/dist/index.js

@@ -15,6 +15,69 @@ var __export = (target, all) => {
 };
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 
+// src/operator-transport.ts
+function stripTrailingSlashes(url) {
+  return url.replace(/\/+$/, "");
+}
+function parseTransport(raw) {
+  if (!raw)
+    return null;
+  const v = raw.trim().toLowerCase();
+  if (VALID_TRANSPORTS.has(v)) {
+    return v;
+  }
+  return null;
+}
+function resolveOperatorTransportProfile(env = process.env, options = {}) {
+  const accessClientId = env.CF_ACCESS_CLIENT_ID?.trim() ?? "";
+  const accessClientSecret = env.CF_ACCESS_CLIENT_SECRET?.trim() ?? "";
+  const hasAccess = Boolean(accessClientId && accessClientSecret);
+  const explicit = parseTransport(env.HOOX_TRANSPORT) ?? parseTransport(options.configTransport);
+  const transport = explicit ?? (hasAccess ? "access" : "public");
+  const apiFromEnv = env.HOOX_API_URL?.trim();
+  const apiFromConfig = options.configApiUrl?.trim();
+  const tokenFromEnv = env.HOOX_API_TOKEN?.trim();
+  const tokenFromConfig = options.configApiToken?.trim();
+  return {
+    transport,
+    apiBase: stripTrailingSlashes(apiFromEnv || apiFromConfig || DEFAULT_API_BASE),
+    bearerToken: tokenFromEnv || tokenFromConfig || "",
+    accessClientId,
+    accessClientSecret
+  };
+}
+function buildOperatorAuthHeaders(profile) {
+  const headers = {};
+  if (profile.bearerToken) {
+    headers.Authorization = `Bearer ${profile.bearerToken}`;
+  }
+  const useAccessHeaders = profile.transport === "access" || Boolean(profile.accessClientId) && Boolean(profile.accessClientSecret);
+  if (useAccessHeaders && profile.accessClientId && profile.accessClientSecret) {
+    headers["CF-Access-Client-Id"] = profile.accessClientId;
+    headers["CF-Access-Client-Secret"] = profile.accessClientSecret;
+  }
+  return headers;
+}
+function hasOperatorClientCredentials(profile) {
+  if (profile.bearerToken)
+    return true;
+  return Boolean(profile.accessClientId && profile.accessClientSecret);
+}
+function operatorUrl(profile, path) {
+  const base = profile.apiBase.replace(/\/+$/, "");
+  const p = path.startsWith("/") ? path : `/${path}`;
+  return `${base}${p}`;
+}
+var DEFAULT_API_BASE = "http://localhost:8787", VALID_TRANSPORTS;
+var init_operator_transport = __esm(() => {
+  VALID_TRANSPORTS = new Set([
+    "public",
+    "access",
+    "mtls",
+    "tunnel"
+  ]);
+});
+
 // src/api-client.ts
 var exports_api_client = {};
 __export(exports_api_client, {
@@ -40,20 +103,25 @@ function isNetworkError(error) {
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
+function activeProfile(override) {
+  return override ?? resolveOperatorTransportProfile();
+}
 async function hooxFetch(path, options) {
+  const profile = options?.transport ?? (options?.transportEnv ? resolveOperatorTransportProfile(options.transportEnv) : activeProfile());
+  const { transport: _t, transportEnv: _e, ...fetchInit } = options ?? {};
   let lastError;
   for (let attempt = 0;attempt <= MAX_RETRIES; attempt++) {
     const controller = new AbortController;
     const timeoutId = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
     try {
-      const url = `${API_BASE}${path}`;
+      const url = operatorUrl(profile, path);
       const headers = {
         "Content-Type": "application/json",
-        ...API_TOKEN ? { Authorization: `Bearer ${API_TOKEN}` } : {},
-        ...options?.headers
+        ...buildOperatorAuthHeaders(profile),
+        ...fetchInit.headers
       };
       const response = await fetch(url, {
-        ...options,
+        ...fetchInit,
         headers,
         signal: controller.signal
       });
@@ -101,10 +169,9 @@ async function hooxFetch(path, options) {
     retryable: false
   });
 }
-var API_BASE, API_TOKEN, FETCH_TIMEOUT_MS = 5000, MAX_RETRIES = 3, BASE_RETRY_DELAY_MS = 1000, MAX_RETRY_DELAY_MS = 16000, WorkerAPIError;
+var FETCH_TIMEOUT_MS = 5000, MAX_RETRIES = 3, BASE_RETRY_DELAY_MS = 1000, MAX_RETRY_DELAY_MS = 16000, WorkerAPIError;
 var init_api_client = __esm(() => {
-  API_BASE = process.env.HOOX_API_URL || "http://localhost:8787";
-  API_TOKEN = process.env.HOOX_API_TOKEN || "";
+  init_operator_transport();
   WorkerAPIError = class WorkerAPIError extends Error {
     status;
     retryable;
@@ -122,17 +189,18 @@ var exports_sse = {};
 __export(exports_sse, {
   subscribeSSE: () => subscribeSSE
 });
-function subscribeSSE(path, callback, onStatus) {
+function subscribeSSE(path, callback, onStatus, options) {
   let aborted = false;
+  const profile = options?.transport ?? (options?.transportEnv ? resolveOperatorTransportProfile(options.transportEnv) : resolveOperatorTransportProfile());
   const run = async () => {
     let attempt = 0;
     while (!aborted && attempt < MAX_RECONNECT_ATTEMPTS) {
       try {
-        const url = `${API_BASE2}${path}`;
+        const url = operatorUrl(profile, path);
         const response = await fetch(url, {
           headers: {
             Accept: "text/event-stream",
-            ...API_TOKEN2 ? { Authorization: `Bearer ${API_TOKEN2}` } : {}
+            ...buildOperatorAuthHeaders(profile)
           }
         });
         if (!response.ok || !response.body) {
@@ -161,7 +229,7 @@ function subscribeSSE(path, callback, onStatus) {
             }
           }
         }
-      } catch (_error) {
+      } catch {
         if (aborted)
           break;
         onStatus?.("reconnecting");
@@ -181,21 +249,31 @@ function subscribeSSE(path, callback, onStatus) {
     }
   };
 }
-var API_BASE2, API_TOKEN2, RECONNECT_BASE_MS = 1000, RECONNECT_MAX_MS = 16000, MAX_RECONNECT_ATTEMPTS = 10;
+var RECONNECT_BASE_MS = 1000, RECONNECT_MAX_MS = 16000, MAX_RECONNECT_ATTEMPTS = 10;
 var init_sse = __esm(() => {
-  API_BASE2 = process.env.HOOX_API_URL || "http://localhost:8787";
-  API_TOKEN2 = process.env.HOOX_API_TOKEN || "";
+  init_operator_transport();
 });
 
 // src/analytics.ts
-async function trackAnalytics(env, endpoint, body) {
+async function trackAnalytics(env, endpoint, body, options) {
   if (!env.ANALYTICS_SERVICE)
     return;
   try {
+    const payload = {
+      ...body,
+      ...options?.indexes ? { indexes: [...options.indexes] } : {}
+    };
+    const headers = {
+      "Content-Type": "application/json"
+    };
+    const internalKey = env.INTERNAL_KEY_BINDING;
+    if (internalKey) {
+      headers["X-Internal-Auth-Key"] = internalKey;
+    }
     await env.ANALYTICS_SERVICE.fetch(new Request(`http://localhost${endpoint}`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(body)
+      headers,
+      body: JSON.stringify(payload)
     }));
   } catch (e) {
     console.error("Analytics tracking failed:", e);
@@ -204,35 +282,81 @@ async function trackAnalytics(env, endpoint, body) {
 
 // src/colors.ts
 var Colors = {
-  background: "#0D1117",
-  foreground: "#EEEEEE",
-  card: "#1C1C1F",
-  border: "#484848",
-  muted: "#A0A0A0",
-  "muted-foreground": "#6E6E6E",
-  dim: "#3B3B3D",
-  accent: "#E8780A",
-  "accent-dim": "#B85E08",
-  success: "#00FF88",
-  warning: "#FFAA00",
-  error: "#FF4444",
-  info: "#4488FF",
-  text: "#EEEEEE",
-  "text-muted": "#A0A0A0",
-  panel: "#1C1C1F",
-  divider: "#484848",
-  highlight: "#E8780A"
+  background: "#050508",
+  foreground: "#E8E8F0",
+  card: "#0A0A0F",
+  border: "#232330",
+  muted: "#8B8B9E",
+  "muted-foreground": "#6E6E84",
+  dim: "#3C3C50",
+  accent: "#818CF8",
+  "accent-dim": "#6366F1",
+  success: "#34D399",
+  warning: "#FBBF24",
+  error: "#FB7185",
+  info: "#38BDF8",
+  text: "#E8E8F0",
+  "text-muted": "#8B8B9E",
+  panel: "#0A0A0F",
+  divider: "#232330",
+  highlight: "#22D3EE",
+  backdrop: "#000000"
+};
+var CoolBracketPalette = [
+  "#22D3EE",
+  "#38BDF8",
+  "#60A5FA",
+  "#818CF8",
+  "#A78BFA",
+  "#C084FC",
+  "#E879F9",
+  "#A78BFA",
+  "#818CF8",
+  "#38BDF8"
+];
+var ConnectionStatusColor = {
+  connected: Colors.success,
+  polling: Colors.highlight,
+  reconnecting: Colors.warning,
+  offline: Colors.error
+};
+var WorkerStatusColor = {
+  operational: Colors.success,
+  degraded: Colors.warning,
+  down: Colors.error
+};
+var LogLevelColor = {
+  error: Colors.error,
+  warn: Colors.warning,
+  info: Colors.foreground,
+  debug: Colors.muted
+};
+var AlertSeverityColor = {
+  info: Colors.info,
+  warning: Colors.warning,
+  error: Colors.error,
+  critical: Colors.error
 };
 
 // src/config.ts
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
+import {
+  readFileSync,
+  writeFileSync,
+  existsSync,
+  mkdirSync,
+  chmodSync,
+  statSync
+} from "fs";
 import { join } from "path";
 import { homedir } from "os";
 var HOX_DIR = join(homedir(), ".hoox");
 var CONFIG_PATH = join(HOX_DIR, "config.json");
+var HOOX_DIR_MODE = 448;
+var HOOX_CONFIG_FILE_MODE = 384;
 var DEFAULT_CONFIG = {
   apiUrl: "http://localhost:8787",
   apiToken: "",
+  transport: "public",
   refreshIntervalMs: 500,
   theme: "dark",
   activeExchanges: ["binance", "bybit", "mexc"],
@@ -265,12 +389,41 @@ function readConfigSync() {
 async function readConfig() {
   return readConfigSync();
 }
+function ensureHooxDirSecure(dir = HOX_DIR) {
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true, mode: HOOX_DIR_MODE });
+  }
+  try {
+    chmodSync(dir, HOOX_DIR_MODE);
+  } catch {}
+}
+function writeSecureFileSync(filePath, contents, mode = HOOX_CONFIG_FILE_MODE) {
+  writeFileSync(filePath, contents, { encoding: "utf-8", mode });
+  try {
+    chmodSync(filePath, mode);
+  } catch {}
+}
+function isUnixModeGroupOrWorldAccessible(mode) {
+  return (mode & 63) !== 0;
+}
+function isConfigWorldOrGroupReadable(filePath = CONFIG_PATH) {
+  try {
+    if (!existsSync(filePath))
+      return false;
+    return isUnixModeGroupOrWorldAccessible(statSync(filePath).mode & 511);
+  } catch {
+    return false;
+  }
+}
+function formatConfigPermissionWarning(filePath = CONFIG_PATH) {
+  if (!isConfigWorldOrGroupReadable(filePath))
+    return null;
+  return `Warning: ${filePath} is group/world-accessible. ` + `Run: chmod 600 ${filePath}  (and chmod 700 on the parent dir). ` + `This file may contain apiToken / operator secrets.`;
+}
 function writeConfigSync(config) {
   try {
-    if (!existsSync(HOX_DIR)) {
-      mkdirSync(HOX_DIR, { recursive: true });
-    }
-    writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2), "utf-8");
+    ensureHooxDirSecure(HOX_DIR);
+    writeSecureFileSync(CONFIG_PATH, JSON.stringify(config, null, 2), HOOX_CONFIG_FILE_MODE);
   } catch (err) {
     console.error("Failed to write config:", err);
   }
@@ -278,6 +431,12 @@ function writeConfigSync(config) {
 async function writeConfig(config) {
   writeConfigSync(config);
 }
+var VALID_TRANSPORTS2 = new Set([
+  "public",
+  "access",
+  "mtls",
+  "tunnel"
+]);
 function validateConfig(config) {
   const errors = [];
   if (config.apiUrl && !config.apiUrl.startsWith("http")) {
@@ -289,6 +448,9 @@ function validateConfig(config) {
   if (config.theme && !["dark", "light"].includes(config.theme)) {
     errors.push('theme must be "dark" or "light"');
   }
+  if (config.transport !== undefined && !VALID_TRANSPORTS2.has(config.transport)) {
+    errors.push('transport must be "public" | "access" | "mtls" | "tunnel"');
+  }
   return errors;
 }
 
@@ -598,6 +760,7 @@ class D1Repository {
     }
   }
 }
+
 // src/d1/schemas.ts
 import { z } from "zod";
 var TradeRecordSchema = z.object({
@@ -1048,6 +1211,16 @@ var WebhookPayloadSchema = z2.object({
   orderType: z2.string().optional(),
   leverage: z2.number().int().positive().optional()
 }).strict();
+var TradeQueueMessageSchema = z2.object({
+  requestId: z2.string().min(1).max(128),
+  exchange: z2.string().min(1).max(64),
+  action: TradeActionSchema,
+  symbol: z2.string().min(1).max(32),
+  quantity: z2.number().positive().finite(),
+  price: z2.number().positive().finite().optional(),
+  leverage: z2.number().int().positive().max(125).optional(),
+  queuedAt: z2.string().min(1).max(64)
+}).strict();
 var TradeSignalSchema = z2.object({
   id: z2.number().int().positive().optional(),
   source: z2.string().min(1),
@@ -1189,7 +1362,209 @@ function createQueueHandler(options) {
   };
 }
 
+// src/middleware/auth.ts
+function timingSafeEqual(a, b) {
+  const encoder = new TextEncoder;
+  const aBuf = encoder.encode(a);
+  const bBuf = encoder.encode(b);
+  const len = Math.max(aBuf.length, bBuf.length);
+  let result = aBuf.length === bBuf.length ? 0 : 1;
+  for (let i = 0;i < len; i++) {
+    const av = i < aBuf.length ? aBuf[i] : 0;
+    const bv = i < bBuf.length ? bBuf[i] : 0;
+    result |= av ^ bv;
+  }
+  return result === 0;
+}
+function resolveOperatorApiKey(env) {
+  const preferred = env.OPERATOR_API_KEY;
+  if (typeof preferred === "string" && preferred.length > 0) {
+    return preferred;
+  }
+  const legacy = env.INTERNAL_API_KEY;
+  if (typeof legacy === "string" && legacy.length > 0) {
+    return legacy;
+  }
+  return;
+}
+async function requireAuth(request, env) {
+  return requireOperatorAuth(request, env);
+}
+async function requireOperatorAuth(request, env) {
+  const apiKey = resolveOperatorApiKey(env);
+  if (!apiKey) {
+    return new Response(JSON.stringify({
+      error: "Operator API key not configured",
+      hint: "Set OPERATOR_API_KEY (preferred) or INTERNAL_API_KEY on the Worker"
+    }), { status: 401, headers: { "Content-Type": "application/json" } });
+  }
+  const authHeader = request.headers.get("Authorization");
+  const expectedHeader = `Bearer ${apiKey}`;
+  if (!authHeader || !timingSafeEqual(authHeader, expectedHeader)) {
+    return new Response(JSON.stringify({ error: "Unauthorized" }), {
+      status: 401,
+      headers: { "Content-Type": "application/json" }
+    });
+  }
+  return null;
+}
+function createOperatorAuthMiddleware() {
+  return async (request, env, _ctx) => {
+    const denied = await requireOperatorAuth(request, env);
+    if (denied)
+      return denied;
+    return;
+  };
+}
+function normalizeKeyNames(keyName) {
+  if (typeof keyName === "string") {
+    return [keyName];
+  }
+  return [...keyName];
+}
+function collectInternalAuthKeys(env, keyNames) {
+  const keys = [];
+  for (const name of normalizeKeyNames(keyNames)) {
+    const value = env[name];
+    if (typeof value === "string" && value.length > 0) {
+      keys.push(value);
+    }
+  }
+  return keys;
+}
+function matchesAnyInternalAuthKey(providedKey, expectedKeys) {
+  for (const expected of expectedKeys) {
+    if (timingSafeEqual(providedKey, expected)) {
+      return true;
+    }
+  }
+  return false;
+}
+function internalAuthNotConfiguredResponse(keyNames) {
+  const label = normalizeKeyNames(keyNames).join(" | ");
+  return new Response(JSON.stringify({
+    success: false,
+    error: `Internal auth key(s) not configured: ${label}`
+  }), { status: 401, headers: { "Content-Type": "application/json" } });
+}
+function requireInternalAuth(request, env, keyName = "INTERNAL_KEY_BINDING") {
+  const expectedKeys = collectInternalAuthKeys(env, keyName);
+  if (expectedKeys.length === 0) {
+    return internalAuthNotConfiguredResponse(keyName);
+  }
+  const providedKey = request.headers.get("X-Internal-Auth-Key");
+  if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
+    return new Response(JSON.stringify({ success: false, error: "Unauthorized" }), { status: 401, headers: { "Content-Type": "application/json" } });
+  }
+  return null;
+}
+function createInternalAuthMiddleware(keyName = "INTERNAL_KEY_BINDING") {
+  return async (request, env, _ctx) => {
+    const expectedKeys = collectInternalAuthKeys(env, keyName);
+    if (expectedKeys.length === 0) {
+      return internalAuthNotConfiguredResponse(keyName);
+    }
+    const providedKey = request.headers.get("X-Internal-Auth-Key");
+    if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
+      return new Response(JSON.stringify({ success: false, error: "Unauthorized" }), { status: 401, headers: { "Content-Type": "application/json" } });
+    }
+    return;
+  };
+}
+function checkInternalAuth(request, env, keyName = "INTERNAL_KEY_BINDING") {
+  const expectedKeys = collectInternalAuthKeys(env, keyName);
+  if (expectedKeys.length === 0) {
+    return {
+      authorized: false,
+      error: `${normalizeKeyNames(keyName).join(" | ")} not configured`
+    };
+  }
+  const providedKey = request.headers.get("X-Internal-Auth-Key");
+  if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
+    return { authorized: false, error: "Unauthorized" };
+  }
+  return { authorized: true };
+}
+
 // src/service-bindings.ts
+var InternalAuthKeyFields = {
+  DEFAULT: "INTERNAL_KEY_BINDING",
+  D1_READ: "D1_READ_KEY_BINDING",
+  D1_WRITE: "D1_WRITE_KEY_BINDING",
+  TRADE_EXECUTE: "TRADE_EXECUTE_KEY_BINDING",
+  TRADE_READ: "TRADE_READ_KEY_BINDING",
+  TELEGRAM_ALERT: "TELEGRAM_INTERNAL_KEY_BINDING",
+  WALLET_EXECUTE: "WALLET_EXECUTE_KEY_BINDING",
+  AGENT: "AGENT_INTERNAL_KEY",
+  D1_INTERNAL_ALIAS: "D1_INTERNAL_KEY",
+  TRADE_INTERNAL_ALIAS: "TRADE_INTERNAL_KEY",
+  TELEGRAM_INTERNAL_ALIAS: "TELEGRAM_INTERNAL_KEY"
+};
+var D1_READ_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.D1_READ,
+  InternalAuthKeyFields.DEFAULT
+];
+var D1_WRITE_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.D1_WRITE,
+  InternalAuthKeyFields.DEFAULT
+];
+var TRADE_EXECUTE_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.TRADE_EXECUTE,
+  InternalAuthKeyFields.DEFAULT,
+  InternalAuthKeyFields.AGENT
+];
+var TRADE_READ_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.TRADE_READ,
+  InternalAuthKeyFields.DEFAULT
+];
+var TELEGRAM_ALERT_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.TELEGRAM_ALERT,
+  InternalAuthKeyFields.DEFAULT
+];
+var WALLET_EXECUTE_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.WALLET_EXECUTE,
+  InternalAuthKeyFields.DEFAULT
+];
+var DASHBOARD_D1_READ_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.D1_READ,
+  InternalAuthKeyFields.D1_INTERNAL_ALIAS,
+  InternalAuthKeyFields.DEFAULT
+];
+var DASHBOARD_TRADE_EXECUTE_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.TRADE_EXECUTE,
+  InternalAuthKeyFields.TRADE_INTERNAL_ALIAS,
+  InternalAuthKeyFields.DEFAULT
+];
+var DASHBOARD_TELEGRAM_ALERT_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.TELEGRAM_ALERT,
+  InternalAuthKeyFields.TELEGRAM_INTERNAL_ALIAS,
+  InternalAuthKeyFields.DEFAULT
+];
+function resolveInternalAuthKey(env, keyFields) {
+  return collectInternalAuthKeys(env, keyFields)[0];
+}
+
+class ServiceAuthError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ServiceAuthError";
+  }
+}
+function authenticatedServiceFetch(binding, env, path, body, options) {
+  const key = options?.internalKey ?? (options?.internalKeyFields ? resolveInternalAuthKey(env, options.internalKeyFields) : env.INTERNAL_KEY_BINDING);
+  if (!key) {
+    const label = options?.internalKeyFields ? Array.isArray(options.internalKeyFields) ? options.internalKeyFields.join(" | ") : options.internalKeyFields : "INTERNAL_KEY_BINDING";
+    return Promise.reject(new ServiceAuthError(`${label} not configured`));
+  }
+  return serviceFetch(binding, path, body, {
+    method: options?.method,
+    timeout: options?.timeout,
+    headers: {
+      ...options?.headers,
+      "X-Internal-Auth-Key": key
+    }
+  });
+}
 function serviceFetch(binding, path, body, options) {
   const timeout = options?.timeout ?? 30000;
   return binding.fetch(`http://internal${path}`, {
@@ -1302,13 +1677,18 @@ function createMockEnv(overrides) {
 }
 
 // src/path-utils.ts
+import { existsSync as existsSync2 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join2, resolve } from "path";
+import { dirname, join as join2, resolve } from "path";
 function createHooxPath(path) {
   return path;
 }
 function getHooxHome() {
   try {
+    const override = process.env.HOOX_HOME?.trim();
+    if (override) {
+      return createHooxPath(resolve(override));
+    }
     const home = homedir2();
     if (!home || home.length === 0) {
       return createHooxPath(resolve(process.cwd(), ".hoox"));
@@ -1318,6 +1698,84 @@ function getHooxHome() {
     return createHooxPath(resolve(process.cwd(), ".hoox"));
   }
 }
+function isHooxSetupRoot(dir) {
+  if (!dir)
+    return false;
+  try {
+    const root = resolve(dir);
+    return existsSync2(join2(root, "wrangler.jsonc")) && existsSync2(join2(root, "packages", "cli", "package.json"));
+  } catch {
+    return false;
+  }
+}
+function findHooxSetupRoot(startDir = process.cwd()) {
+  let dir = resolve(startDir);
+  for (;; ) {
+    if (isHooxSetupRoot(dir))
+      return dir;
+    const parent = dirname(dir);
+    if (parent === dir)
+      return null;
+    dir = parent;
+  }
+}
+function resolveHooxRuntimeRoot(options) {
+  const env = options?.env ?? process.env;
+  const cwd = resolve(options?.cwd ?? process.cwd());
+  const globalRepo = getHooxRepoPath();
+  const envRepo = env.HOOX_REPO?.trim();
+  if (envRepo) {
+    const resolved = resolve(envRepo);
+    if (isHooxSetupRoot(resolved)) {
+      return {
+        root: resolved,
+        source: "env",
+        checked: {
+          env: resolved,
+          cwd: findHooxSetupRoot(cwd),
+          global: globalRepo
+        }
+      };
+    }
+    return {
+      root: null,
+      source: "env",
+      checked: {
+        env: resolved,
+        cwd: findHooxSetupRoot(cwd),
+        global: globalRepo
+      }
+    };
+  }
+  const local = findHooxSetupRoot(cwd);
+  if (local) {
+    return {
+      root: local,
+      source: "cwd",
+      checked: { cwd: local, global: globalRepo }
+    };
+  }
+  if (isHooxSetupRoot(globalRepo)) {
+    return {
+      root: globalRepo,
+      source: "global",
+      checked: { cwd: null, global: globalRepo }
+    };
+  }
+  return {
+    root: null,
+    source: "none",
+    checked: { cwd: null, global: globalRepo }
+  };
+}
+function getTuiEntryCandidates(runtimeRoot) {
+  const root = resolve(runtimeRoot);
+  return [
+    join2(root, "packages", "tui", "src", "main.tsx"),
+    join2(root, "packages", "tui", "dist", "main.js"),
+    join2(root, "packages", "tui", "src", "main.ts")
+  ];
+}
 function resolveHooxPath(relativePath) {
   if (!relativePath || typeof relativePath !== "string") {
     throw new Error("relativePath must be a non-empty string");
@@ -1376,6 +1834,17 @@ function getHooxStatePath() {
 }
 
 // src/session.ts
+import { z as z3 } from "zod";
+var SessionStateFileSchema = z3.object({
+  activeView: z3.string().optional(),
+  sidebarExpanded: z3.boolean().optional(),
+  windowSize: z3.object({
+    cols: z3.number().int().positive(),
+    rows: z3.number().int().positive()
+  }).optional(),
+  lastData: z3.number().nonnegative().optional(),
+  savedAt: z3.string().optional()
+}).strict();
 var TUI_STATE_DIR = ".tui-state";
 var SESSION_FILE = (() => {
   try {
@@ -1413,7 +1882,8 @@ async function restoreSession() {
     if (!exists)
       return { ...DEFAULT_SESSION };
     const raw = await file.text();
-    const parsed = JSON.parse(raw);
+    const result = SessionStateFileSchema.safeParse(JSON.parse(raw));
+    const parsed = result.success ? result.data : {};
     return {
       activeView: validateViewId(parsed.activeView) ? parsed.activeView : DEFAULT_SESSION.activeView,
       sidebarExpanded: typeof parsed.sidebarExpanded === "boolean" ? parsed.sidebarExpanded : DEFAULT_SESSION.sidebarExpanded,
@@ -1601,7 +2071,7 @@ var BASE_WORKERS = {
     path: "workers/d1-worker",
     vars: { database_name: "hoox-db" }
   },
-  hoox: { enabled: true, path: "workers/hoox", vars: {} },
+  hoox: { enabled: true, path: "workers/hoox-worker", vars: {} },
   "agent-worker": { enabled: true, path: "workers/agent-worker", vars: {} },
   "analytics-worker": {
     enabled: true,
@@ -1921,6 +2391,7 @@ class WizardEngine {
     }
   }
 }
+
 // src/wizard/persistence.ts
 function serializeState(state) {
   return JSON.stringify(state, null, 2);
@@ -1951,7 +2422,7 @@ function deriveCalledBy(manifests) {
 var manifests = {
   hoox: {
     name: "hoox",
-    path: "workers/hoox",
+    path: "workers/hoox-worker",
     vars: {
       WEBHOOK_API_KEY_BINDING: {
         type: "secret",
@@ -2295,6 +2766,7 @@ var manifests = {
 var CALLED_BY = deriveCalledBy(manifests);
 var WORKER_MANIFESTS = manifests;
 var WORKER_NAMES = Object.keys(manifests).sort();
+
 // src/schemas/validators.ts
 import { parse } from "jsonc-parser";
 function validateWranglerJsonc(workerName, manifest, jsoncContent) {
@@ -2320,7 +2792,8 @@ function validateWranglerJsonc(workerName, manifest, jsoncContent) {
     });
     return errors;
   }
-  const declaredVars = parsed?.vars ?? {};
+  const wrangler = parsed;
+  const declaredVars = wrangler.vars ?? {};
   for (const [name, def] of Object.entries(manifest.vars)) {
     if (!(name in declaredVars)) {
       errors.push({
@@ -2341,7 +2814,7 @@ function validateWranglerJsonc(workerName, manifest, jsoncContent) {
       });
     }
   }
-  const declaredServices = parsed?.services ?? [];
+  const declaredServices = wrangler.services ?? [];
   for (const expected of manifest.services) {
     const match = declaredServices.find((s) => s.binding === expected.binding && s.service === expected.service);
     if (!match) {
@@ -2397,7 +2870,8 @@ function validateRootSecrets(workerName, manifest, rootJsoncContent) {
     });
     return errors;
   }
-  const rootSecrets = parsed?.workers?.[workerName]?.secrets ?? [];
+  const rootWrangler = parsed;
+  const rootSecrets = rootWrangler.workers?.[workerName]?.secrets ?? [];
   const expectedSecrets = Object.entries(manifest.vars).filter(([_, def]) => def.type === "secret").map(([name]) => name);
   for (const expected of expectedSecrets) {
     if (!rootSecrets.includes(expected)) {
@@ -2647,7 +3121,7 @@ var useServiceStore = create2()(immer2((set, get) => ({
   fetchWorkers: async () => {
     const { hooxFetch: hooxFetch2 } = await Promise.resolve().then(() => (init_api_client(), exports_api_client));
     try {
-      const data = await hooxFetch2("/workers");
+      const data = await hooxFetch2("/v1/workers");
       set((state) => {
         state.workers = data;
         state.lastUpdated = Date.now();
@@ -2672,20 +3146,26 @@ var useServiceStore = create2()(immer2((set, get) => ({
         acknowledged: false
       });
       set((state) => {
+        state.lastError = msg;
+        state.disconnectedAt = state.disconnectedAt ?? Date.now();
         if (state.connectionStatus === "connected" || state.connectionStatus === "polling") {
           state.connectionStatus = "reconnecting";
           state.retryCount = state.retryCount + 1;
-          state.lastError = msg;
-          state.disconnectedAt = state.disconnectedAt ?? Date.now();
           if (state.retryCount >= MAX_RETRIES2) {
             state.connectionStatus = "offline";
             state.lastError = `Connection lost after ${MAX_RETRIES2} retries`;
           } else {
             state.reconnectDelay = getBackoffDelay(state.retryCount);
           }
-        }
-        if (state.connectionStatus === "reconnecting") {
-          state.lastError = msg;
+        } else if (state.connectionStatus === "reconnecting") {
+          state.retryCount = state.retryCount + 1;
+          if (state.retryCount >= MAX_RETRIES2) {
+            state.connectionStatus = "offline";
+            state.lastError = `Connection lost after ${MAX_RETRIES2} retries`;
+            state.reconnectDelay = 0;
+          } else {
+            state.reconnectDelay = getBackoffDelay(state.retryCount);
+          }
         }
       });
     }
@@ -2693,7 +3173,7 @@ var useServiceStore = create2()(immer2((set, get) => ({
   streamTrades: async () => {
     const { subscribeSSE: subscribeSSE2 } = await Promise.resolve().then(() => (init_sse(), exports_sse));
     try {
-      await subscribeSSE2("/trades/stream", (trade) => {
+      await subscribeSSE2("/v1/trades/stream", (trade) => {
         get().pushTrade(trade);
       });
     } catch (error) {
@@ -2712,7 +3192,7 @@ var useServiceStore = create2()(immer2((set, get) => ({
   streamLogs: async () => {
     const { subscribeSSE: subscribeSSE2 } = await Promise.resolve().then(() => (init_sse(), exports_sse));
     try {
-      await subscribeSSE2("/logs/stream", (log) => {
+      await subscribeSSE2("/v1/logs/stream", (log) => {
         get().pushLog(log);
       });
     } catch (error) {
@@ -2772,9 +3252,7 @@ var useServiceStore = create2()(immer2((set, get) => ({
     state.lastErrorDetails = null;
     state.reconnectDelay = 0;
     state.disconnectedAt = null;
-    if (state.connectionStatus === "reconnecting" || state.connectionStatus === "polling") {
-      state.connectionStatus = "connected";
-    }
+    state.connectionStatus = "connected";
   }),
   handleConnectionFailure: (errorMessage) => set((state) => {
     state.lastError = errorMessage;
@@ -2837,6 +3315,7 @@ var useServiceStore = create2()(immer2((set, get) => ({
 import { create as create3 } from "zustand";
 import { immer as immer3 } from "zustand/middleware/immer";
 import { persist, createJSONStorage } from "zustand/middleware";
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, existsSync as existsSync3 } from "fs";
 import { homedir as homedir3 } from "os";
 import { join as join3 } from "path";
 var bunConfigStorage = {
@@ -2853,11 +3332,17 @@ var bunConfigStorage = {
   },
   setItem: async (_name, value) => {
     const dir = join3(homedir3(), ".hoox");
+    if (!existsSync3(dir)) {
+      mkdirSync2(dir, { recursive: true, mode: HOOX_DIR_MODE });
+    }
     try {
-      await Bun.file(dir).exists();
+      chmodSync2(dir, HOOX_DIR_MODE);
     } catch {}
     const filePath = join3(dir, "config.json");
     await Bun.write(filePath, value);
+    try {
+      chmodSync2(filePath, HOOX_CONFIG_FILE_MODE);
+    } catch {}
   },
   removeItem: async (_name) => {}
 };
@@ -2949,7 +3434,9 @@ var useConfigStore = create3()(persist(immer3((set) => ({
 // src/index.ts
 init_api_client();
 init_sse();
+init_operator_transport();
 export {
+  writeSecureFileSync,
   writeConfigSync,
   writeConfig,
   validateWranglerJsonc,
@@ -2967,15 +3454,24 @@ export {
   serializeState,
   saveSession,
   restoreSession,
+  resolveOperatorTransportProfile,
+  resolveInternalAuthKey,
+  resolveHooxRuntimeRoot,
   resolveHooxPath,
   resolveDependencies,
   readConfigSync,
   readConfig,
+  operatorUrl,
   logKvTimestamp,
   isWithinHooxHome,
+  isUnixModeGroupOrWorldAccessible,
+  isHooxSetupRoot,
+  isConfigWorldOrGroupReadable,
   hooxFetch,
   healthCheck,
   headersToObject,
+  hasOperatorClientCredentials,
+  getTuiEntryCandidates,
   getRelativeHooxPath,
   getHooxWranglerPath,
   getHooxStatePath,
@@ -2998,7 +3494,10 @@ export {
   formatDuration2 as formatDuration,
   formatCurrency,
   formatCpu,
+  formatConfigPermissionWarning,
   formatCompactCurrency,
+  findHooxSetupRoot,
+  ensureHooxDirSecure,
   deserializeState,
   createSuccessResponse,
   createQueueHandler,
@@ -3017,6 +3516,9 @@ export {
   createJsonResponse,
   createErrorResponse,
   createCronHandler,
+  buildOperatorAuthHeaders,
+  authenticatedServiceFetch,
+  WorkerStatusColor,
   WorkerAPIError,
   WizardEngine,
   WebhookPayloadSchema,
@@ -3024,23 +3526,41 @@ export {
   WORKER_MANIFESTS,
   WORKER_DEPENDENCIES,
   WIZARD_STATE_PATH,
+  WALLET_EXECUTE_AUTH_KEY_FIELDS,
   TradeSignalSchema,
+  TradeQueueMessageSchema,
   TradeActionSchema,
+  TRADE_READ_AUTH_KEY_FIELDS,
+  TRADE_EXECUTE_AUTH_KEY_FIELDS,
   TRADEMARK_NOTICE,
   TRADEMARKS,
+  TELEGRAM_ALERT_AUTH_KEY_FIELDS,
+  ServiceAuthError,
   PositionSchema,
   PRESETS,
+  LogLevelColor,
   KVKeys,
+  InternalAuthKeyFields,
   INTEGRATIONS,
+  HOOX_DIR_MODE,
+  HOOX_CONFIG_FILE_MODE,
   FULL_LEGAL_NOTICE,
   ExchangeRouter,
   Errors,
   DISCLAIMER_HEADER,
   DISCLAIMER,
+  DASHBOARD_TRADE_EXECUTE_AUTH_KEY_FIELDS,
+  DASHBOARD_TELEGRAM_ALERT_AUTH_KEY_FIELDS,
+  DASHBOARD_D1_READ_AUTH_KEY_FIELDS,
+  D1_WRITE_AUTH_KEY_FIELDS,
+  D1_READ_AUTH_KEY_FIELDS,
   D1Repository,
+  CoolBracketPalette,
+  ConnectionStatusColor,
   Colors,
   COPYRIGHT,
   CALLED_BY,
   BaseExchangeClient2 as BaseExchangeClient,
-  BalanceSchema
+  BalanceSchema,
+  AlertSeverityColor
 };