hive-intelligence 1.1.4 → 1.3.0

package/agent-skills/packs/hive-wallet-investigation/SKILL.md

@@ -1,42 +1,135 @@
 ---
 name: hive-wallet-investigation
-description: Use this skill for wallet, portfolio, holder, whale, transfer, PnL, NFT exposure, DeFi position, or notable on-chain activity investigations. Require wallet address and chain before executing Hive wallet tools.
+description: Use this skill whenever the user wants to look inside a wallet or address — portfolio, holdings, balances, transfers, PnL, NFT exposure, DeFi positions, whale moves, "what does this address hold", "trace this wallet's activity" — even if they just paste an address. Requires wallet address and chain before executing Hive wallet tools. For Solana wallets use hive-solana-analysis; for "is this address malicious" risk checks use hive-security-risk.
 license: MIT
 metadata:
   package: "@hiveintelligence/agent-skills"
   category: "wallet"
   requires_network: "true"
-version: 1.0.0
+version: 1.3.0
 ---
 
 # hive-wallet-investigation — Wallet Investigation
 
-Use this skill when the user asks to investigate a wallet, portfolio, holdings,
-transfers, PnL, NFT exposure, or DeFi positions.
+Investigate a wallet's balances, transfers, PnL, NFT exposure, DeFi positions,
+and notable activity with live Hive data, scoped to exactly what the user
+asked.
 
-## Task toolset
+## Task toolset and identifiers
 
-Use `wallet_investigation`.
+Toolset: `wallet_investigation`. Read
+`hive://toolsets/wallet_investigation` before execution; it is authoritative
+for the current output schema, material-call budget, phases, fallback
+condition, and stop conditions.
 
-Required identifiers: wallet address and chain.
+- Required: wallet address and chain/network — unless the user explicitly asks
+  for multi-chain.
+- Optional: time window, asset filter, counterparty, protocol, NFT collection.
 
-## Procedure
+Ask for the chain when an EVM address appears without context: the same
+address exists on every EVM chain with different state, so guessing the chain
+silently changes the answer. For Solana wallets, hand off to
+`hive-solana-analysis`.
+
+Before choosing endpoints, select exactly one matching entry from the exact
+workflow's routes[]. Follow its ordered steps, use a fallback only under that
+step's published condition, stop at four material calls, and preserve the
+selected route_id in the typed result. The broad coverageCatalog is discovery
+coverage, not an execution plan.
 
-Read `references/workflow.md` when the request needs multi-chain handling,
-activity triage, risk caveats, or a structured wallet investigation report.
+## Procedure
 
 1. Validate the address format for the requested chain.
-2. Start with balances and native balance.
-3. Add transfers, NFT holdings, DeFi positions, or PnL only when relevant.
-4. Summarize exposure, concentration, notable activity, and missing data.
+2. Call `search_tools` for wallet balance, native balance, transfer, NFT,
+   DeFi-position, and PnL capabilities as the question requires.
+3. Call `get_api_endpoint_schema` for each endpoint before calling it.
+4. Call `invoke_api_endpoint` with schema-valid, bounded arguments.
+5. Start with balances and native balance. Add transfers for activity
+   questions; add NFTs, DeFi positions, or PnL only when relevant.
+6. Summarize exposure, concentration, notable activity, and missing data.
+
+## Bounded calls
+
+- Use explicit `limit`, `page`, `per_page`, or time filters for transfers.
+- Do not fetch full history for a quick portfolio read.
+- Avoid mixing chains unless the user requested multi-chain analysis.
+
+## Worked example
+
+User: "What does 0x28C6c06298d514Db089934071355E5743bf21d60 hold on Ethereum,
+and did anything big move this week?"
+
+1. `search_tools` → `{"query": "wallet token balances native balance transfers ethereum", "limit": 5}`
+2. `get_api_endpoint_schema` for the balance and transfer endpoints returned.
+3. `invoke_api_endpoint` for balances first, then transfers with a 7-day
+   window and an explicit limit — argument names come from the schema, not
+   from memory.
+4. Answer with the report template, flagging spam tokens and truncated
+   history.
+
+## Report template
+
+```markdown
+## Summary
+[Wallet posture and the most notable finding.]
 
-## Example
+## Calls made
+- Toolset: wallet_investigation
+- Endpoint(s): [exact endpoint names]
+- Identifiers: [chain, wallet, filters]
 
-If the user provides an EVM wallet but no chain, ask whether they want Ethereum,
-Base, Arbitrum, Polygon, or a multi-chain investigation.
+## Evidence
+- Balances: [native + top token holdings]
+- Activity: [transfers in window, counterparties]
+- Exposure: [NFTs, DeFi positions, PnL if requested]
+- Provenance: [provider, fetched_at, observed_at/cache_age_ms, runtime status per call]
+
+## Caveats
+[Missing chains, truncated history, unavailable enrichment, degraded providers.]
+
+## Next action
+[Chain expansion, transfer drilldown, risk check, or PnL detail — only if needed.]
+```
+
+## Gotchas
+
+- Wallet labels and owner identity are not guaranteed.
+- Token balances can include spam or illiquid assets — say so rather than
+  inflating portfolio value.
+- Absence of DeFi/NFT data may reflect provider coverage, not true absence.
+
+## Evidence receipt (required)
+
+End every Hive-backed answer with a compact receipt built from the `_hive`
+object on each material tool response:
+
+- `provider`, `tool`, `fetched_at`, `observed_at`, `cache_age_ms`, and `runtime_status`
+- `receipt_id`, `receipt_version`, server/build version, and SHA-256 input/result
+  digests when present (self-checks, not signatures)
+- `source`, `cache_status`, `truncated`, and any warnings
+- canonical chain/entity identifiers plus block, slot, transaction, or query ids
+  present in provider data
+- material provider disagreements and how they were handled
+- checks that were unavailable, gated, stale, truncated, or intentionally not run
+- a `claims[]` citation from each material statement to exact receipt IDs
+- one `coverage[]` entry for every canonical evidence phase, with each gap explained
+
+Never turn missing evidence into a clean result, silently merge conflicting
+provider values, or omit a degraded/fallback call from the receipt.
+`observed_at` is Hive's first-observation/original cache-population time, and
+`cache_age_ms: 0` only means newly retrieved by Hive. Use provider time, block,
+slot, transaction, or candle close for source recency; if absent, mark it
+unknown. Run `validate_task_result` before presenting the typed workflow result;
+it checks structure but cannot authenticate an invented receipt.
 
 ## Runtime status handling
 
-Classify provider failures as `missing_key`, `plan_required`, `rate_limited`,
-`degraded`, or `failing`. A single blocked enrichment tool should not suppress
+Classify provider failures as `invalid_input`, `missing_key`, `plan_required`,
+`rate_limited`, `degraded`, or `failing`. A single blocked enrichment tool should not suppress
 balances or transfers that did succeed.
+
+## Hand-offs
+
+- Solana wallet (base58 address) → `hive-solana-analysis`.
+- "Is this address dangerous / phishing / sanctioned" → `hive-security-risk`.
+- Token-specific deep dive on one holding → `hive-token-diligence`.

package/agent-skills/packs/hive-wallet-investigation/evals/evals.json

@@ -3,13 +3,15 @@
   "evals": [
     {
       "id": 1,
-      "prompt": "Investigate this Ethereum wallet's balances and recent transfers: 0x0000000000000000000000000000000000000000",
-      "expected_output": "Uses wallet_investigation, validates chain/address, starts with balances, adds bounded recent transfers, and reports source/freshness/runtime status.",
+      "prompt": "What does 0x28C6c06298d514Db089934071355E5743bf21d60 hold on Ethereum, and did anything big move in the last week?",
+      "expected_output": "Uses wallet_investigation, validates chain/address, starts with balances, adds bounded recent transfers, and ends with a source/freshness/runtime receipt.",
       "files": [],
       "assertions": [
         "Chooses wallet_investigation.",
+        "Selects the matching portfolio_snapshot or recent_activity route and follows its ordered calls.",
         "Starts with balances/native balance.",
-        "Bounds transfer history."
+        "Bounds transfer history.",
+        "Includes receipt ids and missing evidence."
       ]
     },
     {

package/agent-skills/packs/hive-wallet-investigation/evals/triggers.json

@@ -0,0 +1,50 @@
+[
+  {
+    "query": "what does 0x28C6c06298d514Db089934071355E5743bf21d60 hold on ethereum",
+    "should_trigger": true
+  },
+  {
+    "query": "trace where this wallet's funds came from, it just sent me 2 eth",
+    "should_trigger": true
+  },
+  {
+    "query": "did this whale wallet dump any LINK this week? 0x… on mainnet",
+    "should_trigger": true
+  },
+  {
+    "query": "show me this address's defi positions and nft exposure",
+    "should_trigger": true
+  },
+  {
+    "query": "whats the realized pnl of this trader address",
+    "should_trigger": true
+  },
+  {
+    "query": "this EVM address might be active on several chains, can you inspect it",
+    "should_trigger": true
+  },
+  {
+    "query": "is this address that dm'd me flagged as a scammer or phishing",
+    "should_trigger": false
+  },
+  {
+    "query": "analyze this solana wallet 9WzDXwBbmkg8ZTbNMqUxvQRAyrZzDsGYdLVL9zYtAWWM",
+    "should_trigger": false
+  },
+  {
+    "query": "alert me whenever this wallet moves more than $50k",
+    "should_trigger": false
+  },
+  {
+    "query": "how do hd wallets derive addresses from a seed phrase",
+    "should_trigger": false
+  },
+  {
+    "query": "whats gas on mainnet right now",
+    "should_trigger": false
+  },
+  {
+    "query": "what tokens should i buy this week",
+    "should_trigger": false
+  }
+]

package/agent-skills/references/agents-routing.md

@@ -38,13 +38,23 @@ For live crypto intelligence, prefer Hive retrieval over model memory.
   use `hive-mcp`, `hive-build-onboarding`, `hive-cli`, or `hive-build`.
 
 Default execution loop:
-1. Read `hive://toolsets` or call `search_tools`.
-2. Select one task toolset or exact endpoint.
-3. Call `get_api_endpoint_schema`.
-4. Execute through `invoke_api_endpoint` with bounded args.
-5. Report provider, source/freshness, fallback/cache/degraded state, and
-   runtime status (`ok`, `missing_key`, `plan_required`, `rate_limited`,
-   `degraded`, or `failing`).
+1. Read the compact `hive://toolsets` index or call `search_tools`.
+2. Select one task toolset and its best matching compact `routes[]` entry.
+   Preserve `route_id`; follow the ordered calls, conditional per-call
+   fallbacks, four-call cap, and stop condition. Use `coverageCatalog` only
+   for long-tail discovery.
+3. Call `get_api_endpoint_schema` and inspect `operation`/`callPattern`.
+4. Execute reads through `invoke_api_endpoint` with bounded args. Explain any
+   Hive state change, obtain explicit approval, then use
+   `invoke_stateful_endpoint`; never auto-approve it.
+5. Copy exact server-returned `_hive` blocks into the task receipt, cite exact
+   receipt IDs from `claims[]`, account for every canonical `coverage[]`
+   phase, include `route_id`, and call `validate_task_result` before presenting a structured
+   result.
+6. Report provider, source recency, fallback/cache/degraded state, and runtime
+   status (`ok`, `invalid_input`, `missing_key`, `plan_required`,
+   `rate_limited`, `degraded`, or `failing`). `observed_at` is Hive
+   first-observation/original cache time, not necessarily upstream event time.
 ```
 
 Keep this snippet short. The skill files carry the detailed workflow and should

package/agent-skills/scripts/validate-agent-skills-package.mjs

@@ -6,8 +6,8 @@ import { fileURLToPath } from "node:url";
 const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const packsRoot = join(root, "packs");
 const failures = [];
-
-const workflowReferenceSkills = new Set([
+const receiptSkills = new Set([
+  "hive-query",
   "hive-market-research",
   "hive-token-diligence",
   "hive-wallet-investigation",
@@ -18,6 +18,7 @@ const workflowReferenceSkills = new Set([
   "hive-solana-analysis",
   "hive-network-infrastructure",
   "hive-prediction-markets",
+  "hive-stateful-monitoring",
 ]);
 
 function fail(message) {
@@ -80,8 +81,11 @@ for (const skillName of skillDirs) {
   const description = field(fm, "description");
 
   if (name !== skillName) fail(`${skillName} frontmatter name must match directory.`);
-  if (!description.startsWith("Use this skill")) {
-    fail(`${skillName} description must start with trigger language: "Use this skill".`);
+  const hasTriggerLanguage =
+    description.startsWith("Use this skill") ||
+    (skillName === "hive-query" && description.startsWith("Default entry point"));
+  if (!hasTriggerLanguage) {
+    fail(`${skillName} description must start with explicit trigger language.`);
   }
   if (description.includes(": ")) {
     fail(`${skillName} description contains ': ', which breaks some YAML parsers unless quoted.`);
@@ -95,6 +99,13 @@ for (const skillName of skillDirs) {
   if (!body.includes("## Runtime status handling")) {
     fail(`${skillName} must document runtime status handling.`);
   }
+  if (
+    receiptSkills.has(skillName) &&
+    (!body.includes("## Evidence receipt (required)") ||
+      !body.includes("`receipt_id`"))
+  ) {
+    fail(`${skillName} must require Hive evidence receipts.`);
+  }
 
   const evalFile = join(skillDir, "evals", "evals.json");
   if (!existsSync(evalFile)) {
@@ -113,11 +124,42 @@ for (const skillName of skillDirs) {
         fail(`${skillName} eval ${entry.id ?? "unknown"} needs assertions.`);
       }
     }
+    if (
+      receiptSkills.has(skillName) &&
+      !(evals?.evals ?? []).some((entry) =>
+        `${entry.expected_output ?? ""} ${(entry.assertions ?? []).join(" ")}`
+          .toLowerCase()
+          .includes("receipt"),
+      )
+    ) {
+      fail(`${skillName} evals must cover the evidence receipt contract.`);
+    }
   }
 
-  if (workflowReferenceSkills.has(skillName)) {
-    const workflow = join(skillDir, "references", "workflow.md");
-    if (!existsSync(workflow)) fail(`${skillName} is missing references/workflow.md.`);
+  const triggerFile = join(skillDir, "evals", "triggers.json");
+  if (!existsSync(triggerFile)) {
+    fail(`${skillName} is missing evals/triggers.json.`);
+  } else {
+    const triggers = readJson(triggerFile);
+    if (!Array.isArray(triggers) || triggers.length < 4) {
+      fail(`${skillName} must define at least four trigger evals.`);
+    } else {
+      if (!triggers.some((entry) => entry?.should_trigger === true)) {
+        fail(`${skillName} trigger evals need a positive example.`);
+      }
+      if (!triggers.some((entry) => entry?.should_trigger === false)) {
+        fail(`${skillName} trigger evals need a negative example.`);
+      }
+      for (const entry of triggers) {
+        if (
+          typeof entry?.query !== "string" ||
+          !entry.query.trim() ||
+          typeof entry?.should_trigger !== "boolean"
+        ) {
+          fail(`${skillName} has an invalid trigger eval entry.`);
+        }
+      }
+    }
   }
 
   const referenceMatches = [...body.matchAll(/`(references\/[^`]+)`/g)];
@@ -143,11 +185,17 @@ if (directoryManifest) {
 // the drift mode where a pack ships with evals but is invisible to install and
 // routing (e.g. a skill missing from plugin.json never loads via plugin install).
 const pluginManifestPath = join(root, ".claude-plugin", "plugin.json");
+const packageManifest = readJson(join(root, "package.json"));
 if (!existsSync(pluginManifestPath)) {
   fail("agent-skills/.claude-plugin/plugin.json is missing.");
 } else {
   const pluginManifest = readJson(pluginManifestPath);
   if (pluginManifest) {
+    if (packageManifest && pluginManifest.version !== packageManifest.version) {
+      fail(
+        `.claude-plugin/plugin.json version ${pluginManifest.version} must match package.json ${packageManifest.version}.`,
+      );
+    }
     const pluginSkills = new Set((pluginManifest.skills ?? []).map((skill) => skill.name));
     for (const skillName of skillDirs) {
       if (!pluginSkills.has(skillName)) {
@@ -169,9 +217,21 @@ if (!existsSync(pluginManifestPath)) {
       } else {
         const mcp = readJson(mcpPath);
         const hive = mcp?.mcpServers?.hive;
-        if (!hive?.url || !hive.url.includes("mcp.hiveintelligence.xyz")) {
+        if (hive?.url !== "https://mcp.hiveintelligence.xyz/mcp") {
           fail(`${pluginManifest.mcpServers} must define mcpServers.hive.url for the hosted Hive endpoint.`);
         }
+        if (
+          JSON.stringify(hive) !==
+          JSON.stringify({
+            type: "http",
+            url: "https://mcp.hiveintelligence.xyz/mcp",
+          })
+        ) {
+          fail(`${pluginManifest.mcpServers} must be an exact URL-only interactive OAuth config.`);
+        }
+        if (/authorization|bearer|api.?key|token|secret|\$\{/i.test(JSON.stringify(hive))) {
+          fail(`${pluginManifest.mcpServers} must not contain credentials or placeholders.`);
+        }
       }
     }
   }

package/bin/hive-mcp.js

@@ -4,14 +4,14 @@
 // In an ESM file (type:module), static imports are parsed before execution,
 // so a version check using `if (major < 20)` would never execute on old Node.
 // However, since this file IS ESM and uses import statements, the check below
-// is a best-effort guard for Node 20+ (which already supports ESM + TLA).
+// is a best-effort guard for Node 22.12+ (which supports the package runtime).
 // For Node <16, this file fails at parse time with a SyntaxError — engines
 // field in package.json is the primary enforcement mechanism.
 
-const major = parseInt(process.versions.node.split(".")[0], 10);
-if (major < 20) {
+const [major, minor] = process.versions.node.split(".").map(Number);
+if (major < 22 || (major === 22 && minor < 12)) {
   process.stderr.write(
-    `Error: hive requires Node.js 20 or later (found ${process.versions.node}).\n`,
+    `Error: hive requires Node.js 22.12 or later (found ${process.versions.node}).\n`,
   );
   process.exit(1);
 }
@@ -25,7 +25,7 @@ const cliPath = join(__dirname, "..", "build", "cli.js");
 
 if (!existsSync(cliPath)) {
   process.stderr.write(
-    "Error: build/cli.js not found. Run `npm run build` or `bun run build` first.\n",
+    "Error: build/cli.js not found. Run `npm run build` first.\n",
   );
   process.exit(1);
 }

package/build/{alias-3OPMQF4X.js → alias-BKAVOYQV.js}

@@ -3,8 +3,8 @@ import {
   ensureConfigDir,
   getConfig,
   saveConfig
-} from "./chunk-POT2MBEK.js";
-import "./chunk-3WYWXTNN.js";
+} from "./chunk-6PC3HUAK.js";
+import "./chunk-ILVPOLA7.js";
 
 // src/cli/alias.ts
 function getAliases() {

package/build/{api-client-EPF6FD7A.js → api-client-FTVDFW5V.js}

@@ -10,10 +10,10 @@ import {
   getUsage,
   listKeysApi,
   revokeKeyApi
-} from "./chunk-7JWXBKEJ.js";
-import "./chunk-ZCU7XQKF.js";
-import "./chunk-POT2MBEK.js";
-import "./chunk-3WYWXTNN.js";
+} from "./chunk-Q7VBYLX7.js";
+import "./chunk-ZXKFJQDE.js";
+import "./chunk-6PC3HUAK.js";
+import "./chunk-ILVPOLA7.js";
 export {
   authLogin,
   authMe,

package/build/{auth-Q5Q24IRI.js → auth-EZFJ5RYB.js}

@@ -16,9 +16,9 @@ import {
   runWhoami,
   saveProfile,
   switchProfile
-} from "./chunk-5XXI25JE.js";
-import "./chunk-POT2MBEK.js";
-import "./chunk-3WYWXTNN.js";
+} from "./chunk-RUHO24SX.js";
+import "./chunk-6PC3HUAK.js";
+import "./chunk-ILVPOLA7.js";
 export {
   getActiveProfile,
   listProfiles,

package/build/{browser-auth-VPF5LZMZ.js → browser-auth-OJSUNFBI.js}

@@ -1,8 +1,8 @@
 import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
 import {
   browserLogin
-} from "./chunk-GZPDEXO4.js";
-import "./chunk-3WYWXTNN.js";
+} from "./chunk-7GD2MFYI.js";
+import "./chunk-ILVPOLA7.js";
 export {
   browserLogin
 };

package/build/{cache-T6KC5YEY.js → cache-TBDQ7QBU.js}

@@ -4,8 +4,8 @@ import {
   getConfigDir,
   readJsonFile,
   writeJsonFile
-} from "./chunk-POT2MBEK.js";
-import "./chunk-3WYWXTNN.js";
+} from "./chunk-6PC3HUAK.js";
+import "./chunk-ILVPOLA7.js";
 
 // src/cli/cache.ts
 import { existsSync, unlinkSync } from "fs";

package/build/{chunk-POT2MBEK.js → chunk-6PC3HUAK.js}

@@ -1,7 +1,13 @@
 import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
 
 // src/cli/config-dir.ts
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync
+} from "fs";
 import { join } from "path";
 import { homedir } from "os";
 var DEFAULT_CONFIG = {
@@ -24,9 +30,9 @@ function getConfigDir() {
 }
 function ensureConfigDir() {
   const dir = getConfigDir();
-  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 448 });
   const cacheDir = join(dir, "cache");
-  if (!existsSync(cacheDir)) mkdirSync(cacheDir, { recursive: true });
+  if (!existsSync(cacheDir)) mkdirSync(cacheDir, { recursive: true, mode: 448 });
 }
 function readJsonFile(filePath) {
   try {
@@ -41,6 +47,7 @@ function writeJsonFile(filePath, data) {
     encoding: "utf-8",
     mode: 384
   });
+  chmodSync(filePath, 384);
 }
 function getConfig() {
   const filePath = join(getConfigDir(), "config.json");

package/build/{chunk-NP6NSOG2.js → chunk-725R3KLJ.js}

@@ -149,7 +149,8 @@ function errorEnvelope(err, meta) {
     error: {
       code: err.code,
       message: err.message,
-      ...err.suggestion && { suggestion: err.suggestion }
+      ...err.suggestion && { suggestion: err.suggestion },
+      ...err.docUrl && { doc_url: err.docUrl }
     },
     meta
   };
@@ -201,12 +202,34 @@ async function writeOutput(envelope) {
     const provider = envelope.meta.provider ? dim(` (${envelope.meta.provider})`) : "";
     const timing = envelope.meta.duration_ms != null ? dim(` ${envelope.meta.duration_ms}ms`) : "";
     process.stderr.write(`${status}${provider}${timing}
-
 `);
+    const receipt = [
+      envelope.meta.provider ? `provider=${envelope.meta.provider}` : void 0,
+      envelope.meta.source ? `source=${envelope.meta.source}` : void 0,
+      envelope.meta.origin_source ? `origin=${envelope.meta.origin_source}` : void 0,
+      envelope.meta.runtime_status ? `runtime=${envelope.meta.runtime_status}` : void 0,
+      envelope.meta.fetched_at ? `fetched=${envelope.meta.fetched_at}` : void 0,
+      envelope.meta.observed_at ? `observed=${envelope.meta.observed_at}` : void 0,
+      envelope.meta.cache_age_ms != null ? `cache_age_ms=${envelope.meta.cache_age_ms}` : void 0,
+      envelope.meta.cache_status ? `cache=${envelope.meta.cache_status}` : void 0,
+      envelope.meta.receipt_id ? `receipt=${envelope.meta.receipt_id}` : void 0
+    ].filter((value) => Boolean(value));
+    if (receipt.length > 0) {
+      process.stderr.write(dim(`Evidence: ${receipt.join(" \xB7 ")}
+`));
+    }
+    if (envelope.meta.truncated) {
+      process.stderr.write(yellow("Evidence warning: response was truncated.\n"));
+    }
+    for (const warning of envelope.meta.warnings ?? []) {
+      process.stderr.write(yellow(`Evidence warning: ${warning}
+`));
+    }
+    process.stderr.write("\n");
   }
   if (envelope.ok && envelope.data != null) {
     if (Array.isArray(envelope.data) && envelope.data.length > 0 && typeof envelope.data[0] === "object" && envelope.data[0] !== null) {
-      const { formatTable } = await import("./format-5X2HIVDT.js");
+      const { formatTable } = await import("./format-H7FOQSYY.js");
       process.stdout.write(
         formatTable(envelope.data) + "\n"
       );

package/build/{chunk-GZPDEXO4.js → chunk-7GD2MFYI.js}

@@ -5,6 +5,31 @@ import { createServer } from "http";
 import { randomBytes } from "crypto";
 import { execFile } from "child_process";
 import { platform } from "os";
+async function exchangeCliCode(args) {
+  const exchangeUrl = new URL("/auth/cli/exchange", args.baseUrl);
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 1e4);
+  try {
+    const response = await fetch(exchangeUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ code: args.code, state: args.state }),
+      signal: controller.signal
+    });
+    if (!response.ok) {
+      throw new Error(`CLI auth exchange failed with HTTP ${response.status}`);
+    }
+    const payload = await response.json();
+    const key = typeof payload.key === "string" ? payload.key : typeof payload.api_key?.key === "string" ? payload.api_key.key : "";
+    if (!key) throw new Error("CLI auth exchange returned no API key.");
+    return {
+      key,
+      email: typeof payload.email === "string" ? payload.email : ""
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+}
 function openBrowser(url) {
   const plat = platform();
   let cmd;
@@ -33,7 +58,7 @@ async function browserLogin(opts) {
   const state = randomBytes(16).toString("hex");
   return new Promise((resolve, reject) => {
     let settled = false;
-    const server = createServer((req, res) => {
+    const server = createServer(async (req, res) => {
       const url = new URL(req.url || "/", `http://localhost`);
       if (url.pathname !== "/callback") {
         res.writeHead(404);
@@ -45,20 +70,42 @@ async function browserLogin(opts) {
         res.end();
         return;
       }
-      const key = url.searchParams.get("key");
-      const email = url.searchParams.get("email");
+      const legacyKey = url.searchParams.get("key");
+      const code = url.searchParams.get("code");
       const returnedState = url.searchParams.get("state");
       if (returnedState !== state) {
         res.writeHead(403);
         res.end("State mismatch \u2014 possible CSRF attack. Please try again.");
         return;
       }
-      if (!key) {
+      if (legacyKey) {
+        res.writeHead(400);
+        res.end(
+          "Insecure legacy callback rejected. Please update Hive auth and try again."
+        );
+        return;
+      }
+      if (!code) {
         res.writeHead(400);
-        res.end("Missing API key in callback");
+        res.end("Missing one-time code in callback");
         return;
       }
       settled = true;
+      let exchanged;
+      try {
+        exchanged = await exchangeCliCode({
+          baseUrl,
+          code,
+          state: returnedState
+        });
+      } catch (error) {
+        clearTimeout(timer);
+        server.close();
+        res.writeHead(502);
+        res.end("Could not complete CLI auth exchange. Return to the terminal.");
+        reject(error);
+        return;
+      }
       res.writeHead(200, { "Content-Type": "text/html" });
       res.end(`<!DOCTYPE html>
 <html>
@@ -79,7 +126,11 @@ async function browserLogin(opts) {
 </html>`);
       clearTimeout(timer);
       server.close();
-      resolve({ key, email: email || "", state: returnedState });
+      resolve({
+        key: exchanged.key,
+        email: exchanged.email,
+        state: returnedState
+      });
     });
     server.listen(0, "127.0.0.1", () => {
       const addr = server.address();