CLI Commands Reference

# Discover once from the monorepo
cd ~/Git/hoox && hoox doctor

# Use from anywhere
cd ~/Videos && hx check health

hoox                                 Startup: resolve monorepo + chdir. No args: auto-onboard if no wrangler.jsonc; else menu/TUI
├── onboard                          One-shot full bootstrap (init + setup) [recommended]
│                                    aliases: bootstrap, quickstart
├── init                             Interactive setup wizard (config only)
│                                    --self-hosted prints VPS/Docker path and exits (does not write wrangler.jsonc)
├── setup                            Auto-bootstrap infrastructure (keys, D1, secrets, dashboard)
├── clone [name]                     Clone worker repositories as submodules
├── dev                              Local development execution engine
│   ├── start [--runtime native|docker]
│   ├── worker <name>                Start a single worker
│   └── dashboard                    Start Next.js dashboard dev server
├── deploy                           Edge deployment pipelines
│   ├── all                          Workers + dashboard [--env, --rebuild, --auto, --dry-run]
│   ├── workers                      Deploy all workers only (skip dashboard)
│   ├── worker <name>                Deploy a single edge worker
│   ├── dashboard                    Deploy Next.js dashboard via OpenNext [--rebuild]
│   ├── telegram-webhook             Register Telegram bot webhook API
│   ├── update-internal-urls         Bind inter-worker Service Binding URLs
│   ├── kv-config                    Synchronize KV manifest variables
│   ├── history <worker>             Show deployment history
│   └── rollback <worker> [version]  Rollback to a previous version
├── infra                            Cloudflare® resource provisioning
│   ├── provision [--dry-run]        Auto-provision all required services
│   ├── d1 [list/create/delete]      Manage D1 databases
│   ├── kv [list/create/delete]      Manage KV namespaces
│   ├── r2 [list/create/delete]      Manage R2 object storage buckets
│   ├── queues [list/create/delete]  Manage Cloudflare® Queues
│   ├── vectorize [list/create/delete]  Manage vector search indexes
│   └── analytics [list/create]      Manage Analytics Engine datasets
├── config                           Manage wrangler.jsonc configuration
│   ├── show                         View current configuration
│   ├── set <key> <value>            Update a config value
│   ├── env [init/show/validate/generate-dev-vars]
│   ├── kv [set/get/list/delete/apply-manifest/manifest]  CONFIG_KV runtime keys
│   ├── transport [show|set]         Operator transport (public|access|mtls|tunnel)
│   ├── secrets [list/set/delete/sync]  Cloudflare® Worker secrets (legacy location)
│   └── keys [generate/list]         Internal auth keys (legacy location)
├── secrets                          Manage Cloudflare® Worker secrets [top-level]
│   ├── list [worker]                List secrets for a worker
│   ├── set <worker> <name>          Set a secret (worker required; prompts for value)
│   ├── delete <worker> <name>       Delete a secret
│   └── sync [worker] [--system|--required]  Sync .dev.vars → CF (mesh-only with --system)
├── keys                             Manage internal auth keys [top-level]
│   ├── generate                     Generate new keys
│   └── list                         List existing keys
├── check                            Toolchain and route diagnostic suite
│   ├── prerequisites [--tool]       Validate local machine tool installs
│   ├── setup                        Full system validation (config, infra, secrets, db)
│   ├── health [--fix]               Probe worker /health endpoints
│   ├── fix [--dry-run]              Auto-repair common issues
│   └── submodule-gitignore (sg)     Validate/fix worker submodule .gitignore
├── doctor                           Runtime paths, remembered monorepo, TUI entry, security hygiene
├── tunnel                           Private ingress helpers (cloudflared / Access)
│   └── check                        Detect cloudflared; optional /v1/health probe
├── db                               SQLite D1 Database administration
│   ├── apply                        Apply DDL schemas to D1
│   ├── migrate                      Run schema migrations
│   ├── list                         Display active SQLite tables
│   ├── query <sql>                  Execute custom SQL reads
│   ├── export                       Dump database as a secure SQL file
│   └── reset                        Destructive truncate of all tables
├── monitor                          Observability and emergency controls
│   ├── trades [N]                   Aggregate recent filled transactions
│   ├── logs [worker]                Tail and inspect time-series logs
│   ├── kill-switch [show/on/off]    Emergency global trading halt
│   ├── queue-depth                  Audit message counts in queues
│   ├── backup                       Backup SQL ledger to backups/
│   └── analytics [summary/errors]   Query analytics data from D1
├── workers                          Per-worker operations
│   ├── list                         List all workers with status/path/catalog membership
│   ├── catalog                      Canonical worker catalog and default enabled flags
│   ├── enable <name...>             Enable workers in wrangler.jsonc (seeds from catalog)
│   ├── disable <name...>            Disable workers in wrangler.jsonc
│   ├── dev <name>                   Start a worker for local development
│   └── logs <name>                  Tail logs for a specific worker
├── repair                           System diagnostics & self-healing
│   ├── check                        Run diagnostics [--install-deps, --no-typecheck]
│   ├── worker <name>                Rebuild a degraded worker
│   ├── infra [--provision]          Verify and repair missing edge bindings
│   ├── secrets                      Re-sync hardware secrets (`secrets sync --system`)
│   ├── kv                           Restore KV manifest defaults
│   ├── db                           Re-apply schema.sql and tracking migrations
│   └── rebuild                      Full destructive interactive rebuild
├── logs                             Real-time Cloudflare® Worker log tailing
│   ├── worker <name>                Tail logs for a specific worker [--no-follow]
│   └── all                          Tail logs from all enabled workers
├── schema                           Validate/generate worker manifests
│   ├── validate [worker]            Validate worker(s) against canonical manifest
│   ├── list                         List workers with binding counts
│   └── generate <worker>            Generate wrangler.jsonc + .dev.vars from manifest
├── update [worker|wrangler]         git pull the repo, a worker submodule, or wrangler
├── test                             Run verification pipeline (CI)
│   ├── all                          lint → typecheck → unit → integration
│   ├── unit / integration / worker  Scoped test runs
│   └── live                         Live Cloudflare® service tests (no mocks)
├── waf                              Cloudflare® WAF
│   ├── status                       Show WAF status
│   ├── rules [list/add/remove]      Manage firewall rules
│   └── mode [enable/disable]        Enable or disable WAF
├── dashboard                        Unified dashboard operations
│   ├── dev                          Start the dashboard dev server
│   └── deploy [--rebuild]           Build and deploy the dashboard
├── tui                              Launch the OpenTUI terminal dashboard
│                                    --fps, --no-mouse, --remote, --api-url, --token, --debug, --allow-insecure
├── agent                            AI agent operations and health checks
│   └── health [--probe]             Provider config check; optional live probes
├── pyne                             PYNE edge evaluate (pyne-worker / Pine Script™)
│   ├── health                       Probe pyne-worker GET /health
│   ├── run <script>                 POST /run with a .pine file
│   ├── scripts [list|get|deploy|delete]  Managed scripts
│   ├── cron [jobs|run]              Bar-close jobs list / manual trigger
│   ├── feed refresh                 Pull latest klines into R2
│   ├── ingest                       Fetch OHLCV into storage
│   ├── sync-vendor                  Sync pynescript vendor modules
│   └── deploy                       sync-vendor + wrangler deploy
├── trace                            Cloudflare® Workers Observability (beta)
│   ├── events                       Query trace events (spans) with filters
│   ├── metrics                      Aggregate metrics (count, p99, …)
│   ├── live                         Live tail traces
│   ├── keys / values <key>          Filter key discovery
│   ├── destinations [add|remove]    OTLP export destinations
│   └── usage                        Trace event counts
├── perf                             Performance measurement tools
│   └── fastpath                     Probe-based latency measurement
│       ├── run [options]            Send N probes, report p50/p95/p99
│       ├── tail [options]           Continuous probing for a duration
│       └── report [options]         Query past probe events
├── disclaimer                       Display legal disclaimer
└── completion [shell]               Generate shell completion script (bash, zsh, fish)

# Recommended: one-shot full bootstrap (collects credentials, provisions, deploys)
hoox onboard
# aliases: hoox bootstrap, hoox quickstart

# Non-interactive one-shot
hoox onboard --token cfut_xxx --account xxx --preset full

# Step-by-step (more control)
hoox init        # Write wrangler.jsonc, collect integration secrets
hoox setup       # Mesh keys, D1 schema, secrets, dashboard

# Self-hosted (no Cloudflare®): print VPS / Docker path and exit
# Does not write wrangler.jsonc
hoox init --self-hosted

# Verify the system
hoox check setup
hoox check prerequisites

# Start all workers in a Docker container stack
hoox dev start --runtime docker

# Start all workers natively via wrangler dev
hoox dev start --runtime native

# Start a single worker
hoox dev worker trade-worker

# Start the Next.js dashboard dev server
hoox dev dashboard
# OR (equivalent):
hoox dashboard dev

# Provision all databases, buckets, and queues on your Cloudflare® account
hoox infra provision
hoox infra provision --dry-run

# Deploy the entire microservices stack in sequence
hoox deploy all --auto

# JSON: task-result array on stdout. Quiet: no stdout.
hoox deploy all --json
hoox deploy all --quiet

# Preview without executing
hoox deploy all --dry-run

# Deploy a single worker
hoox deploy worker trade-worker

# Build and deploy the Next.js dashboard
hoox dashboard deploy --rebuild
# OR (equivalent):
hoox deploy dashboard --rebuild

# Check all worker health endpoints (the single source of truth)
hoox check health

# Try to auto-fix any issues found
hoox check health --fix

# Auto-repair common local issues (preview first)
hoox check fix --dry-run
hoox check fix

# Audit active trade history table
hoox monitor trades 25

# Emergency Halt: halt all trade signals globally
hoox monitor kill-switch show
hoox monitor kill-switch on
hoox monitor kill-switch off

hoox monitor queue-depth
hoox monitor analytics summary
hoox monitor analytics errors --hours 24

# Set a Cloudflare® Worker secret (live exchange keys)
hoox secrets set trade-worker EXCHANGE_KEY_BINDING
hoox secrets set trade-worker EXCHANGE_SECRET_BINDING

# Optional satellite (clones if the tree is empty)
hoox secrets set pyne-agent-worker API_KEY --yes

# List secrets for a worker
hoox secrets list trade-worker

# Sync mesh/system secrets only (INTERNAL_KEY_BINDING, WEBHOOK_*, …)
hoox secrets sync --system
# Alias: hoox secrets sync --required

# Sync all declared secrets from .dev.vars
# Reports partial results: synced / skipped (placeholders) / failed
hoox secrets sync

# Generate internal auth keys (prints redacted names only)
hoox keys generate

# List existing keys
hoox keys list

hoox workers list
hoox workers catalog
hoox workers enable trade-worker agent-worker
hoox workers enable pyne-agent-worker --yes
hoox workers disable web3-wallet-worker email-worker
hoox workers catalog --json

# Query the total sum of fees paid today across Bybit
hoox db query "SELECT SUM(fee) FROM trades WHERE created_at >= date('now')" --remote

hoox pyne health
hoox pyne run ./strategy.pine --mode auto
hoox pyne scripts list
hoox pyne scripts get <id>
hoox pyne scripts deploy ./strategy.pine --id my-strategy
hoox pyne scripts delete <id>
hoox pyne cron jobs
hoox pyne cron run
hoox pyne feed refresh
hoox pyne ingest -- --symbol BTCUSDT --timeframe 1d
hoox pyne sync-vendor && hoox pyne deploy

hoox tui
hoox tui --fps 30 --no-mouse
hoox tui --remote --token "$HOOX_API_TOKEN"
hoox tui --api-url https://mgmt.example.com --token "$HOOX_API_TOKEN"
hoox tui --debug
# Escape hatch (not recommended):
hoox tui --remote --allow-insecure

hoox update              # git pull of the main repo
hoox update d1-worker    # update that worker's submodule from its remote
hoox update wrangler     # update wrangler to the latest version

# Send 50 synthetic probes and report p50/p95/p99 per-hop latency
hoox perf fastpath run --n 50

# Continuous probing for 60 seconds
hoox perf fastpath tail --duration 60

# Query past probe events
hoox perf fastpath report --from 1h

# Run a full workspace system audit
hoox repair check
hoox repair check --install-deps --no-typecheck

# Verify worker health (the single source of truth)
hoox check health

hoox doctor
hoox doctor --security
hoox tunnel check