@delt/claude-alarm 0.8.2 → 0.9.1

package/dist/cli.js

@@ -190,11 +190,24 @@ var init_crash_guard = __esm({
   }
 });
 
+// src/shared/peer-name.ts
+function isValidPeerName(name) {
+  return typeof name === "string" && name.trim() !== "" && SAFE_PEER_NAME.test(name);
+}
+var SAFE_PEER_NAME;
+var init_peer_name = __esm({
+  "src/shared/peer-name.ts"() {
+    "use strict";
+    SAFE_PEER_NAME = /^[^\u0000-\u001f\u007f"\\[\]]{1,128}$/;
+  }
+});
+
 // src/hub/session-manager.ts
 var SessionManager;
 var init_session_manager = __esm({
   "src/hub/session-manager.ts"() {
     "use strict";
+    init_peer_name();
     SessionManager = class {
       sessions = /* @__PURE__ */ new Map();
       register(session) {
@@ -217,7 +230,7 @@ var init_session_manager = __esm({
         } else {
           session.displayName = baseName;
         }
-        this.sessions.set(session.id, { ...session });
+        this.sessions.set(session.id, { ...session, peerName: isValidPeerName(session.peerName) ? session.peerName : void 0 });
       }
       unregister(sessionId2) {
         const session = this.sessions.get(sessionId2);
@@ -232,6 +245,13 @@ var init_session_manager = __esm({
         }
         return session;
       }
+      setPeerName(sessionId2, peerName2) {
+        const session = this.sessions.get(sessionId2);
+        if (session) {
+          session.peerName = isValidPeerName(peerName2) ? peerName2 : void 0;
+        }
+        return session;
+      }
       updateActivity(sessionId2) {
         const session = this.sessions.get(sessionId2);
         if (session) {
@@ -676,6 +696,7 @@ ${previewHtml}${truncNote}`;
       }
       async handleCallbackQuery(query) {
         if (!query.data) return;
+        if (String(query.message?.chat.id) !== String(this.config.chatId)) return;
         if (query.data.startsWith("sess:")) {
           await this.handleSessionSelectCallback(query);
           return;
@@ -778,8 +799,8 @@ ${label}`);
         css: "css",
         scss: "scss"
       };
-      langOf(path7) {
-        const m = /\.([a-z0-9]+)$/i.exec(path7 || "");
+      langOf(path8) {
+        const m = /\.([a-z0-9]+)$/i.exec(path8 || "");
         return m ? _TelegramBot.LANG_BY_EXT[m[1].toLowerCase()] ?? "" : "";
       }
       /** Convert markdown to Telegram HTML (escape first, then apply formatting) */
@@ -824,6 +845,69 @@ ${bodyLines.join("\n")}`;
   }
 });
 
+// src/hub/auth.ts
+import crypto from "crypto";
+function safeEqual(a, b) {
+  if (typeof a !== "string") return false;
+  const x = Buffer.from(a);
+  const y = Buffer.from(b);
+  return x.length === y.length && crypto.timingSafeEqual(x, y);
+}
+function dashboardCookieValue(token) {
+  return crypto.createHmac("sha256", token).update("claude-alarm-dashboard").digest("hex");
+}
+function parseCookies(header) {
+  const out = {};
+  for (const part of (header ?? "").split(";")) {
+    const i = part.indexOf("=");
+    if (i <= 0) continue;
+    const raw = part.slice(i + 1).trim();
+    let value = raw;
+    try {
+      value = decodeURIComponent(raw);
+    } catch {
+    }
+    out[part.slice(0, i).trim()] = value;
+  }
+  return out;
+}
+function sessionCookieHeader(token, secure) {
+  return `${SESSION_COOKIE}=${dashboardCookieValue(token)}; HttpOnly; SameSite=Strict; Path=/; Max-Age=${COOKIE_MAX_AGE}${secure ? "; Secure" : ""}`;
+}
+function isAuthorized(req, token, allowQueryToken) {
+  const auth = req.headers.authorization;
+  if (auth?.startsWith("Bearer ") && safeEqual(auth.slice(7), token)) return true;
+  if (safeEqual(parseCookies(req.headers.cookie)[SESSION_COOKIE], dashboardCookieValue(token))) return true;
+  if (allowQueryToken) {
+    const q = new URL(req.url ?? "/", "http://hub").searchParams.get("token");
+    if (safeEqual(q, token)) return true;
+  }
+  return false;
+}
+function isCrossOrigin(req) {
+  const origin = req.headers.origin;
+  if (!origin) return false;
+  try {
+    return new URL(origin).host !== req.headers.host;
+  } catch {
+    return true;
+  }
+}
+function isJsonRequest(req) {
+  return String(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json");
+}
+function isSecureRequest(req) {
+  return req.headers["x-forwarded-proto"] === "https";
+}
+var SESSION_COOKIE, COOKIE_MAX_AGE;
+var init_auth = __esm({
+  "src/hub/auth.ts"() {
+    "use strict";
+    SESSION_COOKIE = "ca_session";
+    COOKIE_MAX_AGE = 30 * 24 * 60 * 60;
+  }
+});
+
 // src/hub/server.ts
 var server_exports = {};
 __export(server_exports, {
@@ -835,7 +919,7 @@ import path4 from "path";
 import { fileURLToPath } from "url";
 import { WebSocketServer, WebSocket } from "ws";
 import { randomUUID as randomUUID3 } from "crypto";
-var __dirname, HubServer;
+var __dirname, MAX_WS_PAYLOAD, HubServer;
 var init_server = __esm({
   "src/hub/server.ts"() {
     "use strict";
@@ -846,7 +930,9 @@ var init_server = __esm({
     init_telegram();
     init_config();
     init_crash_guard();
+    init_auth();
     __dirname = path4.dirname(fileURLToPath(import.meta.url));
+    MAX_WS_PAYLOAD = 16 * 1024 * 1024;
     HubServer = class {
       httpServer;
       wssChannel;
@@ -864,6 +950,7 @@ var init_server = __esm({
       heartbeatInterval;
       channelAlive = /* @__PURE__ */ new Map();
       // sessionId -> alive flag
+      socketOwners = /* @__PURE__ */ new WeakMap();
       host;
       port;
       token;
@@ -886,22 +973,23 @@ var init_server = __esm({
           this.initTelegram(fullConfig.telegram);
         }
         this.httpServer = http.createServer((req, res) => this.handleHttp(req, res));
-        this.wssChannel = new WebSocketServer({ noServer: true });
+        this.wssChannel = new WebSocketServer({ noServer: true, maxPayload: MAX_WS_PAYLOAD });
         this.wssChannel.on("connection", (ws, req) => this.handleChannelConnection(ws, req));
         this.wssChannel.on("error", (err) => logger.warn(`Channel WebSocket server error: ${err.message}`));
-        this.wssDashboard = new WebSocketServer({ noServer: true });
+        this.wssDashboard = new WebSocketServer({ noServer: true, maxPayload: MAX_WS_PAYLOAD });
         this.wssDashboard.on("connection", (ws) => this.handleDashboardConnection(ws));
         this.wssDashboard.on("error", (err) => logger.warn(`Dashboard WebSocket server error: ${err.message}`));
         this.httpServer.on("upgrade", (req, socket, head) => {
           socket.on("error", (err) => logger.debug(`Upgrade socket error: ${err.message}`));
-          const url = new URL(req.url, `http://${req.headers.host}`);
+          const url = new URL(req.url ?? "/", "http://hub");
           const pathname = url.pathname;
-          if (this.token && !this.isLocalRequest(req)) {
-            const wsToken = url.searchParams.get("token");
-            if (wsToken !== this.token) {
-              socket.destroy();
-              return;
-            }
+          if (isCrossOrigin(req)) {
+            this.rejectUpgrade(socket, 403, "Forbidden", pathname, req);
+            return;
+          }
+          if (!this.authorized(req, true)) {
+            this.rejectUpgrade(socket, 401, "Unauthorized", pathname, req);
+            return;
           }
           if (pathname === WS_PATH_CHANNEL) {
             this.wssChannel.handleUpgrade(req, socket, head, (ws) => {
@@ -953,31 +1041,28 @@ var init_server = __esm({
       }
       // --- HTTP Handler ---
       handleHttp(req, res) {
-        const url = new URL(req.url, `http://${req.headers.host}`);
-        const origin = req.headers.origin;
-        if (origin && (origin.includes("127.0.0.1") || origin.includes("localhost"))) {
-          res.setHeader("Access-Control-Allow-Origin", origin);
-        }
-        res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
-        res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
-        if (req.method === "OPTIONS") {
-          res.writeHead(204);
-          res.end();
+        const url = new URL(req.url ?? "/", "http://hub");
+        if (isCrossOrigin(req)) {
+          this.jsonResponse(res, 403, { error: "Cross-origin request rejected" });
           return;
         }
-        if (url.pathname !== "/" && this.token) {
-          if (!this.isLocalRequest(req)) {
-            const authHeader = req.headers["authorization"];
-            const bearerToken = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null;
-            if (bearerToken !== this.token) {
-              this.jsonResponse(res, 401, { error: "Unauthorized" });
-              return;
-            }
-          }
+        if (req.method === "POST" && !isJsonRequest(req)) {
+          this.jsonResponse(res, 415, { error: "Content-Type must be application/json" });
+          return;
         }
         if (url.pathname === "/" && req.method === "GET") {
-          this.serveDashboard(res);
-        } else if (url.pathname === "/api/sessions" && req.method === "GET") {
+          this.serveDashboard(req, res, url);
+          return;
+        }
+        if (url.pathname === "/api/login" && req.method === "POST") {
+          this.handleLogin(req, res);
+          return;
+        }
+        if (!this.authorized(req, false)) {
+          this.jsonResponse(res, 401, { error: "Unauthorized" });
+          return;
+        }
+        if (url.pathname === "/api/sessions" && req.method === "GET") {
           this.jsonResponse(res, 200, { sessions: this.sessions.getAll() });
         } else if (url.pathname === "/api/status" && req.method === "GET") {
           this.jsonResponse(res, 200, {
@@ -1028,7 +1113,13 @@ var init_server = __esm({
           this.jsonResponse(res, 404, { error: "Not found" });
         }
       }
-      serveDashboard(res) {
+      serveDashboard(req, res, url) {
+        const linkToken = url.searchParams.get("token");
+        if (linkToken !== null && this.token && safeEqual(linkToken, this.token)) {
+          res.writeHead(302, { Location: "/", "Set-Cookie": sessionCookieHeader(this.token, isSecureRequest(req)) });
+          res.end();
+          return;
+        }
         const candidates = [
           path4.join(__dirname, "..", "dashboard", "index.html"),
           // from dist/hub/
@@ -1055,6 +1146,20 @@ var init_server = __esm({
         res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
         res.end("<html><body><h1>claude-alarm</h1><p>Dashboard HTML not found. Reinstall the package.</p></body></html>");
       }
+      async handleLogin(req, res) {
+        const body = await this.readBody(req);
+        if (!this.token) {
+          res.writeHead(204);
+          res.end();
+          return;
+        }
+        if (typeof body?.token !== "string" || !safeEqual(body.token, this.token)) {
+          this.jsonResponse(res, 401, { error: "Unauthorized" });
+          return;
+        }
+        res.writeHead(204, { "Set-Cookie": sessionCookieHeader(this.token, isSecureRequest(req)) });
+        res.end();
+      }
       async handleApiSend(req, res) {
         const body = await this.readBody(req);
         if (!body) {
@@ -1131,6 +1236,22 @@ var init_server = __esm({
         });
       }
       handleChannelMessage(ws, isLocal, msg) {
+        if (msg.type === "register") {
+          const id = msg.session.id;
+          const owned = this.socketOwners.get(ws);
+          if (owned && owned !== id) {
+            logger.warn(`Rejected register for ${id}: connection already owns ${owned}`);
+            return;
+          }
+          const holder = this.channelSockets.get(id);
+          if (holder && holder !== ws) {
+            this.socketOwners.delete(holder);
+            holder.terminate();
+          }
+          this.socketOwners.set(ws, id);
+        } else if ("sessionId" in msg && this.socketOwners.get(ws) !== msg.sessionId) {
+          return;
+        }
         switch (msg.type) {
           case "register": {
             const session = msg.session;
@@ -1139,7 +1260,7 @@ var init_server = __esm({
             this.sessions.register(session);
             this.channelSockets.set(session.id, ws);
             if (isLocal) this.localChannels.add(session.id);
-            logger.info(`Session registered: ${session.id} (${session.name}, channel: ${session.channelEnabled ?? false})`);
+            logger.info(`Session registered: ${session.id} (${session.name}, channel: ${session.channelEnabled ?? false}, peer: ${session.peerName ?? "-"})`);
             this.broadcastToDashboards({
               type: isReregister ? "session_updated" : "session_connected",
               session
@@ -1153,6 +1274,14 @@ var init_server = __esm({
             }
             break;
           }
+          case "peer_name": {
+            const updated = this.sessions.setPeerName(msg.sessionId, msg.peerName);
+            if (updated) {
+              logger.info(`Peer name for ${msg.sessionId}: ${msg.peerName ?? "-"}`);
+              this.broadcastToDashboards({ type: "session_updated", session: updated });
+            }
+            break;
+          }
           case "notify": {
             this.sessions.updateActivity(msg.sessionId);
             const notifySession = this.sessions.get(msg.sessionId);
@@ -1473,6 +1602,18 @@ var init_server = __esm({
         res.writeHead(status, { "Content-Type": "application/json" });
         res.end(JSON.stringify(body));
       }
+      authorized(req, allowQueryToken) {
+        return !this.token || isAuthorized(req, this.token, allowQueryToken);
+      }
+      rejectUpgrade(socket, status, text, pathname, req) {
+        logger.warn(`Rejected ${pathname} upgrade (${status}) from ${req.socket.remoteAddress}`);
+        socket.write(`HTTP/1.1 ${status} ${text}\r
+Connection: close\r
+Content-Length: 0\r
+\r
+`);
+        socket.destroy();
+      }
       isLocalRequest(req) {
         const addr = req.socket.remoteAddress;
         return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
@@ -1527,12 +1668,13 @@ var init_hub_client = __esm({
     init_logger();
     init_constants();
     HubClient = class {
-      constructor(sessionId2, sessionName2, hubHost2 = DEFAULT_HUB_HOST, hubPort2 = DEFAULT_HUB_PORT, token) {
+      constructor(sessionId2, sessionName2, hubHost2 = DEFAULT_HUB_HOST, hubPort2 = DEFAULT_HUB_PORT, token, getPeerName = () => void 0) {
         this.sessionId = sessionId2;
         this.sessionName = sessionName2;
         this.hubHost = hubHost2;
         this.hubPort = hubPort2;
         this.token = token;
+        this.getPeerName = getPeerName;
       }
       ws = null;
       reconnectTimer = null;
@@ -1557,7 +1699,8 @@ var init_hub_client = __esm({
                 connectedAt: Date.now(),
                 lastActivity: Date.now(),
                 cwd: process.cwd(),
-                channelEnabled: true
+                channelEnabled: true,
+                peerName: this.getPeerName()
               }
             };
             this.ws.send(JSON.stringify(registration));
@@ -1625,6 +1768,53 @@ var init_hub_client = __esm({
   }
 });
 
+// src/channel/peer-name.ts
+import fs5 from "fs";
+import os2 from "os";
+import path5 from "path";
+function findPeerName(records, env) {
+  const valid = records.filter((r) => typeof r === "object" && r !== null);
+  const nameOf = (match) => {
+    const rec = valid.find(match);
+    return isValidPeerName(rec?.name) ? rec.name : void 0;
+  };
+  if (env.messagingSocket) {
+    const bySocket = nameOf((r) => r.messagingSocketPath === env.messagingSocket);
+    if (bySocket) return bySocket;
+  }
+  if (env.sessionId) return nameOf((r) => r.sessionId === env.sessionId);
+  return void 0;
+}
+function readPeerName(env = process.env) {
+  const lookup = {
+    messagingSocket: env.CLAUDE_CODE_MESSAGING_SOCKET,
+    sessionId: env.CLAUDE_CODE_SESSION_ID
+  };
+  if (!lookup.messagingSocket && !lookup.sessionId) return void 0;
+  const configDir = env.CLAUDE_CONFIG_DIR || path5.join(os2.homedir(), ".claude");
+  const dir = path5.join(configDir, "sessions");
+  let files;
+  try {
+    files = fs5.readdirSync(dir).filter((f) => f.endsWith(".json"));
+  } catch {
+    return void 0;
+  }
+  const records = [];
+  for (const f of files) {
+    try {
+      records.push(JSON.parse(fs5.readFileSync(path5.join(dir, f), "utf8")));
+    } catch {
+    }
+  }
+  return findPeerName(records, lookup);
+}
+var init_peer_name2 = __esm({
+  "src/channel/peer-name.ts"() {
+    "use strict";
+    init_peer_name();
+  }
+});
+
 // src/channel/server.ts
 var server_exports2 = {};
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
@@ -1635,10 +1825,19 @@ import {
 } from "@modelcontextprotocol/sdk/types.js";
 import { z } from "zod";
 import { randomUUID as randomUUID4 } from "crypto";
-import path5 from "path";
+import path6 from "path";
 async function main() {
   logger.info(`Starting MCP channel server (session: ${sessionId})`);
   hubClient.connect();
+  const refreshPeerName = () => {
+    const next = readPeerName();
+    if (next === peerName) return;
+    peerName = next;
+    logger.info(`Peer name: ${next ?? "(none)"}`);
+    hubClient.send({ type: "peer_name", sessionId, peerName: next });
+  };
+  setTimeout(refreshPeerName, 2e3).unref();
+  setInterval(refreshPeerName, 3e4).unref();
   hubClient.onMessage(async (msg) => {
     if (msg.type === "message_to_session" && msg.sessionId === sessionId) {
       logger.info(`Message from dashboard: ${msg.content}`);
@@ -1685,7 +1884,7 @@ ${msg.content}` : "";
     process.exit(0);
   });
 }
-var sessionId, sessionName, server, config, hubHost, hubPort, hubToken, hubClient, PermissionRequestSchema;
+var sessionId, sessionName, peerName, server, config, hubHost, hubPort, hubToken, hubClient, PermissionRequestSchema;
 var init_server2 = __esm({
   "src/channel/server.ts"() {
     "use strict";
@@ -1693,8 +1892,10 @@ var init_server2 = __esm({
     init_constants();
     init_config();
     init_hub_client();
+    init_peer_name2();
     sessionId = randomUUID4();
-    sessionName = process.env.CLAUDE_ALARM_SESSION_NAME ?? path5.basename(process.cwd());
+    sessionName = process.env.CLAUDE_ALARM_SESSION_NAME ?? path6.basename(process.cwd());
+    peerName = readPeerName();
     server = new Server(
       {
         name: CHANNEL_SERVER_NAME,
@@ -1717,6 +1918,8 @@ REPLYING:
 
 IMAGES: If a channel message contains "[Image: ...] Read the file to view it: <path>", use the Read tool on that path before responding \u2014 otherwise the image is invisible to you.
 
+ROUTING: If a dashboard message has lines like [claude-alarm] @X = SendMessage to "Y", do what the message asks and deliver the result with the SendMessage tool to exactly "Y". Never guess other recipients. Then reply to the dashboard with what you sent.
+
 STATUS: Call status("working") before starting a long task, status("waiting_input") when blocked on user input, status("idle") when finished responding.
 
 NOTIFICATIONS:
@@ -1733,7 +1936,8 @@ NOTIFICATIONS:
       sessionName,
       hubHost,
       hubPort,
-      hubToken
+      hubToken,
+      () => peerName
     );
     server.setRequestHandler(ListToolsRequestSchema, async () => ({
       tools: [
@@ -1870,11 +2074,17 @@ init_constants();
 init_logger();
 init_crash_guard();
 import { spawn } from "child_process";
-import fs5 from "fs";
-import path6 from "path";
+import fs6 from "fs";
+import path7 from "path";
 import readline from "readline";
 import { fileURLToPath as fileURLToPath2 } from "url";
-var __dirname2 = path6.dirname(fileURLToPath2(import.meta.url));
+var __dirname2 = path7.dirname(fileURLToPath2(import.meta.url));
+function authHeaders(token) {
+  return token ? { Authorization: `Bearer ${token}` } : {};
+}
+function loginLink(displayHost, port, token) {
+  return `http://${displayHost}:${port}/${token ? `?token=${encodeURIComponent(token)}` : ""}`;
+}
 function printUsage() {
   console.log(`
 claude-alarm - Monitor Claude Code sessions with notifications
@@ -1895,8 +2105,8 @@ Quick start:
 }
 async function checkForUpdates() {
   try {
-    const pkgPath = path6.join(__dirname2, "..", "package.json");
-    const pkg = JSON.parse(fs5.readFileSync(pkgPath, "utf-8"));
+    const pkgPath = path7.join(__dirname2, "..", "package.json");
+    const pkg = JSON.parse(fs6.readFileSync(pkgPath, "utf-8"));
     const currentVersion = pkg.version;
     const res = await fetch("https://registry.npmjs.org/@delt/claude-alarm/latest", {
       signal: AbortSignal.timeout(3e3)
@@ -1919,28 +2129,28 @@ async function hubStart(daemon) {
   const port = config2.hub.port ?? DEFAULT_HUB_PORT;
   const displayHost = host === "0.0.0.0" ? "127.0.0.1" : host;
   checkForUpdates();
-  if (fs5.existsSync(PID_FILE)) {
-    const pid = parseInt(fs5.readFileSync(PID_FILE, "utf-8").trim(), 10);
+  if (fs6.existsSync(PID_FILE)) {
+    const pid = parseInt(fs6.readFileSync(PID_FILE, "utf-8").trim(), 10);
     if (isProcessRunning(pid)) {
-      console.log(`Hub is already running (PID: ${pid}) on http://${displayHost}:${port}`);
+      console.log(`Hub is already running (PID: ${pid}). Dashboard: ${loginLink(displayHost, port, config2.hub.token)}`);
       return;
     }
-    fs5.unlinkSync(PID_FILE);
+    fs6.unlinkSync(PID_FILE);
   }
   if (daemon) {
     ensureConfigDir();
-    const logFd = fs5.openSync(LOG_FILE, "a");
-    const hubScript = path6.join(__dirname2, "hub", "server.js");
+    const logFd = fs6.openSync(LOG_FILE, "a");
+    const hubScript = path7.join(__dirname2, "hub", "server.js");
     const child = spawn(process.execPath, [hubScript], {
       detached: true,
       stdio: ["ignore", logFd, logFd],
       env: { ...process.env }
     });
     if (child.pid) {
-      fs5.writeFileSync(PID_FILE, String(child.pid), "utf-8");
+      fs6.writeFileSync(PID_FILE, String(child.pid), "utf-8");
       child.unref();
       console.log(`Hub started as daemon (PID: ${child.pid})`);
-      console.log(`Dashboard: http://${displayHost}:${port}`);
+      console.log(`Dashboard: ${loginLink(displayHost, port, config2.hub.token)}`);
       console.log(`Token: ${config2.hub.token}`);
       console.log(`Logs: ${LOG_FILE}`);
     } else {
@@ -1949,6 +2159,7 @@ async function hubStart(daemon) {
     }
   } else {
     console.log(`Starting hub on http://${displayHost}:${port} (press Ctrl+C to stop)`);
+    console.log(`Dashboard: ${loginLink(displayHost, port, config2.hub.token)}`);
     console.log(`Token: ${config2.hub.token}`);
     console.log(`Logs: ${LOG_FILE}`);
     installCrashGuard("hub foreground");
@@ -1957,11 +2168,11 @@ async function hubStart(daemon) {
     const hub = new HubServer2(config2);
     await hub.start();
     ensureConfigDir();
-    fs5.writeFileSync(PID_FILE, String(process.pid), "utf-8");
+    fs6.writeFileSync(PID_FILE, String(process.pid), "utf-8");
     const shutdown = async () => {
       console.log("\nShutting down...");
       await hub.stop();
-      if (fs5.existsSync(PID_FILE)) fs5.unlinkSync(PID_FILE);
+      if (fs6.existsSync(PID_FILE)) fs6.unlinkSync(PID_FILE);
       process.exit(0);
     };
     process.on("SIGINT", shutdown);
@@ -1969,18 +2180,18 @@ async function hubStart(daemon) {
   }
 }
 function hubStop() {
-  if (!fs5.existsSync(PID_FILE)) {
+  if (!fs6.existsSync(PID_FILE)) {
     console.log("Hub is not running (no PID file found)");
     return;
   }
-  const pid = parseInt(fs5.readFileSync(PID_FILE, "utf-8").trim(), 10);
+  const pid = parseInt(fs6.readFileSync(PID_FILE, "utf-8").trim(), 10);
   try {
     process.kill(pid, "SIGTERM");
     console.log(`Hub stopped (PID: ${pid})`);
   } catch {
     console.log("Hub process not found (may have already stopped)");
   }
-  fs5.unlinkSync(PID_FILE);
+  fs6.unlinkSync(PID_FILE);
 }
 async function hubStatus() {
   const config2 = loadConfig();
@@ -1988,8 +2199,8 @@ async function hubStatus() {
   const port = config2.hub.port ?? DEFAULT_HUB_PORT;
   const displayHost = host === "0.0.0.0" ? "127.0.0.1" : host;
   let pidInfo = "not running";
-  if (fs5.existsSync(PID_FILE)) {
-    const pid = parseInt(fs5.readFileSync(PID_FILE, "utf-8").trim(), 10);
+  if (fs6.existsSync(PID_FILE)) {
+    const pid = parseInt(fs6.readFileSync(PID_FILE, "utf-8").trim(), 10);
     if (isProcessRunning(pid)) {
       pidInfo = `running (PID: ${pid})`;
     } else {
@@ -1997,7 +2208,7 @@ async function hubStatus() {
     }
   }
   try {
-    const res = await fetch(`http://${host}:${port}/api/status`);
+    const res = await fetch(`http://${host}:${port}/api/status`, { headers: authHeaders(config2.hub.token) });
     if (res.ok) {
       const data = await res.json();
       console.log(`Hub: running (PID: ${data.pid})`);
@@ -2061,7 +2272,7 @@ function ask(question) {
 }
 async function init() {
   const dir = process.cwd();
-  const projectName = path6.basename(dir);
+  const projectName = path7.basename(dir);
   console.log(`
 claude-alarm init for "${projectName}"
 `);
@@ -2081,11 +2292,11 @@ claude-alarm init for "${projectName}"
     if (port) env.CLAUDE_ALARM_HUB_PORT = port;
     if (token) env.CLAUDE_ALARM_HUB_TOKEN = token;
   }
-  const mcpPath = path6.join(dir, ".mcp.json");
+  const mcpPath = path7.join(dir, ".mcp.json");
   let mcpConfig = {};
-  if (fs5.existsSync(mcpPath)) {
+  if (fs6.existsSync(mcpPath)) {
     try {
-      mcpConfig = JSON.parse(fs5.readFileSync(mcpPath, "utf-8"));
+      mcpConfig = JSON.parse(fs6.readFileSync(mcpPath, "utf-8"));
     } catch {
       mcpConfig = {};
     }
@@ -2096,7 +2307,7 @@ claude-alarm init for "${projectName}"
     args: ["-y", "@delt/claude-alarm", "serve"],
     env
   };
-  fs5.writeFileSync(mcpPath, JSON.stringify(mcpConfig, null, 2), "utf-8");
+  fs6.writeFileSync(mcpPath, JSON.stringify(mcpConfig, null, 2), "utf-8");
   console.log(`
 \u2713 Created ${mcpPath}`);
   if (remote.toLowerCase() !== "y") {
@@ -2106,7 +2317,7 @@ claude-alarm init for "${projectName}"
     const displayHost = host === "0.0.0.0" ? "127.0.0.1" : host;
     let hubRunning = false;
     try {
-      const res = await fetch(`http://${host}:${port}/api/status`);
+      const res = await fetch(`http://${host}:${port}/api/status`, { headers: authHeaders(config2.hub.token) });
       hubRunning = res.ok;
     } catch {
     }