kojee-mcp 0.5.0 → 0.5.3

package/dist/cli.js

@@ -1,17 +1,18 @@
 #!/usr/bin/env node
+import {
+  loadPairedConfig,
+  pairedConfigPath,
+  savePairedConfig
+} from "./chunk-YH27B6SW.js";
 import {
   AuthModule,
   VERSION,
   startProxy
-} from "./chunk-LCFCCWMM.js";
-import "./chunk-QB22PD6T.js";
-import "./chunk-E26AHU6J.js";
+} from "./chunk-YEC7IHIG.js";
 import "./chunk-BJMASMKX.js";
-import {
-  loadPairedConfig,
-  pairedConfigPath,
-  savePairedConfig
-} from "./chunk-GBOTBYEP.js";
+import "./chunk-C6GZ2L2W.js";
+import "./chunk-WBMX4CHB.js";
+import "./chunk-BLEGIR35.js";
 
 // src/cli.ts
 import { Command } from "commander";
@@ -82,22 +83,26 @@ program.command("pair <code>").description("Pair this machine against Kojee usin
     process.exit(1);
   }
 });
-program.command("hook").description("Run a kojee MCP hook script (called by Claude Code via ~/.claude/settings.json)").requiredOption("--type <type>", "Hook type: stop or user-prompt-submit").action(async (opts) => {
+program.command("hook").description("Run a kojee MCP hook script (called by Claude Code via ~/.claude/settings.json)").requiredOption("--type <type>", "Hook type: stop, user-prompt-submit, or codex-stop").action(async (opts) => {
   if (opts.type === "stop") {
-    const { runStopHook } = await import("./stop-hook-VLQS6QPR.js");
+    const { runStopHook } = await import("./stop-hook-SEPWWETV.js");
     await runStopHook();
     process.exit(0);
   } else if (opts.type === "user-prompt-submit") {
-    const { runUserPromptSubmitHook } = await import("./user-prompt-submit-hook-C42DPDBO.js");
+    const { runUserPromptSubmitHook } = await import("./user-prompt-submit-hook-ARPEO6FF.js");
     await runUserPromptSubmitHook();
     process.exit(0);
+  } else if (opts.type === "codex-stop") {
+    const { runCodexStopHook } = await import("./codex-stop-hook-JOTBCS5K.js");
+    await runCodexStopHook();
+    process.exit(0);
   } else {
-    console.error(`Unknown hook type: ${opts.type}. Expected 'stop' or 'user-prompt-submit'.`);
+    console.error(`Unknown hook type: ${opts.type}. Expected 'stop', 'user-prompt-submit', or 'codex-stop'.`);
     process.exit(1);
   }
 });
 program.command("install-hooks").description("Install kojee Stop + UserPromptSubmit hooks in ~/.claude/settings.json (idempotent)").option("--hooks-path <path>", "Override default ~/.claude/settings.json").option("--uninstall", "Remove kojee hook entries instead of installing them").action(async (opts) => {
-  const { installHooks, uninstallHooks } = await import("./install-D2HIPOMT.js");
+  const { installHooks, uninstallHooks } = await import("./install-WBIUVBZW.js");
   if (opts.uninstall) {
     const removed = uninstallHooks({ hooksPath: opts.hooksPath });
     console.error(removed ? "Removed kojee hook entries." : "No kojee hook entries found.");
@@ -112,7 +117,7 @@ Restart Claude Code for hooks to take effect.`
   }
 });
 program.command("tail <path>").description("Stream a file's contents and follow appends (portable replacement for `tail -F`)").action(async (filePath) => {
-  const { runTail } = await import("./tail-stream-UZ42UIWO.js");
+  const { runTail } = await import("./tail-stream-BYKO4DW6.js");
   try {
     await runTail(filePath);
   } catch (err) {
@@ -121,79 +126,47 @@ program.command("tail <path>").description("Stream a file's contents and follow
   }
 });
 program.command("doctor").description("Diagnose the kojee wake path (proxy, hook-server, SSE stream, event log, Monitor) and print the exact wake recipe").action(async () => {
-  const { runDoctor } = await import("./doctor-GILTOH2R.js");
+  const { runDoctor } = await import("./doctor-TSHOMT5X.js");
   const code = await runDoctor();
   process.exit(code);
 });
-program.command("init").description("Install kojee into Claude Code (MCP server entry + hooks). Run after `kojee-mcp pair`.").option("--config-path <path>", "Override default ~/.claude.json").option("--uninstall", "Remove the kojee MCP server entry and hooks").action(async (opts) => {
-  const { loadPairedConfig: loadPairedConfig2 } = await import("./paired-config-RB4SABOS.js");
+program.command("init").description(
+  "Set up kojee for a runtime (claude-code | hermes | openclaw | codex). Interactive when stdin is a TTY; `--runtime <id>` for non-interactive/CI. Run after `kojee-mcp pair`."
+).option("--runtime <id>", "Target runtime: claude-code | hermes | openclaw | codex").option("--config-path <path>", "Override the runtime's MCP-config path").option("--hooks-path <path>", "Override the runtime's hooks-file path").option("--webhook-url <url>", "Webhook receiver URL (codex/hermes/openclaw)").option("--webhook-secret <secret>", "Webhook HMAC secret (generated if omitted)").option("--uninstall", "Remove the kojee config for the chosen (or recorded) runtime").action(async (opts) => {
+  const { loadPairedConfig: loadPairedConfig2 } = await import("./paired-config-JTFLHMZ2.js");
   if (loadPairedConfig2() === null && !opts.uninstall) {
     console.error("Not paired. Run `kojee-mcp pair <code> --url <broker>` first, then re-run `init`.");
     process.exit(1);
   }
-  const { runInit, runUninstall } = await import("./install-D2HIPOMT.js");
-  if (opts.uninstall) {
-    const report = runUninstall({ configPath: opts.configPath });
-    console.error(formatUninstall(report));
-  } else {
-    const report = runInit({ configPath: opts.configPath });
-    console.error(formatInit(report));
-  }
+  const { runWizard } = await import("./wizard-7KHD5JT4.js");
+  const interactive = process.stdin.isTTY === true && opts.runtime === void 0;
+  const result = await runWizard({
+    ...opts.runtime !== void 0 ? { runtime: opts.runtime } : {},
+    ...opts.uninstall ? { uninstall: true } : {},
+    ...opts.configPath ? { configPath: opts.configPath } : {},
+    ...opts.hooksPath ? { hooksPath: opts.hooksPath } : {},
+    ...opts.webhookUrl ? { webhookUrl: opts.webhookUrl } : {},
+    ...opts.webhookSecret ? { webhookSecret: opts.webhookSecret } : {},
+    interactive,
+    ...interactive ? { promptRuntime: promptRuntimeFromTty } : {}
+  });
+  console.error(result.output);
+  process.exit(result.exitCode);
 });
-function formatInit(report) {
-  const tick = (s) => {
-    if (s === "added") return "\u2713 added";
-    if (s === "already-installed") return "\u21BB already installed";
-    if (s === "preserved-different") return "\u26A0 preserved (existing entry differs \u2014 left untouched)";
-    if (s === "not-found") return "\u2014 not found";
-    return s ?? "\u2014";
-  };
-  const lines = ["Installing kojee for Claude:"];
-  for (const t of report.targets) {
-    const label = t.kind === "cli" ? "CLI" : "Claude.app";
-    lines.push("");
-    lines.push(`  ${t.path} (${label})`);
-    lines.push(`    mcpServers.kojee           ${tick(t.mcpServer)}`);
-    if (t.kind === "cli") {
-      if (t.hooksPath) {
-        lines.push(`  ${t.hooksPath} (hooks)`);
-      }
-      lines.push(`    hooks.Stop                 ${tick(t.stopHook)}`);
-      lines.push(`    hooks.UserPromptSubmit     ${tick(t.userPromptSubmitHook)}`);
-    } else {
-      lines.push(`    (hooks not applicable for Claude.app agent mode)`);
-    }
-  }
-  lines.push("");
-  const desktopWritten = report.targets.some((t) => t.kind === "desktop" && t.mcpServer === "added");
-  if (desktopWritten) {
-    lines.push(
-      "Existing Claude.app agent-mode sessions snapshotted the previous config",
-      "and won't pick up this change automatically. Start a NEW agent-mode",
-      "session (not a resumed one) to use the updated kojee config.",
-      ""
-    );
-  }
-  lines.push("To verify: in any new CC session, run /mcp and confirm `kojee` is listed.");
-  lines.push("                          run /hooks and confirm both Stop and UserPromptSubmit show the kojee entries.");
-  lines.push("To remove: `kojee-mcp init --uninstall`");
-  return lines.join("\n");
-}
-function formatUninstall(report) {
-  const lines = ["Removing kojee from Claude:"];
-  for (const t of report.targets) {
-    const label = t.kind === "cli" ? "CLI" : "Claude.app";
-    lines.push("");
-    lines.push(`  ${t.path} (${label})`);
-    lines.push(`    mcpServers.kojee   ${t.mcpServer ? "\u2713 removed" : "\u2014 not found"}`);
-    if (t.kind === "cli") {
-      if (t.hooksPath) {
-        lines.push(`  ${t.hooksPath} (hooks)`);
-      }
-      lines.push(`    hook entries       ${t.hooks ? "\u2713 removed" : "\u2014 not found"}`);
-    }
+async function promptRuntimeFromTty() {
+  const { RUNTIME_MENU } = await import("./runtimes-CO43XUUK.js");
+  const readline = await import("readline/promises");
+  const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    const menu = RUNTIME_MENU.map((m) => `[${m.index}] ${m.runtime}`).join("  ");
+    const answer = (await rl.question(`Which runtime is this proxy for? ${menu}
+> `)).trim();
+    const byIndex = RUNTIME_MENU.find((m) => String(m.index) === answer);
+    if (byIndex) return byIndex.runtime;
+    return answer;
+  } finally {
+    rl.close();
   }
-  return lines.join("\n");
 }
 program.option("--token <token>", "Gateway token (for token-mode)").option("--url <url>", "Broker base URL (for token-mode; required if --token is passed)").option(
   "--keystore-path <path>",
@@ -202,6 +175,7 @@ program.option("--token <token>", "Gateway token (for token-mode)").option("--ur
   let token = opts.token;
   let url = opts.url;
   let keystorePath = opts.keystorePath;
+  const authMode = token ? "token" : "paired";
   if (token) {
     if (!url) {
       console.error("--url is required when --token is provided");
@@ -210,7 +184,7 @@ program.option("--token <token>", "Gateway token (for token-mode)").option("--ur
     url = url.replace(/\/+$/, "");
     keystorePath ??= deriveKeystorePath(token);
   } else {
-    const { loadPairedConfig: loadPairedConfig2 } = await import("./paired-config-RB4SABOS.js");
+    const { loadPairedConfig: loadPairedConfig2 } = await import("./paired-config-JTFLHMZ2.js");
     const cfg = loadPairedConfig2();
     if (!cfg) {
       console.error(
@@ -223,7 +197,7 @@ program.option("--token <token>", "Gateway token (for token-mode)").option("--ur
     keystorePath ??= defaultPairedKeystorePath();
   }
   try {
-    await startProxy({ token, url, keystorePath });
+    await startProxy({ token, url, keystorePath, authMode });
   } catch (err) {
     console.error("[kojee-mcp] Fatal error:", err);
     process.exit(1);

package/dist/codex-stop-hook-JOTBCS5K.js

@@ -0,0 +1,72 @@
+import {
+  readHookStdin
+} from "./chunk-LSUB6QMP.js";
+import {
+  buildCodexWakeReason
+} from "./chunk-C6GZ2L2W.js";
+
+// src/hooks/codex-stop-hook.ts
+import fs from "fs";
+import os from "os";
+import path from "path";
+var CODEX_PEEK_MS = clampPeekMs(
+  Number.parseInt(process.env["KOJEE_CODEX_PEEK_MS"] ?? "150", 10)
+);
+var MARKER_STALE_MS = 3e4;
+function clampPeekMs(raw) {
+  if (!Number.isFinite(raw) || raw <= 0) return 150;
+  return Math.min(raw, 500);
+}
+function decideCodexStopHook(deps) {
+  if (deps.stopHookActive) return "{}";
+  const peek = deps.peekPending();
+  if (!peek.pending || peek.cursor === null) return "{}";
+  return JSON.stringify({
+    decision: "block",
+    reason: buildCodexWakeReason(peek.cursor)
+  });
+}
+function codexPendingMarkerPath(sessionId) {
+  const safe = (sessionId ?? "no-session").replace(/[^A-Za-z0-9._-]/g, "_");
+  return path.join(os.homedir(), ".kojee", `codex-pending-${safe}`);
+}
+function defaultPeekPending(sessionId) {
+  const markerPath = codexPendingMarkerPath(sessionId);
+  try {
+    const st = fs.statSync(markerPath);
+    const ageMs = Date.now() - st.mtimeMs;
+    if (ageMs > MARKER_STALE_MS) return { pending: false, cursor: null };
+    let cursor = 0;
+    try {
+      const body = fs.readFileSync(markerPath, "utf8").trim().split(/\s+/)[0];
+      const n = Number.parseInt(body ?? "", 10);
+      if (Number.isFinite(n) && n >= 0) cursor = n;
+    } catch {
+    }
+    return { pending: true, cursor };
+  } catch {
+    return { pending: false, cursor: null };
+  }
+}
+async function runCodexStopHook() {
+  const { sessionId, stopHookActive } = await readHookStdin();
+  const out = decideCodexStopHook({
+    stopHookActive,
+    peekPending: () => {
+      try {
+        return defaultPeekPending(sessionId);
+      } catch {
+        return { pending: false, cursor: null };
+      }
+    }
+  });
+  process.stdout.write(out);
+}
+var CODEX_PEEK_BUDGET_MS = CODEX_PEEK_MS;
+export {
+  CODEX_PEEK_BUDGET_MS,
+  codexPendingMarkerPath,
+  decideCodexStopHook,
+  defaultPeekPending,
+  runCodexStopHook
+};

package/dist/{doctor-GILTOH2R.js → doctor-TSHOMT5X.js}

@@ -1,22 +1,23 @@
 import {
-  buildMonitorSpawn,
-  buildReplyRecipe
-} from "./chunk-E26AHU6J.js";
+  loadPairedConfig
+} from "./chunk-YH27B6SW.js";
 import {
   deriveDiscoveryKey,
   findClaudeAncestorPid
 } from "./chunk-BJMASMKX.js";
+import {
+  buildMonitorSpawn,
+  buildReplyRecipe
+} from "./chunk-C6GZ2L2W.js";
 import {
   monitorHeartbeatPath,
   statusLogPath
-} from "./chunk-VLZADEFC.js";
+} from "./chunk-2TUAFAIW.js";
 import {
   discoveryPathForKey,
   readSessionDiscoveryByKey
-} from "./chunk-W6YRLSD4.js";
-import {
-  loadPairedConfig
-} from "./chunk-GBOTBYEP.js";
+} from "./chunk-DO42NPNR.js";
+import "./chunk-BLEGIR35.js";
 
 // src/doctor.ts
 import fs from "fs";
@@ -73,13 +74,20 @@ async function collectDoctorReport(deps = {}) {
   const discoveryKey = deriveDiscoveryKey(projectDir, ccPid);
   const discoveryPath = discoveryPathForKey(discoveryKey);
   const checks = [];
-  const paired = deps.pairedConfigPresent !== void 0 ? deps.pairedConfigPresent : loadPairedConfig() !== null;
-  checks.push({
-    name: "paired config",
-    ok: paired,
-    detail: paired ? "present" : "MISSING \u2014 run `kojee-mcp pair <code> --url <broker>`"
-  });
   const discovery = readDiscovery(discoveryKey);
+  const tokenMode = discovery?.authMode === "token";
+  const paired = deps.pairedConfigPresent !== void 0 ? deps.pairedConfigPresent : loadPairedConfig() !== null;
+  checks.push(
+    tokenMode ? {
+      name: "paired config",
+      ok: true,
+      detail: "n/a (token mode) \u2014 proxy launched with --token; no ~/.kojee/config.json by design"
+    } : {
+      name: "paired config",
+      ok: paired,
+      detail: paired ? "present" : "MISSING \u2014 run `kojee-mcp pair <code> --url <broker>`"
+    }
+  );
   let logPath = null;
   if (!discovery) {
     checks.push({
@@ -210,6 +218,13 @@ function formatDoctorReport(report) {
   return lines.join("\n");
 }
 async function runDoctor() {
+  const { readRecordedRuntime } = await import("./runtime-record-WO4IECM6.js");
+  if (readRecordedRuntime() === "codex") {
+    const { collectCodexDoctorReport, formatCodexDoctorReport } = await import("./doctor-codex-BMI5JOO6.js");
+    const report2 = collectCodexDoctorReport();
+    console.error(formatCodexDoctorReport(report2));
+    return report2.verdict === "broken" ? 1 : 0;
+  }
   const report = await collectDoctorReport();
   console.error(formatDoctorReport(report));
   return report.verdict === "broken" ? 1 : 0;

package/dist/doctor-codex-BMI5JOO6.js

@@ -0,0 +1,130 @@
+import {
+  defaultCodexConfigPath,
+  defaultCodexHooksPath
+} from "./chunk-ZW4SW7LJ.js";
+import "./chunk-SQL56SEB.js";
+import {
+  CODEX_LISTEN_CAP_MS
+} from "./chunk-C6GZ2L2W.js";
+import "./chunk-BLEGIR35.js";
+import {
+  resolveWebhookConfig
+} from "./chunk-F7L25L2J.js";
+
+// src/doctor-codex.ts
+import fs from "fs";
+function parseCodexEnvFromToml(toml) {
+  const env = {};
+  let inEnv = false;
+  for (const line of toml.split("\n")) {
+    const header = line.trim();
+    const isTableHeader = /^\[\[?[^\]]+\]\]?$/.test(header);
+    if (isTableHeader) {
+      inEnv = header === "[mcp_servers.kojee.env]";
+      continue;
+    }
+    if (!inEnv) continue;
+    const eq = line.indexOf("=");
+    if (eq <= 0) continue;
+    const key = line.slice(0, eq).trim();
+    if (!/^[A-Za-z0-9_.-]+$/.test(key)) continue;
+    let value = line.slice(eq + 1).trim();
+    const quote = value[0];
+    if ((quote === '"' || quote === "'") && value.endsWith(quote)) {
+      value = value.slice(1, -1);
+      if (quote === '"') value = value.replace(/\\"/g, '"').replace(/\\\\/g, "\\");
+    }
+    env[key] = value;
+  }
+  return env;
+}
+var WIZARD_RERUN = "re-run `kojee-mcp init --runtime codex`";
+function defaultReadFile(path) {
+  return () => {
+    try {
+      return fs.readFileSync(path, "utf8");
+    } catch {
+      return null;
+    }
+  };
+}
+function collectCodexDoctorReport(deps = {}) {
+  const readConfigToml = deps.readConfigToml ?? defaultReadFile(defaultCodexConfigPath());
+  const readHooksJson = deps.readHooksJson ?? defaultReadFile(defaultCodexHooksPath());
+  const checks = [];
+  const toml = readConfigToml() ?? "";
+  const env = deps.env ?? parseCodexEnvFromToml(toml);
+  const hasKojeeTable = toml.includes("[mcp_servers.kojee]");
+  const hasRuntimeEnv = /KOJEE_RUNTIME\s*=\s*"codex"/.test(toml);
+  const configOk = hasKojeeTable && hasRuntimeEnv;
+  checks.push({
+    name: "~/.codex/config.toml [mcp_servers.kojee]",
+    ok: configOk,
+    detail: configOk ? 'present with env.KOJEE_RUNTIME="codex" (Tier-1 contract)' : `MISSING [mcp_servers.kojee] or env.KOJEE_RUNTIME="codex" \u2014 ${WIZARD_RERUN}`
+  });
+  const hooksRaw = readHooksJson() ?? "{}";
+  let hookPresent = false;
+  try {
+    const hooks = JSON.parse(hooksRaw);
+    hookPresent = !!hooks.hooks?.Stop?.some(
+      (e) => e.hooks?.some((h) => (h.command ?? "").includes("hook --type=codex-stop"))
+    );
+  } catch {
+  }
+  if (!hookPresent && /hook --type=codex-stop/.test(toml)) hookPresent = true;
+  checks.push({
+    name: "Codex Stop hook (codex-stop)",
+    ok: hookPresent,
+    detail: hookPresent ? "present (fast PEEK + model-chosen bounded listen)" : `MISSING in ~/.codex/hooks.json / [[hooks.Stop]] \u2014 ${WIZARD_RERUN}`
+  });
+  const resolution = resolveWebhookConfig(env);
+  if (resolution.enabled && resolution.config) {
+    checks.push({
+      name: "webhook sink",
+      ok: true,
+      detail: `enabled \u2014 ${resolution.config.redactedSummary}`
+    });
+  } else if (resolution.error) {
+    checks.push({
+      name: "webhook sink",
+      ok: false,
+      detail: `${resolution.error} \u2014 ${WIZARD_RERUN} (it generates a secret)`
+    });
+  } else {
+    checks.push({
+      name: "webhook sink",
+      ok: false,
+      detail: `not configured (no KOJEE_WEBHOOK_URL) \u2014 ${WIZARD_RERUN}`
+    });
+  }
+  if (deps.pingReceiver) {
+    const reachable = deps.pingReceiver();
+    checks.push({
+      name: "webhook receiver (optional ping)",
+      ok: reachable ? true : "warn",
+      detail: reachable ? "reachable" : "unreachable \u2014 stand up your receiver at KOJEE_WEBHOOK_URL (owner-built; see doctor note)"
+    });
+  }
+  const verdict = checks.some((c) => c.ok === false) ? "broken" : checks.some((c) => c.ok === "warn") ? "degraded" : "healthy";
+  return { checks, verdict };
+}
+function formatCodexDoctorReport(report) {
+  const mark = (ok) => ok === true ? "\u2713" : ok === "warn" ? "\u26A0" : ok === "unknown" ? "?" : "\u2717";
+  const lines = [];
+  lines.push(`kojee-mcp doctor (codex) \u2014 verdict: ${report.verdict.toUpperCase()}`);
+  lines.push("");
+  lines.push("  Wake mode: webhook-sink + stop-hook peek (Codex has no channel injection).");
+  lines.push(`  Bounded-listen cap: ${CODEX_LISTEN_CAP_MS}ms (model picks listen vs drain vs ignore).`);
+  lines.push("");
+  for (const c of report.checks) {
+    lines.push(`  ${mark(c.ok)} ${c.name}: ${c.detail}`);
+  }
+  lines.push("");
+  lines.push("NOTE: live Codex verification (hook fires, MCP connects, bounded listen) is an owner step.");
+  return lines.join("\n");
+}
+export {
+  collectCodexDoctorReport,
+  formatCodexDoctorReport,
+  parseCodexEnvFromToml
+};

package/dist/{event-log-R6VW6GAF.js → event-log-RSTM4PLL.js}

@@ -5,8 +5,9 @@ import {
   startEventLog,
   statusLogPath,
   sweepStaleEventLogs
-} from "./chunk-VLZADEFC.js";
-import "./chunk-W6YRLSD4.js";
+} from "./chunk-2TUAFAIW.js";
+import "./chunk-DO42NPNR.js";
+import "./chunk-BLEGIR35.js";
 export {
   STATUS_LINE_PREFIX,
   monitorHeartbeatPath,

package/dist/index.d.ts

@@ -2,6 +2,15 @@ interface ProxyConfig {
     token: string;
     url: string;
     keystorePath: string;
+    /**
+     * How credentials were resolved at launch: "token" when `--token` was passed
+     * on the CLI, "paired" when read from ~/.kojee/config.json. The proxy records
+     * this in its session-discovery file so `kojee-mcp doctor` can render the
+     * pairing check honestly on a token-mode box (no config.json by design).
+     * Defaults to "paired" when unset (back-compat with callers predating the
+     * field).
+     */
+    authMode?: "token" | "paired";
 }
 
 declare function startProxy(config: ProxyConfig): Promise<void>;

package/dist/index.js

@@ -1,9 +1,10 @@
 import {
   startProxy
-} from "./chunk-LCFCCWMM.js";
-import "./chunk-QB22PD6T.js";
-import "./chunk-E26AHU6J.js";
+} from "./chunk-YEC7IHIG.js";
 import "./chunk-BJMASMKX.js";
+import "./chunk-C6GZ2L2W.js";
+import "./chunk-WBMX4CHB.js";
+import "./chunk-BLEGIR35.js";
 export {
   startProxy
 };

package/dist/{install-D2HIPOMT.js → install-WBIUVBZW.js}

@@ -1,3 +1,7 @@
+import {
+  secureFile
+} from "./chunk-BLEGIR35.js";
+
 // src/hooks/install.ts
 import fs from "fs";
 import os from "os";
@@ -48,10 +52,7 @@ function writeConfig(p, cfg) {
   const dir = path.dirname(p);
   fs.mkdirSync(dir, { recursive: true });
   fs.writeFileSync(p, JSON.stringify(cfg, null, 2), { mode: 384 });
-  try {
-    fs.chmodSync(p, 384);
-  } catch {
-  }
+  secureFile(p);
 }
 function hasKojeeEntry(arr, command) {
   if (!arr) return false;

package/dist/{paired-config-RB4SABOS.js → paired-config-JTFLHMZ2.js}

@@ -2,7 +2,8 @@ import {
   loadPairedConfig,
   pairedConfigPath,
   savePairedConfig
-} from "./chunk-GBOTBYEP.js";
+} from "./chunk-YH27B6SW.js";
+import "./chunk-BLEGIR35.js";
 export {
   loadPairedConfig,
   pairedConfigPath,

package/dist/runtime-record-WO4IECM6.js

@@ -0,0 +1,14 @@
+import {
+  clearRuntimeRecord,
+  readRecordedRuntime,
+  recordRuntime,
+  runtimeRecordPath
+} from "./chunk-EW72ZNQL.js";
+import "./chunk-SQL56SEB.js";
+import "./chunk-BLEGIR35.js";
+export {
+  clearRuntimeRecord,
+  readRecordedRuntime,
+  recordRuntime,
+  runtimeRecordPath
+};

package/dist/runtimes-CO43XUUK.js

@@ -0,0 +1,12 @@
+import {
+  RUNTIME_MENU,
+  WEBHOOK_RUNTIMES,
+  WIZARD_RUNTIMES,
+  isWizardRuntime
+} from "./chunk-LVL25VLO.js";
+export {
+  RUNTIME_MENU,
+  WEBHOOK_RUNTIMES,
+  WIZARD_RUNTIMES,
+  isWizardRuntime
+};

package/dist/{session-discovery-QE5TTAPS.js → session-discovery-FNMJGFPM.js}

@@ -10,7 +10,8 @@ import {
   sweepStaleDiscovery,
   writeDiscoveryByKey,
   writeSessionDiscovery
-} from "./chunk-W6YRLSD4.js";
+} from "./chunk-DO42NPNR.js";
+import "./chunk-BLEGIR35.js";
 export {
   cleanupDiscoveryByKey,
   cleanupSessionDiscovery,

package/dist/{stop-hook-VLQS6QPR.js → stop-hook-SEPWWETV.js}

@@ -1,20 +1,21 @@
 import {
   readHookStdin
 } from "./chunk-LSUB6QMP.js";
-import {
-  buildMonitorNudge
-} from "./chunk-E26AHU6J.js";
 import {
   deriveDiscoveryKey,
   findClaudeAncestorPid
 } from "./chunk-BJMASMKX.js";
+import {
+  buildMonitorNudge
+} from "./chunk-C6GZ2L2W.js";
 import {
   monitorHeartbeatPath,
   nudgeSentinelPath
-} from "./chunk-VLZADEFC.js";
+} from "./chunk-2TUAFAIW.js";
 import {
   readSessionDiscoveryByKey
-} from "./chunk-W6YRLSD4.js";
+} from "./chunk-DO42NPNR.js";
+import "./chunk-BLEGIR35.js";
 
 // src/hooks/stop-hook.ts
 import fs from "fs";

package/dist/{tail-stream-UZ42UIWO.js → tail-stream-BYKO4DW6.js}

@@ -1,12 +1,13 @@
 import {
   createAdaptiveWatchdog
-} from "./chunk-QB22PD6T.js";
+} from "./chunk-WBMX4CHB.js";
 import {
   STATUS_LINE_PREFIX,
   monitorHeartbeatPath,
   statusLogPath
-} from "./chunk-VLZADEFC.js";
-import "./chunk-W6YRLSD4.js";
+} from "./chunk-2TUAFAIW.js";
+import "./chunk-DO42NPNR.js";
+import "./chunk-BLEGIR35.js";
 
 // src/tail-stream.ts
 import fs from "fs";

package/dist/{user-prompt-submit-hook-C42DPDBO.js → user-prompt-submit-hook-ARPEO6FF.js}

@@ -7,7 +7,8 @@ import {
 } from "./chunk-BJMASMKX.js";
 import {
   readSessionDiscoveryByKey
-} from "./chunk-W6YRLSD4.js";
+} from "./chunk-DO42NPNR.js";
+import "./chunk-BLEGIR35.js";
 
 // src/hooks/user-prompt-submit-hook.ts
 async function runUserPromptSubmitHook() {

package/dist/webhook-config-5TLLX7RA.js

@@ -0,0 +1,10 @@
+import {
+  WEBHOOK_DEFAULT_MAX_RETRIES,
+  WEBHOOK_DEFAULT_TIMEOUT_MS,
+  resolveWebhookConfig
+} from "./chunk-F7L25L2J.js";
+export {
+  WEBHOOK_DEFAULT_MAX_RETRIES,
+  WEBHOOK_DEFAULT_TIMEOUT_MS,
+  resolveWebhookConfig
+};