kojee-mcp 0.5.11 → 0.5.13

package/dist/chunk-D42PZX2I.js

@@ -1,784 +0,0 @@
-import {
-  buildCatchUpNote,
-  buildMonitorSpawn,
-  buildReplyRecipe
-} from "./chunk-X672ZN7V.js";
-import {
-  deriveDiscoveryKey,
-  findClaudeAncestorPid
-} from "./chunk-BJMASMKX.js";
-import {
-  AuthModule
-} from "./chunk-JXMVZEQ7.js";
-import {
-  GatewayClient
-} from "./chunk-HSR3GXCL.js";
-import {
-  startEventStream
-} from "./chunk-MKDMAAMN.js";
-import {
-  secureDir,
-  secureFile
-} from "./chunk-BLEGIR35.js";
-import {
-  parseTandemsConfig
-} from "./chunk-YKW54DKF.js";
-import {
-  translateToolCallResult
-} from "./chunk-LDZXU3DW.js";
-
-// src/index.ts
-import fs4 from "fs";
-import os2 from "os";
-import path3 from "path";
-
-// src/tool-registry.ts
-var ToolRegistry = class {
-  constructor(gateway) {
-    this.gateway = gateway;
-  }
-  gateway;
-  /** Flat map: tool name → full tool definition */
-  tools = /* @__PURE__ */ new Map();
-  /**
-   * Fetch all tools with full schemas from the gateway in a single RPC call.
-   */
-  async discoverTools() {
-    console.error("[tools] Fetching tools with full schemas from gateway...");
-    const result = await this.gateway.sendRpc("tools/list", {
-      include_schema: true
-    });
-    const maybeError = result;
-    if (maybeError.isError) {
-      const msg = maybeError.content?.[0]?.text ?? "unknown error";
-      throw new Error(`Gateway rejected tools/list: ${msg}`);
-    }
-    const toolList = result?.tools;
-    if (!toolList || !Array.isArray(toolList)) {
-      console.error("[tools] No tools returned from gateway");
-      return;
-    }
-    for (const tool of toolList) {
-      if (this.tools.has(tool.name)) {
-        console.error(`[tools] Warning: duplicate tool name "${tool.name}" \u2014 overwriting`);
-      }
-      this.tools.set(tool.name, tool);
-    }
-    console.error(`[tools] Registered ${this.tools.size} tools from gateway`);
-  }
-  /**
-   * Return all registered tools for the MCP ListTools response.
-   */
-  getAllTools() {
-    return Array.from(this.tools.values());
-  }
-  /**
-   * Call a tool through the gateway.
-   */
-  async callTool(name, args) {
-    if (!this.tools.has(name)) {
-      const available = Array.from(this.tools.keys()).slice(0, 10).join(", ");
-      return {
-        content: [
-          {
-            type: "text",
-            text: `Tool '${name}' not found. Some available tools: ${available}${this.tools.size > 10 ? ", ..." : ""}`
-          }
-        ],
-        isError: true
-      };
-    }
-    return this.gateway.sendRpc("tools/call", {
-      name,
-      arguments: args
-    });
-  }
-  /** Total number of registered tools. */
-  get toolCount() {
-    return this.tools.size;
-  }
-};
-
-// src/server.ts
-import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import {
-  ListToolsRequestSchema,
-  CallToolRequestSchema
-} from "@modelcontextprotocol/sdk/types.js";
-
-// src/version.ts
-import fs from "fs";
-import path from "path";
-import { fileURLToPath } from "url";
-var FALLBACK_VERSION = "0.0.0-unknown";
-function resolveVersion() {
-  try {
-    const here = path.dirname(fileURLToPath(import.meta.url));
-    const parsed = JSON.parse(
-      fs.readFileSync(path.join(here, "..", "package.json"), "utf8")
-    );
-    return typeof parsed?.version === "string" && parsed.version ? parsed.version : FALLBACK_VERSION;
-  } catch (err) {
-    process.stderr.write(
-      `kojee-mcp: could not resolve version from package.json, falling back to ${FALLBACK_VERSION}: ${String(err)}
-`
-    );
-    return FALLBACK_VERSION;
-  }
-}
-var VERSION = resolveVersion();
-
-// src/server.ts
-function buildChannelInstructions(_tandemMembershipCount, eventLogPath) {
-  const intro = `Tandem events are delivered to you in three ways depending on which is active in your Claude Code session:
-
-(1) If channel notifications are available, you'll see them as \`<channel source="kojee-mcp" ...>\` tags in your context. Each tag carries tandem_id, message_id, from_principal, kind, severity. To respond: ${buildReplyRecipe()}.
-
-`;
-  const monitorSection = `(2) For sustained wake-from-idle WITHOUT channel notifications, the proxy writes one event line per Tandem message to ${eventLogPath}. At the start of every session, spawn ONE Monitor task: ${buildMonitorSpawn(eventLogPath)}. Each appended line will arrive as a separate wake notification, and carries msg=<id> and cursor=<n>. To respond: ${buildReplyRecipe()}. ${buildCatchUpNote()} (\`kojee-mcp tail\` is a portable line-streamer shipped with this proxy \u2014 works on macOS, Linux, and Windows. It follows BOTH the messages log above and a status sibling; status/heartbeat telemetry never wakes you \u2014 only real messages do.)
-
-`;
-  const listenSection = "(3) If you want to BLOCK until any single reply lands (rather than receive a stream of events), call tandem_listen(tandem_id, since=cursor, timeout_ms=N) instead.";
-  const advice = "\n\nPrefer (2) at session start \u2014 it's the default no-allowlist wake mechanism. (1) supplements it when channels are enabled; (3) is for one-shot blocking waits.";
-  return intro + monitorSection + listenSection + advice;
-}
-function tandemIdArg(args) {
-  return typeof args["tandem_id"] === "string" ? args["tandem_id"] : null;
-}
-async function executeToolCall(registry, name, args, hooks) {
-  const rawResult = await registry.callTool(name, args);
-  const result = translateToolCallResult(rawResult);
-  if (!result.isError) {
-    if (name === "tandem_join") {
-      try {
-        hooks?.onTandemJoin?.(tandemIdArg(args));
-      } catch (err) {
-        console.error("[mcp] onTandemJoin hook failed:", err?.message ?? String(err));
-      }
-    } else if (name === "tandem_leave") {
-      try {
-        hooks?.onTandemLeave?.(tandemIdArg(args));
-      } catch (err) {
-        console.error("[mcp] onTandemLeave hook failed:", err?.message ?? String(err));
-      }
-    }
-  }
-  return result;
-}
-function createMcpServer(registry, adapter, tandemMembershipCount = -1, eventLogPath, hooks) {
-  const capabilities = { tools: {} };
-  if (adapter.supportsChannels) {
-    capabilities.experimental = { "claude/channel": {} };
-  }
-  const server = new Server(
-    { name: "kojee-mcp", version: VERSION },
-    {
-      capabilities,
-      ...adapter.supportsChannels ? { instructions: buildChannelInstructions(tandemMembershipCount, eventLogPath ?? "") } : {}
-    }
-  );
-  server.setRequestHandler(ListToolsRequestSchema, async () => {
-    const tools = registry.getAllTools().map((t) => ({
-      name: t.name,
-      description: t.description,
-      inputSchema: t.inputSchema
-    }));
-    return { tools };
-  });
-  server.setRequestHandler(CallToolRequestSchema, async (request) => {
-    const { name, arguments: args } = request.params;
-    const result = await executeToolCall(registry, name, args ?? {}, hooks);
-    return { content: result.content, isError: result.isError };
-  });
-  return server;
-}
-async function startMcpServer(server) {
-  const transport = new StdioServerTransport();
-  await server.connect(transport);
-  console.error("[mcp] Server started on stdio transport");
-}
-
-// src/runtime/detect.ts
-import psList from "ps-list";
-async function detectRuntime(env = process.env) {
-  if (env["KOJEE_RUNTIME"] === "claude-code") return "claude-code";
-  if (env["KOJEE_RUNTIME"] === "codex") return "codex";
-  if (env["CLAUDE_CODE_SESSION_ID"]) return "claude-code";
-  const ancestor = await detectRuntimeFromAncestry();
-  if (ancestor) return ancestor;
-  return "unknown";
-}
-async function detectRuntimeFromAncestry() {
-  try {
-    const processes = await psList();
-    const byPid = new Map(processes.map((p) => [p.pid, p]));
-    let pid = process.ppid;
-    for (let depth = 0; depth < 5 && pid && pid > 1; depth++) {
-      const row = byPid.get(pid);
-      if (!row) return null;
-      const haystack = `${row.name} ${row.cmd ?? ""}`;
-      if (/(^|\/|\\)claude(\.app|\.exe)?(\/|$|\s|\\)/i.test(haystack) || /Claude Helper/i.test(haystack)) {
-        return "claude-code";
-      }
-      if (/(^|\/|\\)codex(\.exe)?(\/|$|\s|\\)/i.test(haystack)) {
-        return "codex";
-      }
-      pid = row.ppid;
-    }
-  } catch {
-  }
-  return null;
-}
-
-// src/adapters/claude-code.ts
-function computeSeverity(event) {
-  if (event.type === "state_change") return "high";
-  if (event.mentions && event.mentions.length > 0) {
-    return "high";
-  }
-  return "normal";
-}
-function formatBody(event) {
-  if (event.type === "state_change") {
-    return `[Tandem: ${event.tandem_id}] ${event.from.displayname}: ${event.content.body}`;
-  }
-  return [
-    `[Tandem: ${event.tandem_id}] ${event.from.displayname} (${event.from.principal}) \u2014 ${event.kind}:`,
-    event.content.body,
-    "",
-    `> ${buildReplyRecipe({ tandem_id: event.tandem_id, message_id: event.id })}`
-  ].join("\n");
-}
-var claudeCodeAdapter = {
-  runtime: "claude-code",
-  supportsChannels: true,
-  formatTandemEvent(event) {
-    const meta = {
-      tandem_id: event.tandem_id,
-      message_id: event.id,
-      cursor: String(event.cursor),
-      kind: event.kind,
-      from_principal: event.from.principal,
-      from_display: event.from.displayname,
-      severity: computeSeverity(event)
-    };
-    if (event.wake_reason) meta.wake_reason = event.wake_reason;
-    return { content: formatBody(event), meta };
-  }
-};
-
-// src/adapters/codex.ts
-var codexAdapter = {
-  runtime: "codex",
-  supportsChannels: false,
-  // Codex has NO Claude-style channel injection
-  formatTandemEvent() {
-    throw new Error(
-      "codexAdapter.formatTandemEvent() is unreachable \u2014 Codex has no channel injection; server.ts gates this on supportsChannels. Codex receives events via the webhook sink + a model-chosen bounded tandem_listen."
-    );
-  }
-};
-
-// src/adapters/unknown.ts
-var unknownAdapter = {
-  runtime: "unknown",
-  supportsChannels: false,
-  formatTandemEvent() {
-    throw new Error(
-      "unknownAdapter.formatTandemEvent() is unreachable \u2014 caller should gate on supportsChannels"
-    );
-  }
-};
-
-// src/runtime/cc-session-id.ts
-import fs2 from "fs";
-import { execFileSync } from "child_process";
-import { createHash } from "crypto";
-var CC_SESSION_ENV = "CLAUDE_CODE_SESSION_ID";
-function extractCcSessionId(raw) {
-  if (raw.includes("\0")) {
-    for (const entry of raw.split("\0")) {
-      if (entry.startsWith(`${CC_SESSION_ENV}=`)) {
-        const v = entry.slice(CC_SESSION_ENV.length + 1);
-        return v.length > 0 ? v : null;
-      }
-    }
-    return null;
-  }
-  const re = new RegExp(`(?:^|\\s)${CC_SESSION_ENV}=([^\\s]+)`, "g");
-  let last = null;
-  let m;
-  while ((m = re.exec(raw)) !== null) last = m[1];
-  return last;
-}
-function defaultReadProcessEnvRaw(pid, platform) {
-  try {
-    if (platform === "linux") {
-      return fs2.readFileSync(`/proc/${pid}/environ`, "utf8");
-    }
-    if (platform === "darwin") {
-      return execFileSync("ps", ["eww", "-p", String(pid), "-o", "command="], {
-        encoding: "utf8",
-        timeout: 2e3
-      });
-    }
-  } catch {
-    return null;
-  }
-  return null;
-}
-function sanitizeKey(value) {
-  return value.replace(/[^A-Za-z0-9_-]/g, "");
-}
-function resolveInstanceKey(deps = {}) {
-  const env = deps.env ?? process.env;
-  const platform = deps.platform ?? process.platform;
-  const ccPid = deps.ccPid ?? null;
-  if (ccPid !== null) {
-    const reader = deps.readProcessEnvRaw ?? defaultReadProcessEnvRaw;
-    const raw = reader(ccPid, platform);
-    if (raw) {
-      const sid = sanitizeKey(extractCcSessionId(raw) ?? "");
-      if (sid) return sid;
-    }
-  }
-  const explicit = sanitizeKey((env.KOJEE_INSTANCE ?? "").trim());
-  if (explicit) return `inst-${explicit}`;
-  const base = deps.projectDir ?? env.CLAUDE_PROJECT_DIR ?? deps.cwd ?? process.cwd() ?? "";
-  const hash = createHash("sha256").update(base).digest("hex").slice(0, 12);
-  return `wd-${hash}`;
-}
-
-// src/tandem/room-memory.ts
-import fs3 from "fs";
-import os from "os";
-import path2 from "path";
-function defaultKojeeDir() {
-  return path2.join(os.homedir(), ".kojee");
-}
-function seatedRoomsPath(key, dir = defaultKojeeDir()) {
-  return path2.join(dir, `seated-rooms-cc-${key}.json`);
-}
-function readSeatedRooms(key, dir = defaultKojeeDir()) {
-  let raw;
-  try {
-    raw = fs3.readFileSync(seatedRoomsPath(key, dir), "utf8");
-  } catch {
-    return [];
-  }
-  try {
-    const parsed = JSON.parse(raw);
-    return Array.isArray(parsed.rooms) ? parsed.rooms.filter((r) => typeof r === "string") : [];
-  } catch {
-    return [];
-  }
-}
-function hasSeatedRoomsFile(key, dir = defaultKojeeDir()) {
-  return fs3.existsSync(seatedRoomsPath(key, dir));
-}
-function seedSeatedRooms(key, rooms, dir = defaultKojeeDir()) {
-  writeSeatedRooms(key, [...new Set(rooms)], dir);
-}
-function writeSeatedRooms(key, rooms, dir) {
-  fs3.mkdirSync(dir, { recursive: true, mode: 448 });
-  secureDir(dir);
-  const filePath = seatedRoomsPath(key, dir);
-  const body = { schema: 1, rooms, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
-  fs3.writeFileSync(filePath, JSON.stringify(body, null, 2), { mode: 384 });
-  secureFile(filePath);
-}
-function addSeatedRoom(key, tandemId, dir = defaultKojeeDir()) {
-  const rooms = readSeatedRooms(key, dir);
-  if (rooms.includes(tandemId)) return;
-  writeSeatedRooms(key, [...rooms, tandemId], dir);
-}
-function removeSeatedRoom(key, tandemId, dir = defaultKojeeDir()) {
-  const rooms = readSeatedRooms(key, dir);
-  if (!rooms.includes(tandemId)) return;
-  writeSeatedRooms(key, rooms.filter((r) => r !== tandemId), dir);
-}
-
-// src/index.ts
-var DEFAULT_KEYSTORE_PATH = path3.join(os2.homedir(), ".kojee", "keypair.json");
-function isDPoPEnrollmentError(err) {
-  const msg = String(err?.message ?? err ?? "").toLowerCase();
-  if (msg.includes("invalid or expired") && msg.includes("token")) return false;
-  if (msg.includes("generate a new")) return false;
-  return msg.includes("401") || msg.includes("authentication failed") || msg.includes("dpop") || msg.includes("key enrollment") || msg.includes("kid");
-}
-async function selectAdapter() {
-  const runtime = await detectRuntime();
-  if (runtime === "claude-code") return claudeCodeAdapter;
-  if (runtime === "codex") return codexAdapter;
-  return unknownAdapter;
-}
-async function listTandemIds(gateway) {
-  const result = await gateway.sendRpc("tools/call", { name: "tandem_list", arguments: {} });
-  const maybeErr = result;
-  if (maybeErr.isError) return null;
-  const text = maybeErr.content?.[0]?.text;
-  try {
-    const parsed = text ? JSON.parse(text) : {};
-    const list = Array.isArray(parsed.tandems) ? parsed.tandems : Array.isArray(parsed) ? parsed : null;
-    if (!Array.isArray(list)) return [];
-    return list.map((t) => {
-      if (typeof t === "string") return t;
-      const obj = t;
-      if (obj?.my_membership?.is_member !== true) return void 0;
-      return obj?.tandem_id ?? obj?.id;
-    }).filter((id) => typeof id === "string" && id.length > 0);
-  } catch {
-    return null;
-  }
-}
-function needsWebhookEventStream() {
-  return (process.env["KOJEE_WEBHOOK_URL"] ?? "").trim().length > 0;
-}
-async function startProxy(config) {
-  const keystorePath = config.keystorePath || DEFAULT_KEYSTORE_PATH;
-  const adapter = await selectAdapter();
-  console.error(`[kojee-mcp] Starting proxy for ${config.url} (runtime=${adapter.runtime})`);
-  const { registry, gateway } = await enrollAndDiscover(config, keystorePath);
-  console.error(
-    `[kojee-mcp] Ready \u2014 ${registry.toolCount} tools available from ${config.url}`
-  );
-  const ccPid = await findClaudeAncestorPid();
-  const instanceKey = resolveInstanceKey({ ccPid });
-  const roomMemory = {
-    hasMemory: () => hasSeatedRoomsFile(instanceKey),
-    read: () => readSeatedRooms(instanceKey),
-    seed: (rooms) => seedSeatedRooms(instanceKey, rooms)
-  };
-  const recordRooms = parseTandemsConfig(process.env["KOJEE_TANDEMS"]).mode === "auto-local";
-  if (recordRooms && instanceKey.startsWith("wd-")) {
-    console.error(
-      "[kojee-mcp] #28: no Claude Code session id available \u2014 room-memory keyed on project-dir hash; concurrent windows in the same dir will share it. Set KOJEE_INSTANCE=<unique-per-window> to keep them session-faithful."
-    );
-  }
-  let activeStreamHandle = null;
-  const { createJoinReconnectScheduler } = await import("./reconnect-scheduler-ARV6JIWK.js");
-  const joinReconnect = createJoinReconnectScheduler({
-    // BOOT-RACE (Bug B): report whether the stream handle was actually ready.
-    // `false` ⇒ activeStreamHandle is still null (tandem_join fired before the
-    // stream was set up) → the scheduler queues the reconnect and flushes it on
-    // notifyReady() once the handle is assigned (see below), instead of silently
-    // dropping it as the old `activeStreamHandle?.reconnect()` no-op did.
-    reconnect: () => {
-      if (!activeStreamHandle) return false;
-      activeStreamHandle.reconnect();
-      return true;
-    }
-  });
-  const onTandemJoin = (tandemId) => {
-    joinReconnect.requestReconnect();
-    if (recordRooms && tandemId) addSeatedRoom(instanceKey, tandemId);
-  };
-  const onTandemLeave = (tandemId) => {
-    if (recordRooms && tandemId) removeSeatedRoom(instanceKey, tandemId);
-  };
-  const teardownSteps = [];
-  let shuttingDown = false;
-  function shutdown(reason) {
-    if (shuttingDown) return;
-    shuttingDown = true;
-    activeStreamHandle?.();
-    for (const step of teardownSteps) {
-      try {
-        const maybe = step();
-        if (maybe && typeof maybe.catch === "function") {
-          maybe.catch((err) => {
-            console.error("[kojee-mcp] async shutdown step failed:", err?.message ?? err);
-          });
-        }
-      } catch (err) {
-        console.error("[kojee-mcp] shutdown step failed:", err?.message ?? err);
-      }
-    }
-    console.error(`[kojee-mcp] shutting down (${reason}), exiting`);
-    process.exit(0);
-  }
-  const { ensureJoinTandems } = await import("./ensure-join-5Y5IJ7HN.js");
-  await ensureJoinTandems({
-    gateway,
-    env: process.env["KOJEE_TANDEMS"],
-    listTandems: () => listTandemIds(gateway),
-    roomMemory,
-    onJoined: () => joinReconnect.requestReconnect()
-  });
-  let tandemMembershipCount = -1;
-  try {
-    const bootIds = await listTandemIds(gateway);
-    tandemMembershipCount = bootIds === null ? -1 : bootIds.length;
-  } catch (err) {
-    console.error("[kojee-mcp] tandem_list probe failed:", err.message);
-  }
-  console.error(`[kojee-mcp] Tandem memberships: ${tandemMembershipCount === -1 ? "unknown" : tandemMembershipCount}`);
-  let server;
-  if (adapter.supportsChannels) {
-    const { EventQueue } = await import("./event-queue-5YVJFR3E.js");
-    const { startHookServer } = await import("./hook-server-37E2LUKJ.js");
-    const {
-      writeDiscoveryByKey,
-      cleanupDiscoveryByKey,
-      sweepStaleDiscovery
-    } = await import("./session-discovery-FNMJGFPM.js");
-    const { startEventLog, sweepStaleEventLogs } = await import("./event-log-B27VVEMK.js");
-    const { resubscribeMemberships } = await import("./resubscribe-G5OGDZJD.js");
-    const { resolveWebhookConfig } = await import("./webhook-config-O4WMQ532.js");
-    const { createWebhookSink } = await import("./webhook-sink-NWGCUDGY.js");
-    sweepStaleDiscovery();
-    sweepStaleEventLogs();
-    const projectDir = process.env["CLAUDE_PROJECT_DIR"];
-    const discoveryKey = deriveDiscoveryKey(projectDir, ccPid);
-    const eventLog = startEventLog({ key: discoveryKey });
-    const webhookResolution = resolveWebhookConfig();
-    if (webhookResolution.error) {
-      console.error(`[kojee-mcp] webhook sink ERROR: ${webhookResolution.error}`);
-      void eventLog.appendStatus(`status=webhook error="${webhookResolution.error}"`).catch(() => {
-      });
-    }
-    if (webhookResolution.warning) {
-      console.error(`[kojee-mcp] webhook sink WARNING: ${webhookResolution.warning}`);
-      void eventLog.appendStatus(`status=webhook warning="${webhookResolution.warning}"`).catch(() => {
-      });
-    }
-    const webhookSink = webhookResolution.enabled && webhookResolution.config ? createWebhookSink(webhookResolution.config, {
-      // Route delivery/failure observability to the STATUS sink.
-      log: (line) => {
-        void eventLog.appendStatus(`status=webhook ${line}`).catch(() => {
-        });
-      }
-    }) : null;
-    if (webhookSink) {
-      console.error(`[kojee-mcp] webhook sink ENABLED (${webhookSink.configSummary()})`);
-      void eventLog.appendStatus(`status=webhook enabled ${webhookSink.configSummary()}`).catch(() => {
-      });
-    }
-    server = createMcpServer(registry, adapter, tandemMembershipCount, eventLog.path, {
-      onTandemJoin,
-      onTandemLeave
-    });
-    const { issueControlToken, controlTokenPath } = await import("./control-token-4BUCTYQB.js");
-    let controlToken = null;
-    try {
-      controlToken = issueControlToken();
-    } catch (err) {
-      console.error(
-        "[kojee-mcp] control token write failed \u2014 POST /send disabled; GET /poll and /status left UNGATED (degrade open):",
-        err.message
-      );
-    }
-    const queue = new EventQueue();
-    let streamHandle = null;
-    const hookServer = await startHookServer({
-      port: 0,
-      queue,
-      adapter,
-      // 0.5.4 hardening: the same bearer gates POST /send AND the data-bearing
-      // reads (GET /poll, GET /status). When token issuance failed both stay
-      // available-but-degraded: /send answers 503, the reads stay open.
-      ...controlToken !== null ? { controlToken, send: { gateway, authToken: controlToken } } : {},
-      getStreamState: () => streamHandle ? streamHandle.getState() : {
-        connected: false,
-        connectedSince: null,
-        lastEventAt: null,
-        lastHeartbeatAt: null,
-        cursors: {},
-        reconnectCount: 0,
-        // Adaptive: unknown until the watchdog observes ≥2 heartbeats.
-        staleAfterMs: null
-      }
-    });
-    writeDiscoveryByKey(discoveryKey, {
-      schema: 2,
-      discoveryKey,
-      ccPid,
-      projectDir: projectDir ?? null,
-      proxyPid: process.pid,
-      // Legacy `pid` mirrors `proxyPid` so the existing event-log sweep
-      // (which reads `data.pid`) still considers this entry live.
-      pid: process.pid,
-      port: hookServer.port,
-      startedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      brokerUrl: config.url,
-      eventLogPath: eventLog.path,
-      // Advertise where the POST /send bearer lives so local consumers
-      // (native gateway plugins) can find it without guessing ~/.kojee.
-      ...controlToken !== null ? { controlTokenPath: controlTokenPath() } : {},
-      // Stamp the auth mode so `kojee-mcp doctor` renders the pairing check
-      // honestly: a token-mode box has no ~/.kojee/config.json by design and
-      // must not hard-fail on "paired config: MISSING". Defaults to "paired"
-      // for back-compat with callers that don't set it.
-      authMode: config.authMode ?? "paired"
-    });
-    const cleanupDiscoveryFile = () => cleanupDiscoveryByKey(discoveryKey);
-    process.on("exit", () => {
-      cleanupDiscoveryFile();
-      eventLog.cleanup();
-    });
-    teardownSteps.push(() => {
-      void webhookSink?.stop();
-    });
-    teardownSteps.push(() => cleanupDiscoveryFile());
-    teardownSteps.push(() => eventLog.cleanup());
-    teardownSteps.push(() => hookServer.stop());
-    streamHandle = await startEventStream({
-      brokerUrl: config.url,
-      token: config.token,
-      gateway,
-      adapter,
-      server,
-      queue,
-      eventLog,
-      // Generic webhook sink (null unless KOJEE_WEBHOOK_URL + _SECRET are set).
-      // Wired LAST in the fan-out, fire-and-forget — can't delay a wake.
-      ...webhookSink ? { webhookSink } : {},
-      // Resubscribe-on-start (P0 #2): touch all memberships + write a
-      // `status=subscribed n=<count>` line on every (re)connect, so a backend
-      // restart / scope reset self-heals and the log is never ambiguously
-      // empty. See resubscribe.ts for the unverified-touch caveat.
-      //
-      // MINOR 6: `listTandems` re-fetches the membership list per reconnect (a
-      // mid-session join is touched next reconnect, not boot-frozen), each
-      // touch is timeout-bounded + run with bounded concurrency, and the whole
-      // routine runs concurrently with consumeSse (never blocks first-event
-      // delivery). `listTandemIds` may return null (unknown) → treat as empty.
-      // MINOR E: a shared debounce cursor damps a connect/drop flap storm — a
-      // resubscribe within 30s of the last successful one is skipped.
-      onConnected: /* @__PURE__ */ (() => {
-        const debounceState = { lastRunAt: 0 };
-        return async () => {
-          await resubscribeMemberships({
-            gateway,
-            eventLog,
-            listTandems: async () => await listTandemIds(gateway) ?? [],
-            debounceState
-          });
-        };
-      })()
-    });
-    activeStreamHandle = streamHandle;
-    joinReconnect.notifyReady();
-  } else if (needsWebhookEventStream()) {
-    const { startEventLog, sweepStaleEventLogs } = await import("./event-log-B27VVEMK.js");
-    const { resolveWebhookConfig } = await import("./webhook-config-O4WMQ532.js");
-    const { createWebhookSink } = await import("./webhook-sink-NWGCUDGY.js");
-    const { resubscribeMemberships } = await import("./resubscribe-G5OGDZJD.js");
-    sweepStaleEventLogs();
-    const projectDir = process.env["CLAUDE_PROJECT_DIR"];
-    const discoveryKey = deriveDiscoveryKey(projectDir, ccPid);
-    const eventLog = startEventLog({ key: discoveryKey });
-    const webhookResolution = resolveWebhookConfig();
-    if (webhookResolution.error) {
-      console.error(`[kojee-mcp] webhook sink ERROR: ${webhookResolution.error}`);
-      void eventLog.appendStatus(`status=webhook error="${webhookResolution.error}"`).catch(() => {
-      });
-    }
-    if (webhookResolution.warning) {
-      console.error(`[kojee-mcp] webhook sink WARNING: ${webhookResolution.warning}`);
-      void eventLog.appendStatus(`status=webhook warning="${webhookResolution.warning}"`).catch(() => {
-      });
-    }
-    const webhookSink = webhookResolution.enabled && webhookResolution.config ? createWebhookSink(webhookResolution.config, {
-      log: (line) => {
-        void eventLog.appendStatus(`status=webhook ${line}`).catch(() => {
-        });
-      }
-    }) : null;
-    if (webhookSink) {
-      console.error(`[kojee-mcp] webhook sink ENABLED (${webhookSink.configSummary()})`);
-      void eventLog.appendStatus(`status=webhook enabled ${webhookSink.configSummary()}`).catch(() => {
-      });
-    }
-    server = createMcpServer(registry, adapter, tandemMembershipCount, void 0, {
-      onTandemJoin,
-      onTandemLeave
-    });
-    process.on("exit", () => eventLog.cleanup());
-    teardownSteps.push(() => {
-      void webhookSink?.stop();
-    });
-    teardownSteps.push(() => eventLog.cleanup());
-    const streamHandle = await startEventStream({
-      brokerUrl: config.url,
-      token: config.token,
-      gateway,
-      adapter,
-      server,
-      eventLog,
-      ...webhookSink ? { webhookSink } : {},
-      onConnected: /* @__PURE__ */ (() => {
-        const debounceState = { lastRunAt: 0 };
-        return async () => {
-          await resubscribeMemberships({
-            gateway,
-            eventLog,
-            listTandems: async () => await listTandemIds(gateway) ?? [],
-            debounceState
-          });
-        };
-      })()
-    });
-    activeStreamHandle = streamHandle;
-    joinReconnect.notifyReady();
-  } else {
-    server = createMcpServer(registry, adapter, tandemMembershipCount);
-  }
-  process.stdin.on("end", () => shutdown("stdin end"));
-  process.stdin.on("close", () => shutdown("stdin close"));
-  process.on("SIGHUP", () => shutdown("SIGHUP"));
-  process.on("SIGINT", () => shutdown("SIGINT"));
-  process.on("SIGTERM", () => shutdown("SIGTERM"));
-  if (ccPid !== null) {
-    const { createParentWatchdog } = await import("./parent-watchdog-RZLHYP7T.js");
-    const watchdog = createParentWatchdog({
-      ccPid,
-      onParentGone: () => shutdown("parent (Claude Code) gone")
-    });
-    watchdog.start();
-    teardownSteps.push(() => watchdog.stop());
-  } else {
-    console.error(
-      "[kojee-mcp] no Claude Code ancestor found \u2014 parent-liveness watchdog NOT armed (stdin/signal handlers still cover clean exits)"
-    );
-  }
-  await startMcpServer(server);
-}
-async function enrollAndDiscover(config, keystorePath, isRetry = false) {
-  const auth = new AuthModule(config.token, config.url, keystorePath);
-  const keyPair = await auth.ensureEnrolled();
-  const sessionId = GatewayClient.deriveSessionId(config.token);
-  console.error(`[kojee-mcp] Session: ${sessionId}`);
-  const gateway = new GatewayClient(
-    config.url,
-    config.token,
-    keyPair.privateKey,
-    keyPair.kid,
-    sessionId
-  );
-  const registry = new ToolRegistry(gateway);
-  try {
-    await registry.discoverTools();
-    return { registry, gateway };
-  } catch (err) {
-    if (isRetry || !isDPoPEnrollmentError(err)) {
-      throw err;
-    }
-    console.error(
-      "[kojee-mcp] Auth failed, attempting recovery with fresh enrollment..."
-    );
-    try {
-      if (fs4.existsSync(keystorePath)) fs4.unlinkSync(keystorePath);
-    } catch (unlinkErr) {
-      console.error("[kojee-mcp] Could not remove stale keystore:", unlinkErr);
-    }
-    return enrollAndDiscover(config, keystorePath, true);
-  }
-}
-
-export {
-  VERSION,
-  listTandemIds,
-  startProxy
-};