kojee-mcp 0.5.14 → 0.5.16

package/dist/{chunk-IMOEZ4NJ.js → chunk-34IRTWP6.js}

@@ -120,22 +120,10 @@ var GatewayClient = class {
     return result ?? { content: [{ type: "text", text: "No result" }] };
   }
   async sendHttpRequest(rpcRequest, signal) {
-    const proof = await createDPoPProof(
-      this.privateKey,
-      this.kid,
-      "POST",
-      this.endpoint,
-      this.currentNonce,
-      this.token
-    );
+    const headers = await this.buildAuthHeaders("POST", this.endpoint);
     return fetch(this.endpoint, {
       method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        Authorization: `DPoP ${this.token}`,
-        DPoP: proof,
-        "Mcp-Session-Id": getSessionId()
-      },
+      headers,
       body: JSON.stringify(rpcRequest),
       // ROUND-3 MAJOR A: the caller's AbortSignal rides HERE (a real fetch
       // option), never inside the JSON-RPC body. `undefined` is a valid value
@@ -143,6 +131,49 @@ var GatewayClient = class {
       ...signal ? { signal } : {}
     });
   }
+  /**
+   * Build the DPoP-authed request headers shared by every backend call: a fresh
+   * DPoP proof bound to (method, url) + the current nonce + the access token, the
+   * `Authorization: DPoP <token>` header, the stable `Mcp-Session-Id`, and the
+   * JSON content type. Factored out of sendHttpRequest so the REST helper below
+   * reuses the EXACT same auth construction (no auth-path divergence).
+   */
+  async buildAuthHeaders(method, url) {
+    const proof = await createDPoPProof(
+      this.privateKey,
+      this.kid,
+      method,
+      url,
+      this.currentNonce,
+      this.token
+    );
+    return {
+      "Content-Type": "application/json",
+      Authorization: `DPoP ${this.token}`,
+      DPoP: proof,
+      "Mcp-Session-Id": getSessionId()
+    };
+  }
+  /**
+   * Send an authed REST request (NOT JSON-RPC) to `<brokerUrl><path>`, reusing
+   * the SAME DPoP-proof + Authorization + Mcp-Session-Id header construction as
+   * the JSON-RPC path (buildAuthHeaders). Returns the RAW `Response` — callers
+   * own status handling; there is deliberately NO error-translation here, so a
+   * best-effort caller (presence) can fire-and-forget and swallow non-2xx.
+   *
+   * `body` is JSON-serialized when present (omitted otherwise). `signal` rides
+   * the real fetch option (per the JSON-RPC path's ROUND-3 convention).
+   */
+  async sendRest(method, path, body, signal) {
+    const url = `${this.brokerUrl}${path}`;
+    const headers = await this.buildAuthHeaders(method, url);
+    return fetch(url, {
+      method,
+      headers,
+      ...body !== void 0 ? { body: JSON.stringify(body) } : {},
+      ...signal ? { signal } : {}
+    });
+  }
   trackNonce(response) {
     const nonce = response.headers.get("DPoP-Nonce");
     if (nonce) {

package/dist/{chunk-LVL25VLO.js → chunk-77HWBSRH.js}

@@ -1,9 +1,5 @@
 // src/wizard/runtimes.ts
 var WIZARD_RUNTIMES = ["claude-code", "hermes", "openclaw", "codex"];
-var WEBHOOK_RUNTIMES = /* @__PURE__ */ new Set([
-  "hermes",
-  "openclaw"
-]);
 function isWizardRuntime(value) {
   return WIZARD_RUNTIMES.includes(value);
 }
@@ -16,7 +12,6 @@ var RUNTIME_MENU = [
 
 export {
   WIZARD_RUNTIMES,
-  WEBHOOK_RUNTIMES,
   isWizardRuntime,
   RUNTIME_MENU
 };

package/dist/{chunk-3H3TL34J.js → chunk-IRD26KZG.js}

@@ -4,7 +4,7 @@ import {
 import {
   GatewayClient,
   applyStableSessionId
-} from "./chunk-IMOEZ4NJ.js";
+} from "./chunk-34IRTWP6.js";
 import {
   AuthModule
 } from "./chunk-JXMVZEQ7.js";
@@ -312,7 +312,7 @@ async function startProxy(config) {
   }
   console.error(`[kojee-mcp] Tandem memberships: ${tandemMembershipCount === -1 ? "unknown" : tandemMembershipCount}`);
   let server;
-  const { selectDelivery } = await import("./registry-TGALQP6M.js");
+  const { selectDelivery } = await import("./registry-HPCRIWRF.js");
   const delivery = selectDelivery(adapter.runtime, {
     supportsChannels: adapter.supportsChannels
   });

package/dist/cli.js

@@ -4,12 +4,12 @@ import {
 } from "./chunk-OGHDTFAX.js";
 import {
   startProxy
-} from "./chunk-3H3TL34J.js";
+} from "./chunk-IRD26KZG.js";
 import "./chunk-XXFVWP6H.js";
 import {
   pairedConfigPath
 } from "./chunk-YH27B6SW.js";
-import "./chunk-IMOEZ4NJ.js";
+import "./chunk-34IRTWP6.js";
 import "./chunk-JXMVZEQ7.js";
 import "./chunk-NR4Y54OL.js";
 import {
@@ -79,7 +79,7 @@ Restart Claude Code for hooks to take effect.`
 program.command("send <tandem_id>").description(
   "Send a Tandem message using this machine's paired credentials (~/.kojee). Prints one JSON envelope to stdout: {ok, message_id, cursor, text} on success, {ok:false, error:<typed code>, message} on failure (exit 1)."
 ).requiredOption("--body <text>", "Message body (required)").option("--reply-to <message_id>", "Message id this send replies to").option("--kind <kind>", "Message kind: message | status (default: backend default)").action(async (tandemId, opts) => {
-  const { runSendCli } = await import("./send-cli-RH7D4JDP.js");
+  const { runSendCli } = await import("./send-cli-T6RPZZQ4.js");
   const { exitCode, envelope } = await runSendCli({
     tandemId,
     body: opts.body,
@@ -140,7 +140,7 @@ program.command("init").description(
     console.error("Not paired. Run `kojee-mcp pair <code> --url <broker>` first, then re-run `init` \u2014 or pass --token/--pair-code, or run `init` in a terminal for the guided wizard.");
     process.exit(1);
   }
-  const { runWizard } = await import("./wizard-5ILBK6YD.js");
+  const { runWizard } = await import("./wizard-3FDEWEYO.js");
   const result = await runWizard({
     ...opts.runtime !== void 0 ? { runtime: opts.runtime } : {},
     ...opts.uninstall ? { uninstall: true } : {},
@@ -178,7 +178,7 @@ async function withReadline(fn) {
   }
 }
 async function promptRuntimeFromTty() {
-  const { RUNTIME_MENU } = await import("./runtimes-CO43XUUK.js");
+  const { RUNTIME_MENU } = await import("./runtimes-GG7EOFZH.js");
   return withReadline(async (ask) => {
     const menu = RUNTIME_MENU.map((m) => `[${m.index}] ${m.runtime}`).join("  ");
     const answer = (await ask(`Which runtime is this proxy for? ${menu}

package/dist/{gateway-client-C6yx1mfM.d.ts → gateway-client-CbM2OC_w.d.ts}

@@ -90,6 +90,25 @@ declare class GatewayClient {
     sendRpc(method: string, params?: Record<string, unknown>, signal?: AbortSignal): Promise<ToolCallResult>;
     private executeWithRetries;
     private sendHttpRequest;
+    /**
+     * Build the DPoP-authed request headers shared by every backend call: a fresh
+     * DPoP proof bound to (method, url) + the current nonce + the access token, the
+     * `Authorization: DPoP <token>` header, the stable `Mcp-Session-Id`, and the
+     * JSON content type. Factored out of sendHttpRequest so the REST helper below
+     * reuses the EXACT same auth construction (no auth-path divergence).
+     */
+    private buildAuthHeaders;
+    /**
+     * Send an authed REST request (NOT JSON-RPC) to `<brokerUrl><path>`, reusing
+     * the SAME DPoP-proof + Authorization + Mcp-Session-Id header construction as
+     * the JSON-RPC path (buildAuthHeaders). Returns the RAW `Response` — callers
+     * own status handling; there is deliberately NO error-translation here, so a
+     * best-effort caller (presence) can fire-and-forget and swallow non-2xx.
+     *
+     * `body` is JSON-serialized when present (omitted otherwise). `signal` rides
+     * the real fetch option (per the JSON-RPC path's ROUND-3 convention).
+     */
+    sendRest(method: string, path: string, body?: unknown, signal?: AbortSignal): Promise<Response>;
     private trackNonce;
     private tryParseErrorBody;
 }

package/dist/{hook-server-T2Z444OV.js → hook-server-XK2NHLJV.js}

@@ -45,6 +45,7 @@ async function handleRequest(req, res, opts) {
   if (req.method === "GET" && url.pathname === "/poll") {
     const type = url.searchParams.get("type") ?? "";
     const timeoutMs = Number.parseInt(url.searchParams.get("timeout_ms") ?? "0", 10);
+    fireLiveliness(opts.liveliness, type);
     if (type === "user-prompt-submit") {
       return respondWithEvents(res, opts);
     }
@@ -131,6 +132,17 @@ function readBody(req, maxBytes) {
     req.on("error", reject);
   });
 }
+function fireLiveliness(liveliness, type) {
+  if (!liveliness) return;
+  try {
+    if (type === "user-prompt-submit") {
+      liveliness.onTurnStart();
+    } else if (type === "stop") {
+      liveliness.onTurnEnd();
+    }
+  } catch {
+  }
+}
 function respondWithEvents(res, opts) {
   const entries = opts.queue.takeForHook();
   const events = entries.map((entry) => opts.adapter.formatTandemEvent(entry.event));

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { G as GatewayClient, P as ProxyConfig } from './gateway-client-C6yx1mfM.js';
+import { G as GatewayClient, P as ProxyConfig } from './gateway-client-CbM2OC_w.js';
 import 'jose';
 
 /**

package/dist/index.js

@@ -1,9 +1,9 @@
 import {
   listTandemIds,
   startProxy
-} from "./chunk-3H3TL34J.js";
+} from "./chunk-IRD26KZG.js";
 import "./chunk-XXFVWP6H.js";
-import "./chunk-IMOEZ4NJ.js";
+import "./chunk-34IRTWP6.js";
 import "./chunk-JXMVZEQ7.js";
 import "./chunk-NR4Y54OL.js";
 import "./chunk-CH32ELFX.js";

package/dist/lib.d.ts

@@ -1,5 +1,5 @@
 import { KeyLike, JWK } from 'jose';
-import { L as LoadedKeyPair, K as KeystoreData, G as GatewayClient, M as McpToolDefinition, T as ToolCallResult, P as ProxyConfig } from './gateway-client-C6yx1mfM.js';
+import { L as LoadedKeyPair, K as KeystoreData, G as GatewayClient, M as McpToolDefinition, T as ToolCallResult, P as ProxyConfig } from './gateway-client-CbM2OC_w.js';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 
 /**

package/dist/lib.js

@@ -13,7 +13,7 @@ import {
 import {
   GatewayClient,
   applyStableSessionId
-} from "./chunk-IMOEZ4NJ.js";
+} from "./chunk-34IRTWP6.js";
 import {
   AuthModule
 } from "./chunk-JXMVZEQ7.js";

package/dist/{registry-TGALQP6M.js → registry-HPCRIWRF.js}

@@ -43,6 +43,40 @@ function formatChannelNotification(event) {
   return claudeCodeAdapter.formatTandemEvent(event);
 }
 
+// src/delivery/liveliness.ts
+function createPresenceProvider({
+  post,
+  debounceMs = 2e3
+}) {
+  let idleTimer = null;
+  const clearIdleTimer = () => {
+    if (idleTimer !== null) {
+      clearTimeout(idleTimer);
+      idleTimer = null;
+    }
+  };
+  const emit = (state) => {
+    void post(state).catch(() => {
+    });
+  };
+  return {
+    onTurnStart() {
+      clearIdleTimer();
+      emit("working");
+    },
+    onTurnEnd() {
+      clearIdleTimer();
+      idleTimer = setTimeout(() => {
+        idleTimer = null;
+        emit("idle");
+      }, debounceMs);
+    },
+    stop() {
+      clearIdleTimer();
+    }
+  };
+}
+
 // src/delivery/claude-code.ts
 function createClaudeCodeDelivery() {
   let eventLog = null;
@@ -52,11 +86,12 @@ function createClaudeCodeDelivery() {
   let hookServer = null;
   let cleanupDiscoveryFile = null;
   let streamHandle = null;
+  let liveliness = null;
   return {
     name: "claude-code",
     async start(ctx) {
       const { EventQueue } = await import("./event-queue-5YVJFR3E.js");
-      const { startHookServer } = await import("./hook-server-T2Z444OV.js");
+      const { startHookServer } = await import("./hook-server-XK2NHLJV.js");
       const {
         writeDiscoveryByKey,
         cleanupDiscoveryByKey,
@@ -117,6 +152,9 @@ function createClaudeCodeDelivery() {
           err.message
         );
       }
+      liveliness = createPresenceProvider({
+        post: (state) => ctx.gateway.sendRest("POST", "/api/v2/presence", { state })
+      });
       queue = new EventQueue();
       const localQueue = queue;
       let liveStream = null;
@@ -124,6 +162,7 @@ function createClaudeCodeDelivery() {
         port: 0,
         queue: localQueue,
         adapter: ctx.adapter,
+        liveliness,
         ...controlToken !== null ? { controlToken, send: { gateway: ctx.gateway, authToken: controlToken } } : {},
         getStreamState: () => liveStream ? liveStream.getState() : {
           connected: false,
@@ -152,11 +191,15 @@ function createClaudeCodeDelivery() {
       cleanupDiscoveryFile = () => cleanupDiscoveryByKey(discoveryKey);
       const localCleanupDiscovery = cleanupDiscoveryFile;
       const localHookServer = hookServer;
+      const localLiveliness = liveliness;
       const exitCleanup = () => {
         localCleanupDiscovery();
         eventLog?.cleanup();
       };
       const teardown = [
+        () => {
+          localLiveliness.stop();
+        },
         () => {
           void webhookSink?.stop();
         },
@@ -207,6 +250,7 @@ function createClaudeCodeDelivery() {
       });
     },
     async stop() {
+      liveliness?.stop();
       await webhookSink?.stop();
       cleanupDiscoveryFile?.();
       eventLog?.cleanup();

package/dist/{runtimes-CO43XUUK.js → runtimes-GG7EOFZH.js}

@@ -1,12 +1,10 @@
 import {
   RUNTIME_MENU,
-  WEBHOOK_RUNTIMES,
   WIZARD_RUNTIMES,
   isWizardRuntime
-} from "./chunk-LVL25VLO.js";
+} from "./chunk-77HWBSRH.js";
 export {
   RUNTIME_MENU,
-  WEBHOOK_RUNTIMES,
   WIZARD_RUNTIMES,
   isWizardRuntime
 };

package/dist/{send-cli-RH7D4JDP.js → send-cli-T6RPZZQ4.js}

@@ -10,7 +10,7 @@ import {
 import {
   GatewayClient,
   applyStableSessionId
-} from "./chunk-IMOEZ4NJ.js";
+} from "./chunk-34IRTWP6.js";
 import "./chunk-NR4Y54OL.js";
 import {
   loadKeystore

package/dist/{wizard-5ILBK6YD.js → wizard-3FDEWEYO.js}

@@ -15,7 +15,7 @@ import {
 import {
   WIZARD_RUNTIMES,
   isWizardRuntime
-} from "./chunk-LVL25VLO.js";
+} from "./chunk-77HWBSRH.js";
 import {
   resolveSignatureEmission,
   resolveWebhookConfig
@@ -30,8 +30,8 @@ import {
 
 // src/wizard/wizard.ts
 import crypto2 from "crypto";
-import fs4 from "fs";
-import path5 from "path";
+import fs5 from "fs";
+import path6 from "path";
 import { fileURLToPath } from "url";
 
 // src/wizard/registry.ts
@@ -318,6 +318,141 @@ function installHermes(inp) {
   };
 }
 
+// src/wizard/capabilities/openclaw-channel-config.ts
+import fs4 from "fs";
+import path5 from "path";
+var CHANNEL_ID = "kojee-tandem";
+function mergeOpenclawChannelConfig(existing, block) {
+  const prevChannels = existing.channels && typeof existing.channels === "object" ? existing.channels : {};
+  return {
+    ...existing,
+    channels: {
+      ...prevChannels,
+      [CHANNEL_ID]: { ...block }
+    }
+  };
+}
+function readOpenclawConfigState(configPath) {
+  let raw;
+  try {
+    raw = fs4.readFileSync(configPath, "utf8");
+  } catch {
+    return { cfg: {}, unparseable: false };
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    return {
+      cfg: parsed && typeof parsed === "object" ? parsed : {},
+      unparseable: false
+    };
+  } catch {
+    return { cfg: {}, unparseable: true };
+  }
+}
+function atomicWrite(filePath, content, secret) {
+  fs4.mkdirSync(path5.dirname(filePath), { recursive: true });
+  const tmp = `${filePath}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`;
+  fs4.writeFileSync(tmp, content, { ...secret ? { mode: 384 } : {} });
+  if (secret) secureFile(tmp);
+  fs4.renameSync(tmp, filePath);
+  if (secret) secureFile(filePath);
+}
+function writeOpenclawChannelConfig(configPath, block, opts = {}) {
+  const { cfg, unparseable } = readOpenclawConfigState(configPath);
+  let backedUp;
+  if (unparseable) {
+    const stamp = opts.timestamp ?? corruptStamp();
+    backedUp = `${configPath}.corrupt-${stamp}`;
+    fs4.copyFileSync(configPath, backedUp);
+  }
+  const merged = mergeOpenclawChannelConfig(cfg, block);
+  atomicWrite(configPath, JSON.stringify(merged, null, 2) + "\n", Boolean(block.credential));
+  return backedUp ? { backedUp } : {};
+}
+function corruptStamp() {
+  return (/* @__PURE__ */ new Date()).toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
+}
+function removeOpenclawChannel(configPath) {
+  let raw;
+  try {
+    raw = fs4.readFileSync(configPath, "utf8");
+  } catch {
+    return false;
+  }
+  let cfg;
+  try {
+    cfg = JSON.parse(raw);
+  } catch {
+    return false;
+  }
+  const channels = cfg.channels && typeof cfg.channels === "object" ? cfg.channels : void 0;
+  if (!channels || !(CHANNEL_ID in channels)) return false;
+  const { [CHANNEL_ID]: _removed, ...rest } = channels;
+  const next = { ...cfg, channels: rest };
+  atomicWrite(configPath, JSON.stringify(next, null, 2) + "\n", false);
+  return true;
+}
+
+// src/wizard/installers/openclaw.ts
+function installOpenclaw(inp) {
+  const gatewayUrl = inp.url ? inp.url.replace(/\/+$/, "") : void 0;
+  const block = {
+    enabled: true,
+    ...gatewayUrl ? { gatewayUrl } : {},
+    // Token-mode → credential lands here (config-first). Paired-mode → omitted.
+    ...inp.token ? { credential: inp.token } : {},
+    tandems: [],
+    selfPrincipals: [],
+    wake: { severities: [], mentionsOnly: false }
+  };
+  const stamp = (inp.now ? inp.now() : /* @__PURE__ */ new Date()).toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
+  const { backedUp } = writeOpenclawChannelConfig(inp.openclawConfigPath, block, { timestamp: stamp });
+  const installCmd = inp.pluginSourceDir ? `openclaw plugins install -l ${inp.pluginSourceDir}` : `openclaw plugins install npm:openclaw-channel-kojee-tandem  (available once published)`;
+  const lines = [];
+  if (backedUp) {
+    lines.push(
+      `WARNING: ${inp.openclawConfigPath} was present but could not be parsed as JSON.`,
+      `         The original was backed up to ${backedUp} before writing the kojee-tandem block.`,
+      `         If it held other channels, recover them from that backup and re-merge by hand.`,
+      ""
+    );
+  }
+  lines.push(
+    "Configured runtime: openclaw (in-process channel plugin)",
+    "Wake mode: native OpenClaw channel \u2014 the plugin streams Tandem events while the gateway is up.",
+    `  channel config:  ${inp.openclawConfigPath} (channels.${CHANNEL_ID})`,
+    inp.token ? `  credential:      written into the channel block (owner-only perms; the plugin's config-first path)` : `  credential:      shared ~/.kojee/config.json (paired) \u2014 not duplicated into the channel block`,
+    "",
+    "Next steps (openclaw):",
+    `  - Install the plugin via OpenClaw's own plugin manager:  ${installCmd}`,
+    "  - Reload the gateway to load the plugin:  openclaw gateway restart",
+    "  - Verify:  openclaw plugins inspect kojee-tandem  /  openclaw channels status"
+  );
+  return {
+    runtime: "openclaw",
+    output: lines.join("\n"),
+    exitCode: 0,
+    configPath: inp.openclawConfigPath
+  };
+}
+function uninstallOpenclaw(inp) {
+  const removed = removeOpenclawChannel(inp.openclawConfigPath);
+  const lines = ["Uninstalling runtime: openclaw (in-process channel plugin)"];
+  lines.push(
+    removed ? `  removed channels.${CHANNEL_ID} from ${inp.openclawConfigPath} (sibling channels preserved)` : `  no channels.${CHANNEL_ID} block found in ${inp.openclawConfigPath} \u2014 nothing to remove`
+  );
+  lines.push("");
+  lines.push("Next steps (openclaw):");
+  lines.push("  - Remove the plugin via OpenClaw's own plugin manager:  openclaw plugins uninstall kojee-tandem");
+  lines.push("  - Reload the gateway:  openclaw gateway restart");
+  return {
+    runtime: "openclaw",
+    output: lines.join("\n"),
+    exitCode: 0,
+    configPath: inp.openclawConfigPath
+  };
+}
+
 // src/wizard/wizard.ts
 var DEFAULT_BROKER_URL = "https://rosie-staging.kojee.net";
 function generateWebhookSecret() {
@@ -383,22 +518,6 @@ function resolveWizardWebhook(opts) {
     ...warning !== void 0 ? { warning } : {}
   };
 }
-function writeRuntimeEnvFile(runtime, url, secret, signatureEnv = []) {
-  const envPath = path5.join(kojeeHomeDir(), ".kojee", `${runtime}.env`);
-  const body = [
-    `# kojee daemon env for runtime=${runtime} (source this before starting the daemon)`,
-    `export KOJEE_RUNTIME=${shellSingleQuote(runtime)}`,
-    `export KOJEE_WEBHOOK_URL=${shellSingleQuote(url)}`,
-    `export KOJEE_WEBHOOK_SECRET=${shellSingleQuote(secret)}`,
-    // Signature emission overrides (0.5.3) — only when explicitly configured.
-    ...signatureEnv.map(([k, v]) => `export ${k}=${shellSingleQuote(v)}`),
-    ""
-  ].join("\n");
-  fs4.mkdirSync(path5.dirname(envPath), { recursive: true, mode: 448 });
-  fs4.writeFileSync(envPath, body, { mode: 384 });
-  secureFile(envPath);
-  return envPath;
-}
 var CODEX_UNVERIFIED_NOTE = "NOTE: live Codex verification (hook fires, MCP server connects, bounded listen works) has not been run on this build \u2014 confirm in a real Codex session. This is the owner morning step.";
 async function gatherGuidedInputs(runtime, opts) {
   const preamble = [];
@@ -599,26 +718,8 @@ function buildDaemonEnvBlock(runtime, wh, envFile) {
   lines.push(indent(buildWebhookReceiverNote({ header: wh.signatureHeader, prefix: wh.signaturePrefix })));
   return lines;
 }
-function configureWebhookDaemon(runtime, opts) {
-  const wh = resolveWizardWebhook(opts);
-  if (wh.error) {
-    return { runtime, output: `webhook env ERROR: ${wh.error}`, exitCode: 2 };
-  }
-  recordRuntime(runtime);
-  const lines = [];
-  lines.push(`Configured runtime: ${runtime}`);
-  lines.push("Wake mode: webhook sink (daemon-consumed). NO MCP-config file, NO hooks written.");
-  lines.push("");
-  if (wh.warning) lines.push(`webhook WARNING: ${wh.warning}`);
-  const envFile = wh.url ? writeRuntimeEnvFile(runtime, wh.url, wh.secret, wh.signatureEnv) : void 0;
-  lines.push(...buildDaemonEnvBlock(runtime, wh, envFile));
-  lines.push("");
-  lines.push(`Next steps (${runtime}):`);
-  lines.push("  Start the daemon with the env above. Verify: kojee-mcp doctor (after the daemon is up).");
-  return { runtime, output: lines.join("\n"), exitCode: 0 };
-}
 function distDir() {
-  return path5.dirname(fileURLToPath(import.meta.url));
+  return path6.dirname(fileURLToPath(import.meta.url));
 }
 function resolveBinPath() {
   const entry = process.argv[1];
@@ -663,7 +764,7 @@ function configureHermes(opts) {
       return { runtime, output: lines.join("\n"), exitCode: install.exitCode };
     }
     recordRuntime(runtime);
-    const envFile = path5.join(home, ".kojee", "hermes.env");
+    const envFile = path6.join(home, ".kojee", "hermes.env");
     lines.push(...buildDaemonEnvBlock(runtime, wh, envFile));
     lines.push("");
     lines.push(install.output);
@@ -678,6 +779,35 @@ function configureHermes(opts) {
   lines.push("  Verify: kojee-mcp doctor (after the daemon is up).");
   return { runtime, output: lines.join("\n"), exitCode: 0 };
 }
+function openclawConfigPath(opts) {
+  return opts.openclawConfigPath ?? path6.join(kojeeHomeDir(), ".openclaw", "config.json");
+}
+function resolveOpenclawPluginSourceDir() {
+  const candidates = [
+    path6.resolve(distDir(), "..", "..", "integrations", "openclaw-plugin"),
+    path6.resolve(distDir(), "..", "..", "..", "integrations", "openclaw-plugin")
+  ];
+  for (const dir of candidates) {
+    if (fs5.existsSync(path6.join(dir, "openclaw.plugin.json"))) return dir;
+  }
+  return void 0;
+}
+function configureOpenclaw(opts) {
+  const runtime = "openclaw";
+  const env = opts.env ?? process.env;
+  const token = (opts.token ?? "").trim();
+  const url = (opts.url ?? env["KOJEE_GATEWAY_URL"] ?? "").trim();
+  const pluginSourceDir = resolveOpenclawPluginSourceDir();
+  const install = installOpenclaw({
+    homeDir: kojeeHomeDir(),
+    openclawConfigPath: openclawConfigPath(opts),
+    ...url ? { url } : {},
+    ...token ? { token } : {},
+    ...pluginSourceDir ? { pluginSourceDir } : {}
+  });
+  recordRuntime(runtime);
+  return { runtime, output: install.output, exitCode: install.exitCode };
+}
 async function runWizardUninstall(runtime, opts) {
   const effective = opts.runtime !== void 0 ? runtime : readRecordedRuntime() ?? runtime;
   const lines = [`Uninstalling runtime: ${effective}`];
@@ -705,12 +835,15 @@ async function runWizardUninstall(runtime, opts) {
     });
     lines.push(`  config.toml [mcp_servers.kojee]: ${removed.mcpServer ? "removed" : "not found"}`);
     lines.push(`  hooks.json Stop: ${removed.stopHook ? "removed" : "not found"}`);
+  } else if (effective === "openclaw") {
+    const un = uninstallOpenclaw({ openclawConfigPath: openclawConfigPath(opts) });
+    lines.push(un.output);
   } else {
-    lines.push("  (hermes/openclaw write no MCP-config or hooks \u2014 nothing to tear down.");
+    lines.push("  (hermes writes no MCP-config or hooks \u2014 nothing to tear down.");
     lines.push("   Stop the daemon and unset KOJEE_WEBHOOK_URL/SECRET to disable the sink.)");
-    const envPath = path5.join(kojeeHomeDir(), ".kojee", `${effective}.env`);
+    const envPath = path6.join(kojeeHomeDir(), ".kojee", `${effective}.env`);
     try {
-      fs4.unlinkSync(envPath);
+      fs5.unlinkSync(envPath);
       lines.push(`  removed ${envPath}`);
     } catch {
     }
@@ -758,8 +891,8 @@ registerBuiltinInstaller(
 registerBuiltinInstaller(
   "openclaw",
   "OpenClaw",
-  ["pair-credential", "webhook"],
-  (o) => configureWebhookDaemon("openclaw", o)
+  ["pair-credential", "in-process-plugin"],
+  (o) => configureOpenclaw(o)
 );
 export {
   CODEX_UNVERIFIED_NOTE,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kojee-mcp",
-  "version": "0.5.14",
+  "version": "0.5.16",
   "type": "module",
   "main": "dist/index.js",
   "exports": {