kojee-mcp 0.5.19 → 0.7.0

package/dist/cli.js

@@ -1,28 +1,30 @@
 #!/usr/bin/env node
 import {
   runPair
-} from "./chunk-OGHDTFAX.js";
+} from "./chunk-EIAUW6KO.js";
 import {
   startProxy
-} from "./chunk-PSVVRGJC.js";
-import "./chunk-XXFVWP6H.js";
+} from "./chunk-5H75AEZ2.js";
+import "./chunk-OB5T6P24.js";
 import {
   pairedConfigPath
-} from "./chunk-YH27B6SW.js";
-import "./chunk-U4MNICQI.js";
-import "./chunk-JXMVZEQ7.js";
-import "./chunk-NR4Y54OL.js";
+} from "./chunk-5SZHXYPK.js";
+import "./chunk-247WFMCJ.js";
+import "./chunk-I67C2HYA.js";
+import "./chunk-Z5LPNJQ6.js";
+import "./chunk-MIEI4PLB.js";
 import {
   defaultPairedKeystorePath,
   deriveKeystorePath
-} from "./chunk-CH32ELFX.js";
-import "./chunk-BLEGIR35.js";
+} from "./chunk-6G6YYST6.js";
+import "./chunk-U5HHHRXA.js";
 import {
   VERSION
-} from "./chunk-XIDCYUTK.js";
-import "./chunk-X672ZN7V.js";
-import "./chunk-2OLXXOT3.js";
-import "./chunk-VHKPWUX7.js";
+} from "./chunk-SGRVG4HW.js";
+import "./chunk-QEJUNP3X.js";
+import "./chunk-PPTKGWFF.js";
+import "./chunk-XJEBJIQE.js";
+import "./chunk-KNEJTD6G.js";
 
 // src/cli.ts
 import { Command } from "commander";
@@ -42,17 +44,30 @@ program.command("pair <code>").description("Pair this machine against Kojee usin
     process.exit(1);
   }
 });
+program.command("connect <code>").description(
+  "Connect this runtime to Kojee with a per-agent pair code from the dashboard (claude-code | codex | openclaw | hermes). claude-code/codex/openclaw write a per-runtime paired slot (~/.kojee/agents/<runtime>/config.json) and point the runtime launcher at it via --paired-config; hermes writes the global ~/.kojee/config.json (its daemon + `kojee-mcp send` read that). Idempotent."
+).requiredOption("--runtime <id>", "Target runtime: claude-code | codex | openclaw | hermes").option("--url <url>", "Broker base URL (default: the canonical staging broker)").action(async (code, opts) => {
+  const { runConnect } = await import("./connect-handler-HIRM624N.js");
+  const result = await runConnect({
+    code,
+    runtime: opts.runtime,
+    ...opts.url ? { url: opts.url } : {}
+  });
+  for (const m of result.messages) console.error(m);
+  console.error(result.output);
+  process.exit(result.exitCode);
+});
 program.command("hook").description("Run a kojee MCP hook script (called by Claude Code via ~/.claude/settings.json)").requiredOption("--type <type>", "Hook type: stop, user-prompt-submit, or codex-stop").action(async (opts) => {
   if (opts.type === "stop") {
-    const { runStopHook } = await import("./stop-hook-QZTFH5WV.js");
+    const { runStopHook } = await import("./stop-hook-YI4KRKF2.js");
     await runStopHook();
     process.exit(0);
   } else if (opts.type === "user-prompt-submit") {
-    const { runUserPromptSubmitHook } = await import("./user-prompt-submit-hook-FQ43NIHC.js");
+    const { runUserPromptSubmitHook } = await import("./user-prompt-submit-hook-DTXXFDSD.js");
     await runUserPromptSubmitHook();
     process.exit(0);
   } else if (opts.type === "codex-stop") {
-    const { runCodexStopHook } = await import("./codex-stop-hook-VY7DOMAG.js");
+    const { runCodexStopHook } = await import("./codex-stop-hook-EOMQD3J4.js");
     await runCodexStopHook();
     process.exit(0);
   } else {
@@ -61,16 +76,17 @@ program.command("hook").description("Run a kojee MCP hook script (called by Clau
   }
 });
 program.command("install-hooks").description("Install kojee Stop + UserPromptSubmit hooks in ~/.claude/settings.json (idempotent)").option("--hooks-path <path>", "Override default ~/.claude/settings.json").option("--uninstall", "Remove kojee hook entries instead of installing them").action(async (opts) => {
-  const { installHooks, uninstallHooks } = await import("./install-LJY2CHKG.js");
+  const { installHooks, uninstallHooks } = await import("./install-V7LSQCYZ.js");
   if (opts.uninstall) {
     const removed = uninstallHooks({ hooksPath: opts.hooksPath });
     console.error(removed ? "Removed kojee hook entries." : "No kojee hook entries found.");
   } else {
     const { stop, ups } = installHooks({ hooksPath: opts.hooksPath });
+    const label = (s) => s === "added" ? "\u2713 added" : s === "updated" ? "\u21BB updated" : "\u21BB already installed";
     console.error(
       "Installed kojee hooks in " + (opts.hooksPath ?? "~/.claude/settings.json") + `:
-  - Stop:              ${stop === "added" ? "\u2713 added" : "\u21BB already installed"}
-  - UserPromptSubmit:  ${ups === "added" ? "\u2713 added" : "\u21BB already installed"}
+  - Stop:              ${label(stop)}
+  - UserPromptSubmit:  ${label(ups)}
 Restart Claude Code for hooks to take effect.`
     );
   }
@@ -78,7 +94,7 @@ Restart Claude Code for hooks to take effect.`
 program.command("send <tandem_id>").description(
   "Send a Tandem message using this machine's paired credentials (~/.kojee). Prints one JSON envelope to stdout: {ok, message_id, cursor, text} on success, {ok:false, error:<typed code>, message} on failure (exit 1)."
 ).requiredOption("--body <text>", "Message body (required)").option("--reply-to <message_id>", "Message id this send replies to").option("--kind <kind>", "Message kind: message | status (default: backend default)").action(async (tandemId, opts) => {
-  const { runSendCli } = await import("./send-cli-IPADRDD2.js");
+  const { runSendCli } = await import("./send-cli-45RLGYIC.js");
   const { exitCode, envelope } = await runSendCli({
     tandemId,
     body: opts.body,
@@ -89,7 +105,7 @@ program.command("send <tandem_id>").description(
   process.exit(exitCode);
 });
 program.command("tail <path>").description("Stream a file's contents and follow appends (portable replacement for `tail -F`)").action(async (filePath) => {
-  const { runTail } = await import("./tail-stream-CEJZGSIR.js");
+  const { runTail } = await import("./tail-stream-NBGHHBS4.js");
   try {
     await runTail(filePath);
   } catch (err) {
@@ -98,75 +114,70 @@ program.command("tail <path>").description("Stream a file's contents and follow
   }
 });
 program.command("doctor").description("Diagnose the kojee wake path (proxy, hook-server, SSE stream, event log, Monitor) and print the exact wake recipe").action(async () => {
-  const { runDoctor } = await import("./doctor-U3MTB4GY.js");
+  const { runDoctor } = await import("./doctor-PLKLHTJM.js");
   const code = await runDoctor();
   process.exit(code);
 });
-program.command("init").description(
-  "Set up kojee for a runtime (claude-code | hermes | openclaw | codex). Interactive when stdin is a TTY; `--runtime <id>` for non-interactive/CI. Run after `kojee-mcp pair`."
-).option("--runtime <id>", "Target runtime: claude-code | hermes | openclaw | codex").option("--config-path <path>", "Override the runtime's MCP-config path").option("--hooks-path <path>", "Override the runtime's hooks-file path").option("--token <token>", "Gateway token \u2014 token mode (writes --token/--url into the MCP config)").option("--url <url>", "Broker base URL (token mode / pair URL; default https://rosie-staging.kojee.net)").option("--pair-code <code>", "Pair code \u2014 runs the pair flow (writes ~/.kojee/config.json) before configuring").option("--webhook-url <url>", "Webhook receiver URL (codex/hermes/openclaw)").option("--webhook-secret <secret>", "Webhook HMAC secret (generated if omitted)").option(
-  "--webhook-signature-format <preset>",
-  'Signature preset: "github" = header X-Hub-Signature-256, value sha256=<hex> (default: bare hex in X-Kojee-Signature)'
-).option(
-  "--webhook-signature-header <name>",
-  "Signature header name (default X-Kojee-Signature; overrides the preset's header)"
-).option(
-  "--webhook-signature-prefix <prefix>",
-  "Literal string prepended to the hex digest (default empty; overrides the preset's prefix)"
-).option("--uninstall", "Remove the kojee config for the chosen (or recorded) runtime").action(async (opts) => {
-  const interactive = process.stdin.isTTY === true && opts.runtime === void 0;
-  if (opts.pairCode && !opts.uninstall) {
-    const { runPair: runPair2 } = await import("./pair-P4ILCMT7.js");
-    const { pairedConfigPath: pairedConfigPath2 } = await import("./paired-config-JTFLHMZ2.js");
-    const { defaultPairedKeystorePath: defaultPairedKeystorePath2 } = await import("./keystore-XLEV3FL5.js");
-    const url = (opts.url ?? "https://rosie-staging.kojee.net").replace(/\/+$/, "");
-    try {
-      const r = await runPair2({
-        code: opts.pairCode,
-        url,
-        keystorePath: defaultPairedKeystorePath2(),
-        configPath: pairedConfigPath2()
-      });
-      console.error(r.message);
-    } catch (err) {
-      console.error("[kojee-mcp init] Pairing failed:", err.message);
-      process.exit(1);
-    }
-  }
-  const { loadPairedConfig } = await import("./paired-config-JTFLHMZ2.js");
-  const hasCredential = loadPairedConfig() !== null || opts.token !== void 0;
-  if (!hasCredential && !interactive && !opts.uninstall) {
-    console.error("Not paired. Run `kojee-mcp pair <code> --url <broker>` first, then re-run `init` \u2014 or pass --token/--pair-code, or run `init` in a terminal for the guided wizard.");
-    process.exit(1);
-  }
-  const { runWizard } = await import("./wizard-Y3ULSO2C.js");
-  const result = await runWizard({
-    ...opts.runtime !== void 0 ? { runtime: opts.runtime } : {},
-    ...opts.uninstall ? { uninstall: true } : {},
-    ...opts.configPath ? { configPath: opts.configPath } : {},
-    ...opts.hooksPath ? { hooksPath: opts.hooksPath } : {},
-    // Token-mode threading (token + url ⇒ --token/--url in the written config).
-    // Normalize the URL exactly like the proxy action does (strip trailing /).
-    ...opts.token ? { token: opts.token } : {},
-    ...opts.url ? { url: opts.url.replace(/\/+$/, "") } : {},
-    ...opts.webhookUrl ? { webhookUrl: opts.webhookUrl } : {},
-    ...opts.webhookSecret ? { webhookSecret: opts.webhookSecret } : {},
-    ...opts.webhookSignatureFormat ? { webhookSignatureFormat: opts.webhookSignatureFormat } : {},
-    ...opts.webhookSignatureHeader ? { webhookSignatureHeader: opts.webhookSignatureHeader } : {},
-    ...opts.webhookSignaturePrefix !== void 0 ? { webhookSignaturePrefix: opts.webhookSignaturePrefix } : {},
-    interactive,
-    ...interactive ? {
-      promptRuntime: promptRuntimeFromTty,
-      promptUrl: promptUrlFromTty,
-      promptAuth: promptAuthFromTty,
-      promptToken: promptTokenFromTty,
-      promptPairCode: promptPairCodeFromTty,
-      promptWebhookUrl: promptWebhookUrlFromTty
-    } : {}
-  });
-  console.error(result.output);
-  process.exit(result.exitCode);
-});
+function addInstallOptions(cmd, runtimeHelp) {
+  return cmd.option("--runtime <id>", runtimeHelp).option("--config-path <path>", "Override the runtime's MCP-config path").option("--hooks-path <path>", "Override the runtime's hooks-file path").option("--token <token>", "Gateway token \u2014 token mode (writes --token/--url into the MCP config; requires --url)").option("--url <url>", "Broker base URL (token mode / pair URL; default https://rosie-staging.kojee.net)").option("--pair <code>", "Pair code \u2014 runs the pair flow before configuring (alias of --pair-code)").option("--pair-code <code>", "Pair code \u2014 runs the pair flow before configuring (connect runtimes write ~/.kojee/agents/<runtime>/config.json; hermes/openclaw write ~/.kojee/config.json)").option("--webhook-url <url>", "Webhook receiver URL (codex/hermes/openclaw)").option("--webhook-secret <secret>", "Webhook HMAC secret (generated if omitted)").option(
+    "--webhook-signature-format <preset>",
+    'Signature preset: "github" = header X-Hub-Signature-256, value sha256=<hex> (default: bare hex in X-Kojee-Signature)'
+  ).option(
+    "--webhook-signature-header <name>",
+    "Signature header name (default X-Kojee-Signature; overrides the preset's header)"
+  ).option(
+    "--webhook-signature-prefix <prefix>",
+    "Literal string prepended to the hex digest (default empty; overrides the preset's prefix)"
+  ).option("--uninstall", "Remove the kojee config for the chosen (or recorded) runtime");
+}
+function makeInstallAction(verb) {
+  return async (opts) => {
+    const interactive = process.stdin.isTTY === true && opts.runtime === void 0;
+    const { runSetup, resolvePairCode } = await import("./setup-handler-UHVKSX7E.js");
+    const pairCode = resolvePairCode(opts);
+    const result = await runSetup({
+      verb,
+      ...opts.runtime !== void 0 ? { runtime: opts.runtime } : {},
+      ...opts.configPath ? { configPath: opts.configPath } : {},
+      ...opts.hooksPath ? { hooksPath: opts.hooksPath } : {},
+      ...opts.token ? { token: opts.token } : {},
+      ...opts.url ? { url: opts.url } : {},
+      ...pairCode ? { pairCode } : {},
+      ...opts.webhookUrl ? { webhookUrl: opts.webhookUrl } : {},
+      ...opts.webhookSecret ? { webhookSecret: opts.webhookSecret } : {},
+      ...opts.webhookSignatureFormat ? { webhookSignatureFormat: opts.webhookSignatureFormat } : {},
+      ...opts.webhookSignatureHeader ? { webhookSignatureHeader: opts.webhookSignatureHeader } : {},
+      ...opts.webhookSignaturePrefix !== void 0 ? { webhookSignaturePrefix: opts.webhookSignaturePrefix } : {},
+      ...opts.uninstall ? { uninstall: true } : {},
+      interactive,
+      ...interactive ? {
+        prompts: {
+          promptRuntime: promptRuntimeFromTty,
+          promptUrl: promptUrlFromTty,
+          promptAuth: promptAuthFromTty,
+          promptToken: promptTokenFromTty,
+          promptPairCode: promptPairCodeFromTty,
+          promptWebhookUrl: promptWebhookUrlFromTty
+        }
+      } : {}
+    });
+    for (const m of result.messages) console.error(m);
+    console.error(result.output);
+    process.exit(result.exitCode);
+  };
+}
+addInstallOptions(
+  program.command("init").description(
+    "Set up kojee for a runtime (claude-code | hermes | openclaw | codex). Interactive when stdin is a TTY; `--runtime <id>` for non-interactive/CI. Run after `kojee-mcp pair`."
+  ),
+  "Target runtime: claude-code | hermes | openclaw | codex"
+).action(makeInstallAction("init"));
+addInstallOptions(
+  program.command("setup").description(
+    "One-line install: pair + write the runtime's MCP config + hooks in one shot (claude-code | codex). `--pair <code> --url <broker> --runtime <id>`, or the token form `--token <T> --url <U> --runtime <id>` for CI."
+  ),
+  "Target runtime: claude-code | codex"
+).action(makeInstallAction("setup"));
 async function withReadline(fn) {
   const readline = await import("readline/promises");
   const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
@@ -208,6 +219,9 @@ async function promptWebhookUrlFromTty() {
   return withReadline((ask) => ask("Webhook receiver URL (press Enter to skip and set it up later):\n> "));
 }
 program.option("--token <token>", "Gateway token (for token-mode)").option("--url <url>", "Broker base URL (for token-mode; required if --token is passed)").option(
+  "--paired-config <path>",
+  "Explicit per-runtime paired config path (written by `connect`)"
+).option(
   "--keystore-path <path>",
   "Path to keypair file (defaults to per-token path under ~/.kojee/)"
 ).action(async (opts) => {
@@ -216,18 +230,36 @@ program.option("--token <token>", "Gateway token (for token-mode)").option("--ur
   let keystorePath = opts.keystorePath;
   const authMode = token ? "token" : "paired";
   if (token) {
+    if (opts.pairedConfig) {
+      console.error(
+        "[kojee-mcp] both --token and --paired-config given; using --token (the per-runtime paired config is ignored)."
+      );
+    }
     if (!url) {
       console.error("--url is required when --token is provided");
       process.exit(1);
     }
     url = url.replace(/\/+$/, "");
     keystorePath ??= deriveKeystorePath(token);
+  } else if (opts.pairedConfig) {
+    const { resolveLaunchCreds } = await import("./resolve-slot-BFIB46Y5.js");
+    const resolved = resolveLaunchCreds({
+      pairedConfig: opts.pairedConfig,
+      ...url ? { url } : {}
+    });
+    if (!resolved.ok) {
+      console.error(resolved.error);
+      process.exit(1);
+    }
+    token = resolved.token;
+    url = resolved.url;
+    keystorePath = resolved.keystorePath;
   } else {
-    const { loadPairedConfig } = await import("./paired-config-JTFLHMZ2.js");
+    const { loadPairedConfig } = await import("./paired-config-GUDDO2CH.js");
     const cfg = loadPairedConfig();
     if (!cfg) {
       console.error(
-        "No --token provided and no ~/.kojee/config.json found. Run `kojee-mcp pair <code> --url <broker>` first."
+        "No --token provided and no ~/.kojee/config.json found. Run `kojee-mcp connect <code> --runtime <id>` (or `kojee-mcp pair`) first."
       );
       process.exit(1);
     }

package/dist/{chunk-35XBRG3V.js → codex-stop-hook-EOMQD3J4.js}

@@ -1,14 +1,15 @@
 import {
   readHookStdin
 } from "./chunk-LSUB6QMP.js";
+import {
+  codexPendingMarkerPath
+} from "./chunk-WIU5WGDF.js";
 import {
   buildCodexWakeReason
-} from "./chunk-X672ZN7V.js";
+} from "./chunk-QEJUNP3X.js";
 
 // src/hooks/codex-stop-hook.ts
 import fs from "fs";
-import os from "os";
-import path from "path";
 var CODEX_PEEK_MS = clampPeekMs(
   Number.parseInt(process.env["KOJEE_CODEX_PEEK_MS"] ?? "150", 10)
 );
@@ -26,12 +27,8 @@ function decideCodexStopHook(deps) {
     reason: buildCodexWakeReason(peek.cursor)
   });
 }
-function codexPendingMarkerPath(sessionId) {
-  const safe = (sessionId ?? "no-session").replace(/[^A-Za-z0-9._-]/g, "_");
-  return path.join(os.homedir(), ".kojee", `codex-pending-${safe}`);
-}
-function defaultPeekPending(sessionId) {
-  const markerPath = codexPendingMarkerPath(sessionId);
+function defaultPeekPending() {
+  const markerPath = codexPendingMarkerPath();
   try {
     const st = fs.statSync(markerPath);
     const ageMs = Date.now() - st.mtimeMs;
@@ -49,12 +46,12 @@ function defaultPeekPending(sessionId) {
   }
 }
 async function runCodexStopHook() {
-  const { sessionId, stopHookActive } = await readHookStdin();
+  const { stopHookActive } = await readHookStdin();
   const out = decideCodexStopHook({
     stopHookActive,
     peekPending: () => {
       try {
-        return defaultPeekPending(sessionId);
+        return defaultPeekPending();
       } catch {
         return { pending: false, cursor: null };
       }
@@ -63,11 +60,10 @@ async function runCodexStopHook() {
   process.stdout.write(out);
 }
 var CODEX_PEEK_BUDGET_MS = CODEX_PEEK_MS;
-
 export {
-  decideCodexStopHook,
+  CODEX_PEEK_BUDGET_MS,
   codexPendingMarkerPath,
+  decideCodexStopHook,
   defaultPeekPending,
-  runCodexStopHook,
-  CODEX_PEEK_BUDGET_MS
+  runCodexStopHook
 };

package/dist/connect-handler-HIRM624N.js

@@ -0,0 +1,137 @@
+import {
+  DEFAULT_BROKER_URL,
+  reconcileConnectPairSlot,
+  runWizard
+} from "./chunk-GVWYW7MY.js";
+import "./chunk-E6WMFMM2.js";
+import "./chunk-OBIJ6WQP.js";
+import "./chunk-QJFMU4QC.js";
+import "./chunk-D6JKFJ6A.js";
+import {
+  CONNECT_RUNTIMES
+} from "./chunk-EIH2LNF4.js";
+import "./chunk-RDLF4NQC.js";
+import "./chunk-SQL56SEB.js";
+import "./chunk-77HWBSRH.js";
+import "./chunk-V5VZPYMZ.js";
+import {
+  runPair
+} from "./chunk-EIAUW6KO.js";
+import {
+  loadPairedConfig,
+  pairedConfigPath,
+  perRuntimeConfigPath
+} from "./chunk-5SZHXYPK.js";
+import "./chunk-I67C2HYA.js";
+import "./chunk-MIEI4PLB.js";
+import {
+  defaultPairedKeystorePath,
+  deriveKeystorePath
+} from "./chunk-6G6YYST6.js";
+import "./chunk-U5HHHRXA.js";
+import "./chunk-QEJUNP3X.js";
+
+// src/wizard/connect-handler.ts
+import os from "os";
+import path from "path";
+function absConfigPath(runtime) {
+  const p = path.resolve(perRuntimeConfigPath(runtime));
+  if (process.platform === "win32" && !/^[a-zA-Z]:/.test(p)) {
+    return path.resolve(path.join(os.homedir(), ".kojee", "agents", runtime, "config.json"));
+  }
+  return p;
+}
+function identityLabel(cfg) {
+  if (cfg?.agent_id && cfg?.principal_id) return `${cfg.agent_id} (${cfg.principal_id})`;
+  if (cfg?.agent_id) return cfg.agent_id;
+  if (cfg?.principal_id) return cfg.principal_id;
+  return "this runtime";
+}
+async function runConnect(opts) {
+  if (opts.runtime === "hermes") return runConnectHermes(opts);
+  const messages = [];
+  const runtime = opts.runtime;
+  if (!CONNECT_RUNTIMES.includes(runtime)) {
+    return {
+      messages,
+      output: `\`connect\` supports: ${CONNECT_RUNTIMES.join(", ")}, hermes. Unknown --runtime "${runtime}". (claude-code/codex/openclaw write a per-runtime paired slot; hermes writes the global ~/.kojee/config.json.)`,
+      exitCode: 2
+    };
+  }
+  const url = (opts.url ?? DEFAULT_BROKER_URL).replace(/\/+$/, "");
+  const configPath = absConfigPath(runtime);
+  const oldConfig = loadPairedConfig(configPath);
+  const reconcile = reconcileConnectPairSlot(runtime, opts.code);
+  if (!reconcile.ok) {
+    return { messages, output: reconcile.output, exitCode: reconcile.exitCode };
+  }
+  messages.push(...reconcile.messages);
+  const pair = opts.runPair ?? runPair;
+  try {
+    const r = await pair({
+      code: opts.code,
+      url,
+      keystorePath: deriveKeystorePath(opts.code),
+      configPath,
+      runtime,
+      allowOverwrite: true
+    });
+    messages.push(r.message);
+  } catch (err) {
+    return { messages, output: `Connect failed while pairing: ${err.message}`, exitCode: 1 };
+  }
+  const wizard = opts.runWizard ?? runWizard;
+  const wiz = await wizard({ runtime, pairedConfigPath: configPath, interactive: false });
+  if (wiz.exitCode !== 0) {
+    return { messages, output: wiz.output, exitCode: wiz.exitCode };
+  }
+  const newConfig = loadPairedConfig(configPath);
+  const newLabel = identityLabel(newConfig);
+  const summary = oldConfig ? `\u21BB re-connected ${runtime} as ${newLabel} (was ${identityLabel(oldConfig)})` : `\u2713 connected ${runtime} as ${newLabel} \u2192 ${url}`;
+  const output = `${summary}
+Restart ${runtime} to pick up the connection.`;
+  return { messages, output, exitCode: 0 };
+}
+async function runConnectHermes(opts) {
+  const messages = [];
+  const url = (opts.url ?? DEFAULT_BROKER_URL).replace(/\/+$/, "");
+  const configPath = pairedConfigPath();
+  const oldConfig = loadPairedConfig(configPath);
+  const guard = reconcileConnectPairSlot("hermes", opts.code);
+  if (!guard.ok) {
+    return { messages, output: guard.output, exitCode: guard.exitCode };
+  }
+  messages.push(...guard.messages);
+  const pair = opts.runPair ?? runPair;
+  try {
+    const r = await pair({
+      code: opts.code,
+      url,
+      keystorePath: defaultPairedKeystorePath(),
+      configPath,
+      runtime: "hermes",
+      allowOverwrite: true
+      // connect is idempotent
+    });
+    messages.push(r.message);
+  } catch (err) {
+    return { messages, output: `Connect failed while pairing: ${err.message}`, exitCode: 1 };
+  }
+  const wizard = opts.runWizard ?? runWizard;
+  const wiz = await wizard({ runtime: "hermes", interactive: false });
+  if (wiz.exitCode !== 0) {
+    return { messages, output: wiz.output, exitCode: wiz.exitCode };
+  }
+  const label = identityLabel(loadPairedConfig(configPath));
+  const summary = oldConfig ? `\u21BB re-connected hermes as ${label}` : `\u2713 connected hermes as ${label} \u2192 ${url}`;
+  return {
+    messages,
+    output: `${summary}
+Start (or restart) the hermes daemon to pick up the connection.`,
+    exitCode: 0
+  };
+}
+export {
+  runConnect,
+  runConnectHermes
+};

package/dist/{control-token-4BUCTYQB.js → control-token-KXSZ3GBY.js}

@@ -3,8 +3,8 @@ import {
   controlTokenPath,
   issueControlToken,
   loadControlToken
-} from "./chunk-GI2CKKBL.js";
-import "./chunk-BLEGIR35.js";
+} from "./chunk-GKXHKR3B.js";
+import "./chunk-U5HHHRXA.js";
 export {
   controlTokenAuthHeaders,
   controlTokenPath,

package/dist/{doctor-U3MTB4GY.js → doctor-PLKLHTJM.js}

@@ -1,28 +1,31 @@
 import "./chunk-XLKGPGZT.js";
+import {
+  loadControlToken
+} from "./chunk-GKXHKR3B.js";
 import {
   monitorHeartbeatPath,
   statusLogPath
-} from "./chunk-DURRQDYI.js";
+} from "./chunk-TNZITJAB.js";
 import {
   discoveryPathForKey,
   readSessionDiscoveryByKey,
   sessionDiscoveryDir
-} from "./chunk-DO42NPNR.js";
-import {
-  loadControlToken
-} from "./chunk-GI2CKKBL.js";
+} from "./chunk-67F67AQ6.js";
 import {
   loadPairedConfig
-} from "./chunk-YH27B6SW.js";
-import "./chunk-BLEGIR35.js";
+} from "./chunk-5SZHXYPK.js";
+import "./chunk-U5HHHRXA.js";
 import {
   buildMonitorSpawn,
   buildReplyRecipe
-} from "./chunk-X672ZN7V.js";
+} from "./chunk-QEJUNP3X.js";
 import {
   deriveDiscoveryKey,
   findClaudeAncestorPid
-} from "./chunk-VHKPWUX7.js";
+} from "./chunk-XJEBJIQE.js";
+import {
+  resolveSharedSessionId
+} from "./chunk-KNEJTD6G.js";
 
 // src/doctor.ts
 import fs from "fs";
@@ -95,7 +98,8 @@ function defaultIsPidAlive(pid) {
     process.kill(pid, 0);
     return true;
   } catch (err) {
-    if (err.code === "EPERM") return true;
+    const code = err.code;
+    if (code === "EPERM" || code === "EACCES") return true;
     return false;
   }
 }
@@ -132,6 +136,19 @@ function defaultReadLastStatusLine(path2) {
     }
   }
 }
+async function resolveDefaultPairedScope() {
+  const { resolvePairedSlot } = await import("./resolve-slot-BFIB46Y5.js");
+  const { readRecordedRuntime } = await import("./runtime-record-OXRLTOLC.js");
+  const { deriveKeystorePath } = await import("./keystore-LQNFDHGO.js");
+  const runtime = readRecordedRuntime() ?? process.env["KOJEE_RUNTIME"];
+  const resolution = resolvePairedSlot({ ...runtime ? { runtime } : {} });
+  const cfg = loadPairedConfig(resolution.configPath);
+  let present = cfg !== null && typeof cfg.token === "string" && cfg.token !== "";
+  if (present && resolution.scope === "paired" && cfg) {
+    present = fs.existsSync(deriveKeystorePath(cfg.token));
+  }
+  return { scope: resolution.scope, present, ...runtime ? { runtime } : {} };
+}
 async function collectDoctorReport(deps = {}) {
   const fetchFn = deps.fetchFn ?? fetch;
   const isPidAlive = deps.isPidAlive ?? defaultIsPidAlive;
@@ -140,23 +157,32 @@ async function collectDoctorReport(deps = {}) {
   const readDiscovery = deps.readDiscovery ?? readSessionDiscoveryByKey;
   const projectDir = deps.projectDir ?? process.env["CLAUDE_PROJECT_DIR"];
   const ccPid = deps.ccPid !== void 0 ? deps.ccPid : await findClaudeAncestorPid();
-  const discoveryKey = deriveDiscoveryKey(projectDir, ccPid);
+  const sessionId = deps.sessionId !== void 0 ? deps.sessionId : resolveSharedSessionId();
+  const discoveryKey = deriveDiscoveryKey(projectDir, ccPid, sessionId);
   const discoveryPath = discoveryPathForKey(discoveryKey);
   const checks = [];
   const discovery = readDiscovery(discoveryKey);
   const tokenMode = discovery?.authMode === "token";
-  const paired = deps.pairedConfigPresent !== void 0 ? deps.pairedConfigPresent : loadPairedConfig() !== null;
-  checks.push(
-    tokenMode ? {
+  const pairedScope = deps.pairedScope ?? (deps.pairedConfigPresent !== void 0 ? { scope: "legacy", present: deps.pairedConfigPresent } : await resolveDefaultPairedScope());
+  if (tokenMode) {
+    checks.push({
       name: "paired config",
       ok: true,
       detail: "n/a (token mode) \u2014 proxy launched with --token; no ~/.kojee/config.json by design"
-    } : {
+    });
+  } else if (pairedScope.scope === "paired") {
+    checks.push({
       name: "paired config",
-      ok: paired,
-      detail: paired ? "present" : "MISSING \u2014 run `kojee-mcp pair <code> --url <broker>`"
-    }
-  );
+      ok: pairedScope.present,
+      detail: pairedScope.present ? `present (per-runtime: ${pairedScope.runtime ?? "?"}) + token-derived keystore` : `MISSING per-runtime slot for ${pairedScope.runtime ?? "?"} \u2014 run \`kojee-mcp connect <code> --runtime ${pairedScope.runtime ?? "<id>"}\``
+    });
+  } else {
+    checks.push({
+      name: "paired config",
+      ok: pairedScope.present,
+      detail: pairedScope.present ? "present (legacy global slot)" : "MISSING \u2014 run `kojee-mcp connect <code> --runtime <id>` (or `kojee-mcp pair`)"
+    });
+  }
   let logPath = null;
   if (!discovery) {
     checks.push({
@@ -326,15 +352,15 @@ function formatDoctorReport(report) {
   return lines.join("\n");
 }
 async function runDoctor() {
-  const { readRecordedRuntime } = await import("./runtime-record-WO4IECM6.js");
+  const { readRecordedRuntime } = await import("./runtime-record-OXRLTOLC.js");
   if (readRecordedRuntime() === "codex") {
-    const { collectCodexDoctorReport, formatCodexDoctorReport } = await import("./doctor-codex-PA3WO6LR.js");
+    const { collectCodexDoctorReport, formatCodexDoctorReport } = await import("./doctor-codex-HARAAH4Y.js");
     const report2 = collectCodexDoctorReport();
     console.error(formatCodexDoctorReport(report2));
     return report2.verdict === "broken" ? 1 : 0;
   }
   if (readRecordedRuntime() === "openclaw") {
-    const { collectOpenclawDoctorReport, formatOpenclawDoctorReport } = await import("./doctor-openclaw-SS2TMQOX.js");
+    const { collectOpenclawDoctorReport, formatOpenclawDoctorReport } = await import("./doctor-openclaw-LL6NSPLC.js");
     const report2 = collectOpenclawDoctorReport();
     console.error(formatOpenclawDoctorReport(report2));
     return report2.verdict === "broken" ? 1 : 0;