kojee-mcp 0.6.0 → 0.7.0

package/dist/chunk-U5HHHRXA.js

@@ -0,0 +1,103 @@
+// src/fs-retry.ts
+import fs from "fs";
+var RETRYABLE = /* @__PURE__ */ new Set(["EPERM", "EBUSY", "EACCES"]);
+function sleepSync(ms) {
+  if (ms <= 0) return;
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function withFileOpRetry(op, opts = {}) {
+  const tries = opts.tries ?? 5;
+  const backoffMs = opts.backoffMs ?? 15;
+  let lastErr;
+  for (let i = 0; i < tries; i++) {
+    try {
+      return op();
+    } catch (err) {
+      const code = err.code;
+      if (!code || !RETRYABLE.has(code)) throw err;
+      lastErr = err;
+      if (i < tries - 1) sleepSync(backoffMs);
+    }
+  }
+  throw lastErr;
+}
+function renameSyncRetry(from, to, opts) {
+  withFileOpRetry(() => fs.renameSync(from, to), opts);
+}
+function unlinkSyncRetry(p, opts) {
+  try {
+    withFileOpRetry(() => fs.unlinkSync(p), opts);
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+  }
+}
+
+// src/secure-file.ts
+import fs2 from "fs";
+import os from "os";
+import { execFileSync } from "child_process";
+function isWindows() {
+  return process.platform === "win32";
+}
+function secureFile(filePath) {
+  if (isWindows()) {
+    restrictAclToCurrentUser(filePath, "(F)");
+  } else {
+    try {
+      fs2.chmodSync(filePath, 384);
+    } catch {
+    }
+  }
+}
+function secureDir(dirPath) {
+  if (isWindows()) {
+    restrictAclToCurrentUser(dirPath, "(OI)(CI)(F)");
+  } else {
+    try {
+      fs2.chmodSync(dirPath, 448);
+    } catch {
+    }
+  }
+}
+function currentUserSid() {
+  try {
+    const out = execFileSync("whoami", ["/user", "/fo", "csv", "/nh"], { encoding: "utf8" });
+    const m = out.match(/S-1-[0-9-]+/);
+    return m ? m[0] : null;
+  } catch {
+    return null;
+  }
+}
+function restrictAclToCurrentUser(target, permission) {
+  try {
+    const sid = currentUserSid();
+    const grantee = sid ? `*${sid}` : os.userInfo().username;
+    execFileSync("icacls", [target, "/grant:r", `${grantee}:${permission}`], { stdio: "ignore" });
+    execFileSync("icacls", [target, "/inheritance:r"], { stdio: "ignore" });
+    if (permission.includes("(F)")) {
+      try {
+        fs2.accessSync(target, fs2.constants.R_OK);
+      } catch {
+        try {
+          execFileSync("icacls", [target, "/grant:r", `${grantee}:${permission}`], { stdio: "ignore" });
+        } catch {
+        }
+      }
+    }
+  } catch {
+  }
+}
+function createSecureFileSync(filePath) {
+  unlinkSyncRetry(filePath);
+  const fd = fs2.openSync(filePath, "wx", 384);
+  fs2.closeSync(fd);
+  secureFile(filePath);
+}
+
+export {
+  renameSyncRetry,
+  unlinkSyncRetry,
+  secureFile,
+  secureDir,
+  createSecureFileSync
+};

package/dist/chunk-WBXU27BF.js

@@ -0,0 +1,35 @@
+import {
+  readSessionDiscoveryByKey
+} from "./chunk-67F67AQ6.js";
+import {
+  deriveDiscoveryKey,
+  findClaudeAncestorPid
+} from "./chunk-XJEBJIQE.js";
+import {
+  resolveSharedSessionId
+} from "./chunk-KNEJTD6G.js";
+
+// src/hooks/discovery.ts
+async function resolveHookDiscovery(stdinSessionId, deps = {}) {
+  const read = deps.readDiscovery ?? readSessionDiscoveryByKey;
+  const findPid = deps.findAncestorPid ?? findClaudeAncestorPid;
+  const projectDir = deps.projectDir !== void 0 ? deps.projectDir : process.env["CLAUDE_PROJECT_DIR"];
+  const sessionId = resolveSharedSessionId({ env: {}, stdinSessionId });
+  if (sessionId) {
+    const sidKey = deriveDiscoveryKey(projectDir, null, sessionId);
+    const sidHit = read(sidKey);
+    if (sidHit) return { discovery: sidHit, key: sidKey };
+    const ccPid2 = await findPid();
+    const legacyKey2 = deriveDiscoveryKey(projectDir, ccPid2, null);
+    const legacyHit = read(legacyKey2);
+    if (legacyHit) return { discovery: legacyHit, key: legacyKey2 };
+    return { discovery: null, key: sidKey };
+  }
+  const ccPid = await findPid();
+  const legacyKey = deriveDiscoveryKey(projectDir, ccPid, null);
+  return { discovery: read(legacyKey), key: legacyKey };
+}
+
+export {
+  resolveHookDiscovery
+};

package/dist/chunk-WIU5WGDF.js

@@ -0,0 +1,10 @@
+// src/hooks/codex-pending-path.ts
+import os from "os";
+import path from "path";
+function codexPendingMarkerPath() {
+  return path.join(os.homedir(), ".kojee", "codex-pending");
+}
+
+export {
+  codexPendingMarkerPath
+};

package/dist/chunk-XJEBJIQE.js

@@ -0,0 +1,52 @@
+// src/runtime/ancestry.ts
+import psList from "ps-list";
+import { createHash } from "crypto";
+var CLAUDE_PROCESS_RE = /\bclaude\b/i;
+function rowLooksLikeClaude(row) {
+  return CLAUDE_PROCESS_RE.test(`${row.name} ${row.cmd ?? ""}`);
+}
+async function findClaudeAncestorPid(startPid = process.ppid) {
+  let processes;
+  try {
+    processes = await psList();
+  } catch {
+    return null;
+  }
+  const byPid = /* @__PURE__ */ new Map();
+  for (const p of processes) byPid.set(p.pid, p);
+  let pid = startPid;
+  for (let depth = 0; depth < 20 && pid !== void 0 && pid > 1; depth++) {
+    const row = byPid.get(pid);
+    if (!row) return null;
+    if (rowLooksLikeClaude(row)) return pid;
+    if (row.ppid === void 0 || row.ppid === pid) return null;
+    pid = row.ppid;
+  }
+  return null;
+}
+async function pidLooksLikeClaude(pid) {
+  let processes;
+  try {
+    processes = await psList();
+  } catch {
+    return null;
+  }
+  const row = processes.find((p) => p.pid === pid);
+  if (!row) return null;
+  return rowLooksLikeClaude(row);
+}
+function deriveDiscoveryKey(projectDir, ccPid, sessionId) {
+  const hasProjectDir = typeof projectDir === "string" && projectDir.length > 0;
+  const prefix = createHash("sha256").update(hasProjectDir ? projectDir : "<no-project>").digest("hex").slice(0, 12);
+  const sid = typeof sessionId === "string" ? sessionId.trim() : "";
+  if (sid) return `${prefix}-s-${sid}`;
+  if (!hasProjectDir && ccPid === null) return `orphan-${process.pid}`;
+  if (ccPid === null) return `${prefix}-orphan`;
+  return `${prefix}-${ccPid}`;
+}
+
+export {
+  findClaudeAncestorPid,
+  pidLooksLikeClaude,
+  deriveDiscoveryKey
+};

package/dist/chunk-Z5LPNJQ6.js

@@ -0,0 +1,20 @@
+// src/tandem/session-id.ts
+import crypto from "crypto";
+import { ulid } from "ulidx";
+var MCP_SESSION_ID = ulid();
+function deriveStableSessionId(token, instanceKey) {
+  return crypto.createHash("sha256").update(`${token}:${instanceKey}`).digest("hex").slice(0, 32);
+}
+var _stableSessionId = null;
+function setStableSessionId(id) {
+  _stableSessionId = id;
+}
+function getSessionId() {
+  return _stableSessionId ?? MCP_SESSION_ID;
+}
+
+export {
+  deriveStableSessionId,
+  setStableSessionId,
+  getSessionId
+};

package/dist/cli.js

@@ -1,28 +1,30 @@
 #!/usr/bin/env node
 import {
   runPair
-} from "./chunk-OGHDTFAX.js";
+} from "./chunk-EIAUW6KO.js";
 import {
   startProxy
-} from "./chunk-BYV7CWNY.js";
-import "./chunk-N35X22G7.js";
+} from "./chunk-5H75AEZ2.js";
+import "./chunk-OB5T6P24.js";
 import {
   pairedConfigPath
-} from "./chunk-YH27B6SW.js";
-import "./chunk-KH5YEJIM.js";
-import "./chunk-JXMVZEQ7.js";
-import "./chunk-NR4Y54OL.js";
+} from "./chunk-5SZHXYPK.js";
+import "./chunk-247WFMCJ.js";
+import "./chunk-I67C2HYA.js";
+import "./chunk-Z5LPNJQ6.js";
+import "./chunk-MIEI4PLB.js";
 import {
   defaultPairedKeystorePath,
   deriveKeystorePath
-} from "./chunk-CH32ELFX.js";
-import "./chunk-BLEGIR35.js";
+} from "./chunk-6G6YYST6.js";
+import "./chunk-U5HHHRXA.js";
 import {
   VERSION
-} from "./chunk-ALZX3SGI.js";
-import "./chunk-Q7T3WAST.js";
+} from "./chunk-SGRVG4HW.js";
+import "./chunk-QEJUNP3X.js";
 import "./chunk-PPTKGWFF.js";
-import "./chunk-VHKPWUX7.js";
+import "./chunk-XJEBJIQE.js";
+import "./chunk-KNEJTD6G.js";
 
 // src/cli.ts
 import { Command } from "commander";
@@ -42,17 +44,30 @@ program.command("pair <code>").description("Pair this machine against Kojee usin
     process.exit(1);
   }
 });
+program.command("connect <code>").description(
+  "Connect this runtime to Kojee with a per-agent pair code from the dashboard (claude-code | codex | openclaw | hermes). claude-code/codex/openclaw write a per-runtime paired slot (~/.kojee/agents/<runtime>/config.json) and point the runtime launcher at it via --paired-config; hermes writes the global ~/.kojee/config.json (its daemon + `kojee-mcp send` read that). Idempotent."
+).requiredOption("--runtime <id>", "Target runtime: claude-code | codex | openclaw | hermes").option("--url <url>", "Broker base URL (default: the canonical staging broker)").action(async (code, opts) => {
+  const { runConnect } = await import("./connect-handler-HIRM624N.js");
+  const result = await runConnect({
+    code,
+    runtime: opts.runtime,
+    ...opts.url ? { url: opts.url } : {}
+  });
+  for (const m of result.messages) console.error(m);
+  console.error(result.output);
+  process.exit(result.exitCode);
+});
 program.command("hook").description("Run a kojee MCP hook script (called by Claude Code via ~/.claude/settings.json)").requiredOption("--type <type>", "Hook type: stop, user-prompt-submit, or codex-stop").action(async (opts) => {
   if (opts.type === "stop") {
-    const { runStopHook } = await import("./stop-hook-TCPJFGFF.js");
+    const { runStopHook } = await import("./stop-hook-YI4KRKF2.js");
     await runStopHook();
     process.exit(0);
   } else if (opts.type === "user-prompt-submit") {
-    const { runUserPromptSubmitHook } = await import("./user-prompt-submit-hook-FQ43NIHC.js");
+    const { runUserPromptSubmitHook } = await import("./user-prompt-submit-hook-DTXXFDSD.js");
     await runUserPromptSubmitHook();
     process.exit(0);
   } else if (opts.type === "codex-stop") {
-    const { runCodexStopHook } = await import("./codex-stop-hook-RWQSZTST.js");
+    const { runCodexStopHook } = await import("./codex-stop-hook-EOMQD3J4.js");
     await runCodexStopHook();
     process.exit(0);
   } else {
@@ -61,16 +76,17 @@ program.command("hook").description("Run a kojee MCP hook script (called by Clau
   }
 });
 program.command("install-hooks").description("Install kojee Stop + UserPromptSubmit hooks in ~/.claude/settings.json (idempotent)").option("--hooks-path <path>", "Override default ~/.claude/settings.json").option("--uninstall", "Remove kojee hook entries instead of installing them").action(async (opts) => {
-  const { installHooks, uninstallHooks } = await import("./install-LJY2CHKG.js");
+  const { installHooks, uninstallHooks } = await import("./install-V7LSQCYZ.js");
   if (opts.uninstall) {
     const removed = uninstallHooks({ hooksPath: opts.hooksPath });
     console.error(removed ? "Removed kojee hook entries." : "No kojee hook entries found.");
   } else {
     const { stop, ups } = installHooks({ hooksPath: opts.hooksPath });
+    const label = (s) => s === "added" ? "\u2713 added" : s === "updated" ? "\u21BB updated" : "\u21BB already installed";
     console.error(
       "Installed kojee hooks in " + (opts.hooksPath ?? "~/.claude/settings.json") + `:
-  - Stop:              ${stop === "added" ? "\u2713 added" : "\u21BB already installed"}
-  - UserPromptSubmit:  ${ups === "added" ? "\u2713 added" : "\u21BB already installed"}
+  - Stop:              ${label(stop)}
+  - UserPromptSubmit:  ${label(ups)}
 Restart Claude Code for hooks to take effect.`
     );
   }
@@ -78,7 +94,7 @@ Restart Claude Code for hooks to take effect.`
 program.command("send <tandem_id>").description(
   "Send a Tandem message using this machine's paired credentials (~/.kojee). Prints one JSON envelope to stdout: {ok, message_id, cursor, text} on success, {ok:false, error:<typed code>, message} on failure (exit 1)."
 ).requiredOption("--body <text>", "Message body (required)").option("--reply-to <message_id>", "Message id this send replies to").option("--kind <kind>", "Message kind: message | status (default: backend default)").action(async (tandemId, opts) => {
-  const { runSendCli } = await import("./send-cli-IYJF32PE.js");
+  const { runSendCli } = await import("./send-cli-45RLGYIC.js");
   const { exitCode, envelope } = await runSendCli({
     tandemId,
     body: opts.body,
@@ -89,7 +105,7 @@ program.command("send <tandem_id>").description(
   process.exit(exitCode);
 });
 program.command("tail <path>").description("Stream a file's contents and follow appends (portable replacement for `tail -F`)").action(async (filePath) => {
-  const { runTail } = await import("./tail-stream-4IMXI44S.js");
+  const { runTail } = await import("./tail-stream-NBGHHBS4.js");
   try {
     await runTail(filePath);
   } catch (err) {
@@ -98,12 +114,12 @@ program.command("tail <path>").description("Stream a file's contents and follow
   }
 });
 program.command("doctor").description("Diagnose the kojee wake path (proxy, hook-server, SSE stream, event log, Monitor) and print the exact wake recipe").action(async () => {
-  const { runDoctor } = await import("./doctor-WVX3WCYX.js");
+  const { runDoctor } = await import("./doctor-PLKLHTJM.js");
   const code = await runDoctor();
   process.exit(code);
 });
 function addInstallOptions(cmd, runtimeHelp) {
-  return cmd.option("--runtime <id>", runtimeHelp).option("--config-path <path>", "Override the runtime's MCP-config path").option("--hooks-path <path>", "Override the runtime's hooks-file path").option("--token <token>", "Gateway token \u2014 token mode (writes --token/--url into the MCP config; requires --url)").option("--url <url>", "Broker base URL (token mode / pair URL; default https://rosie-staging.kojee.net)").option("--pair <code>", "Pair code \u2014 runs the pair flow before configuring (alias of --pair-code)").option("--pair-code <code>", "Pair code \u2014 runs the pair flow (writes ~/.kojee/config.json) before configuring").option("--webhook-url <url>", "Webhook receiver URL (codex/hermes/openclaw)").option("--webhook-secret <secret>", "Webhook HMAC secret (generated if omitted)").option(
+  return cmd.option("--runtime <id>", runtimeHelp).option("--config-path <path>", "Override the runtime's MCP-config path").option("--hooks-path <path>", "Override the runtime's hooks-file path").option("--token <token>", "Gateway token \u2014 token mode (writes --token/--url into the MCP config; requires --url)").option("--url <url>", "Broker base URL (token mode / pair URL; default https://rosie-staging.kojee.net)").option("--pair <code>", "Pair code \u2014 runs the pair flow before configuring (alias of --pair-code)").option("--pair-code <code>", "Pair code \u2014 runs the pair flow before configuring (connect runtimes write ~/.kojee/agents/<runtime>/config.json; hermes/openclaw write ~/.kojee/config.json)").option("--webhook-url <url>", "Webhook receiver URL (codex/hermes/openclaw)").option("--webhook-secret <secret>", "Webhook HMAC secret (generated if omitted)").option(
     "--webhook-signature-format <preset>",
     'Signature preset: "github" = header X-Hub-Signature-256, value sha256=<hex> (default: bare hex in X-Kojee-Signature)'
   ).option(
@@ -117,7 +133,7 @@ function addInstallOptions(cmd, runtimeHelp) {
 function makeInstallAction(verb) {
   return async (opts) => {
     const interactive = process.stdin.isTTY === true && opts.runtime === void 0;
-    const { runSetup, resolvePairCode } = await import("./setup-handler-7HOFAD7C.js");
+    const { runSetup, resolvePairCode } = await import("./setup-handler-UHVKSX7E.js");
     const pairCode = resolvePairCode(opts);
     const result = await runSetup({
       verb,
@@ -203,6 +219,9 @@ async function promptWebhookUrlFromTty() {
   return withReadline((ask) => ask("Webhook receiver URL (press Enter to skip and set it up later):\n> "));
 }
 program.option("--token <token>", "Gateway token (for token-mode)").option("--url <url>", "Broker base URL (for token-mode; required if --token is passed)").option(
+  "--paired-config <path>",
+  "Explicit per-runtime paired config path (written by `connect`)"
+).option(
   "--keystore-path <path>",
   "Path to keypair file (defaults to per-token path under ~/.kojee/)"
 ).action(async (opts) => {
@@ -211,18 +230,36 @@ program.option("--token <token>", "Gateway token (for token-mode)").option("--ur
   let keystorePath = opts.keystorePath;
   const authMode = token ? "token" : "paired";
   if (token) {
+    if (opts.pairedConfig) {
+      console.error(
+        "[kojee-mcp] both --token and --paired-config given; using --token (the per-runtime paired config is ignored)."
+      );
+    }
     if (!url) {
       console.error("--url is required when --token is provided");
       process.exit(1);
     }
     url = url.replace(/\/+$/, "");
     keystorePath ??= deriveKeystorePath(token);
+  } else if (opts.pairedConfig) {
+    const { resolveLaunchCreds } = await import("./resolve-slot-BFIB46Y5.js");
+    const resolved = resolveLaunchCreds({
+      pairedConfig: opts.pairedConfig,
+      ...url ? { url } : {}
+    });
+    if (!resolved.ok) {
+      console.error(resolved.error);
+      process.exit(1);
+    }
+    token = resolved.token;
+    url = resolved.url;
+    keystorePath = resolved.keystorePath;
   } else {
-    const { loadPairedConfig } = await import("./paired-config-JTFLHMZ2.js");
+    const { loadPairedConfig } = await import("./paired-config-GUDDO2CH.js");
     const cfg = loadPairedConfig();
     if (!cfg) {
       console.error(
-        "No --token provided and no ~/.kojee/config.json found. Run `kojee-mcp pair <code> --url <broker>` first."
+        "No --token provided and no ~/.kojee/config.json found. Run `kojee-mcp connect <code> --runtime <id>` (or `kojee-mcp pair`) first."
       );
       process.exit(1);
     }

package/dist/{chunk-KFDZWNQO.js → codex-stop-hook-EOMQD3J4.js}

@@ -1,14 +1,15 @@
 import {
   readHookStdin
 } from "./chunk-LSUB6QMP.js";
+import {
+  codexPendingMarkerPath
+} from "./chunk-WIU5WGDF.js";
 import {
   buildCodexWakeReason
-} from "./chunk-Q7T3WAST.js";
+} from "./chunk-QEJUNP3X.js";
 
 // src/hooks/codex-stop-hook.ts
 import fs from "fs";
-import os from "os";
-import path from "path";
 var CODEX_PEEK_MS = clampPeekMs(
   Number.parseInt(process.env["KOJEE_CODEX_PEEK_MS"] ?? "150", 10)
 );
@@ -26,12 +27,8 @@ function decideCodexStopHook(deps) {
     reason: buildCodexWakeReason(peek.cursor)
   });
 }
-function codexPendingMarkerPath(sessionId) {
-  const safe = (sessionId ?? "no-session").replace(/[^A-Za-z0-9._-]/g, "_");
-  return path.join(os.homedir(), ".kojee", `codex-pending-${safe}`);
-}
-function defaultPeekPending(sessionId) {
-  const markerPath = codexPendingMarkerPath(sessionId);
+function defaultPeekPending() {
+  const markerPath = codexPendingMarkerPath();
   try {
     const st = fs.statSync(markerPath);
     const ageMs = Date.now() - st.mtimeMs;
@@ -49,12 +46,12 @@ function defaultPeekPending(sessionId) {
   }
 }
 async function runCodexStopHook() {
-  const { sessionId, stopHookActive } = await readHookStdin();
+  const { stopHookActive } = await readHookStdin();
   const out = decideCodexStopHook({
     stopHookActive,
     peekPending: () => {
       try {
-        return defaultPeekPending(sessionId);
+        return defaultPeekPending();
       } catch {
         return { pending: false, cursor: null };
       }
@@ -63,11 +60,10 @@ async function runCodexStopHook() {
   process.stdout.write(out);
 }
 var CODEX_PEEK_BUDGET_MS = CODEX_PEEK_MS;
-
 export {
-  decideCodexStopHook,
+  CODEX_PEEK_BUDGET_MS,
   codexPendingMarkerPath,
+  decideCodexStopHook,
   defaultPeekPending,
-  runCodexStopHook,
-  CODEX_PEEK_BUDGET_MS
+  runCodexStopHook
 };

package/dist/connect-handler-HIRM624N.js

@@ -0,0 +1,137 @@
+import {
+  DEFAULT_BROKER_URL,
+  reconcileConnectPairSlot,
+  runWizard
+} from "./chunk-GVWYW7MY.js";
+import "./chunk-E6WMFMM2.js";
+import "./chunk-OBIJ6WQP.js";
+import "./chunk-QJFMU4QC.js";
+import "./chunk-D6JKFJ6A.js";
+import {
+  CONNECT_RUNTIMES
+} from "./chunk-EIH2LNF4.js";
+import "./chunk-RDLF4NQC.js";
+import "./chunk-SQL56SEB.js";
+import "./chunk-77HWBSRH.js";
+import "./chunk-V5VZPYMZ.js";
+import {
+  runPair
+} from "./chunk-EIAUW6KO.js";
+import {
+  loadPairedConfig,
+  pairedConfigPath,
+  perRuntimeConfigPath
+} from "./chunk-5SZHXYPK.js";
+import "./chunk-I67C2HYA.js";
+import "./chunk-MIEI4PLB.js";
+import {
+  defaultPairedKeystorePath,
+  deriveKeystorePath
+} from "./chunk-6G6YYST6.js";
+import "./chunk-U5HHHRXA.js";
+import "./chunk-QEJUNP3X.js";
+
+// src/wizard/connect-handler.ts
+import os from "os";
+import path from "path";
+function absConfigPath(runtime) {
+  const p = path.resolve(perRuntimeConfigPath(runtime));
+  if (process.platform === "win32" && !/^[a-zA-Z]:/.test(p)) {
+    return path.resolve(path.join(os.homedir(), ".kojee", "agents", runtime, "config.json"));
+  }
+  return p;
+}
+function identityLabel(cfg) {
+  if (cfg?.agent_id && cfg?.principal_id) return `${cfg.agent_id} (${cfg.principal_id})`;
+  if (cfg?.agent_id) return cfg.agent_id;
+  if (cfg?.principal_id) return cfg.principal_id;
+  return "this runtime";
+}
+async function runConnect(opts) {
+  if (opts.runtime === "hermes") return runConnectHermes(opts);
+  const messages = [];
+  const runtime = opts.runtime;
+  if (!CONNECT_RUNTIMES.includes(runtime)) {
+    return {
+      messages,
+      output: `\`connect\` supports: ${CONNECT_RUNTIMES.join(", ")}, hermes. Unknown --runtime "${runtime}". (claude-code/codex/openclaw write a per-runtime paired slot; hermes writes the global ~/.kojee/config.json.)`,
+      exitCode: 2
+    };
+  }
+  const url = (opts.url ?? DEFAULT_BROKER_URL).replace(/\/+$/, "");
+  const configPath = absConfigPath(runtime);
+  const oldConfig = loadPairedConfig(configPath);
+  const reconcile = reconcileConnectPairSlot(runtime, opts.code);
+  if (!reconcile.ok) {
+    return { messages, output: reconcile.output, exitCode: reconcile.exitCode };
+  }
+  messages.push(...reconcile.messages);
+  const pair = opts.runPair ?? runPair;
+  try {
+    const r = await pair({
+      code: opts.code,
+      url,
+      keystorePath: deriveKeystorePath(opts.code),
+      configPath,
+      runtime,
+      allowOverwrite: true
+    });
+    messages.push(r.message);
+  } catch (err) {
+    return { messages, output: `Connect failed while pairing: ${err.message}`, exitCode: 1 };
+  }
+  const wizard = opts.runWizard ?? runWizard;
+  const wiz = await wizard({ runtime, pairedConfigPath: configPath, interactive: false });
+  if (wiz.exitCode !== 0) {
+    return { messages, output: wiz.output, exitCode: wiz.exitCode };
+  }
+  const newConfig = loadPairedConfig(configPath);
+  const newLabel = identityLabel(newConfig);
+  const summary = oldConfig ? `\u21BB re-connected ${runtime} as ${newLabel} (was ${identityLabel(oldConfig)})` : `\u2713 connected ${runtime} as ${newLabel} \u2192 ${url}`;
+  const output = `${summary}
+Restart ${runtime} to pick up the connection.`;
+  return { messages, output, exitCode: 0 };
+}
+async function runConnectHermes(opts) {
+  const messages = [];
+  const url = (opts.url ?? DEFAULT_BROKER_URL).replace(/\/+$/, "");
+  const configPath = pairedConfigPath();
+  const oldConfig = loadPairedConfig(configPath);
+  const guard = reconcileConnectPairSlot("hermes", opts.code);
+  if (!guard.ok) {
+    return { messages, output: guard.output, exitCode: guard.exitCode };
+  }
+  messages.push(...guard.messages);
+  const pair = opts.runPair ?? runPair;
+  try {
+    const r = await pair({
+      code: opts.code,
+      url,
+      keystorePath: defaultPairedKeystorePath(),
+      configPath,
+      runtime: "hermes",
+      allowOverwrite: true
+      // connect is idempotent
+    });
+    messages.push(r.message);
+  } catch (err) {
+    return { messages, output: `Connect failed while pairing: ${err.message}`, exitCode: 1 };
+  }
+  const wizard = opts.runWizard ?? runWizard;
+  const wiz = await wizard({ runtime: "hermes", interactive: false });
+  if (wiz.exitCode !== 0) {
+    return { messages, output: wiz.output, exitCode: wiz.exitCode };
+  }
+  const label = identityLabel(loadPairedConfig(configPath));
+  const summary = oldConfig ? `\u21BB re-connected hermes as ${label}` : `\u2713 connected hermes as ${label} \u2192 ${url}`;
+  return {
+    messages,
+    output: `${summary}
+Start (or restart) the hermes daemon to pick up the connection.`,
+    exitCode: 0
+  };
+}
+export {
+  runConnect,
+  runConnectHermes
+};

package/dist/{control-token-4BUCTYQB.js → control-token-KXSZ3GBY.js}

@@ -3,8 +3,8 @@ import {
   controlTokenPath,
   issueControlToken,
   loadControlToken
-} from "./chunk-GI2CKKBL.js";
-import "./chunk-BLEGIR35.js";
+} from "./chunk-GKXHKR3B.js";
+import "./chunk-U5HHHRXA.js";
 export {
   controlTokenAuthHeaders,
   controlTokenPath,