kojee-mcp 0.6.0 → 0.7.0

package/dist/{doctor-WVX3WCYX.js → doctor-PLKLHTJM.js}

@@ -1,28 +1,31 @@
 import "./chunk-XLKGPGZT.js";
+import {
+  loadControlToken
+} from "./chunk-GKXHKR3B.js";
 import {
   monitorHeartbeatPath,
   statusLogPath
-} from "./chunk-DURRQDYI.js";
+} from "./chunk-TNZITJAB.js";
 import {
   discoveryPathForKey,
   readSessionDiscoveryByKey,
   sessionDiscoveryDir
-} from "./chunk-DO42NPNR.js";
-import {
-  loadControlToken
-} from "./chunk-GI2CKKBL.js";
+} from "./chunk-67F67AQ6.js";
 import {
   loadPairedConfig
-} from "./chunk-YH27B6SW.js";
-import "./chunk-BLEGIR35.js";
+} from "./chunk-5SZHXYPK.js";
+import "./chunk-U5HHHRXA.js";
 import {
   buildMonitorSpawn,
   buildReplyRecipe
-} from "./chunk-Q7T3WAST.js";
+} from "./chunk-QEJUNP3X.js";
 import {
   deriveDiscoveryKey,
   findClaudeAncestorPid
-} from "./chunk-VHKPWUX7.js";
+} from "./chunk-XJEBJIQE.js";
+import {
+  resolveSharedSessionId
+} from "./chunk-KNEJTD6G.js";
 
 // src/doctor.ts
 import fs from "fs";
@@ -95,7 +98,8 @@ function defaultIsPidAlive(pid) {
     process.kill(pid, 0);
     return true;
   } catch (err) {
-    if (err.code === "EPERM") return true;
+    const code = err.code;
+    if (code === "EPERM" || code === "EACCES") return true;
     return false;
   }
 }
@@ -132,6 +136,19 @@ function defaultReadLastStatusLine(path2) {
     }
   }
 }
+async function resolveDefaultPairedScope() {
+  const { resolvePairedSlot } = await import("./resolve-slot-BFIB46Y5.js");
+  const { readRecordedRuntime } = await import("./runtime-record-OXRLTOLC.js");
+  const { deriveKeystorePath } = await import("./keystore-LQNFDHGO.js");
+  const runtime = readRecordedRuntime() ?? process.env["KOJEE_RUNTIME"];
+  const resolution = resolvePairedSlot({ ...runtime ? { runtime } : {} });
+  const cfg = loadPairedConfig(resolution.configPath);
+  let present = cfg !== null && typeof cfg.token === "string" && cfg.token !== "";
+  if (present && resolution.scope === "paired" && cfg) {
+    present = fs.existsSync(deriveKeystorePath(cfg.token));
+  }
+  return { scope: resolution.scope, present, ...runtime ? { runtime } : {} };
+}
 async function collectDoctorReport(deps = {}) {
   const fetchFn = deps.fetchFn ?? fetch;
   const isPidAlive = deps.isPidAlive ?? defaultIsPidAlive;
@@ -140,23 +157,32 @@ async function collectDoctorReport(deps = {}) {
   const readDiscovery = deps.readDiscovery ?? readSessionDiscoveryByKey;
   const projectDir = deps.projectDir ?? process.env["CLAUDE_PROJECT_DIR"];
   const ccPid = deps.ccPid !== void 0 ? deps.ccPid : await findClaudeAncestorPid();
-  const discoveryKey = deriveDiscoveryKey(projectDir, ccPid);
+  const sessionId = deps.sessionId !== void 0 ? deps.sessionId : resolveSharedSessionId();
+  const discoveryKey = deriveDiscoveryKey(projectDir, ccPid, sessionId);
   const discoveryPath = discoveryPathForKey(discoveryKey);
   const checks = [];
   const discovery = readDiscovery(discoveryKey);
   const tokenMode = discovery?.authMode === "token";
-  const paired = deps.pairedConfigPresent !== void 0 ? deps.pairedConfigPresent : loadPairedConfig() !== null;
-  checks.push(
-    tokenMode ? {
+  const pairedScope = deps.pairedScope ?? (deps.pairedConfigPresent !== void 0 ? { scope: "legacy", present: deps.pairedConfigPresent } : await resolveDefaultPairedScope());
+  if (tokenMode) {
+    checks.push({
       name: "paired config",
       ok: true,
       detail: "n/a (token mode) \u2014 proxy launched with --token; no ~/.kojee/config.json by design"
-    } : {
+    });
+  } else if (pairedScope.scope === "paired") {
+    checks.push({
       name: "paired config",
-      ok: paired,
-      detail: paired ? "present" : "MISSING \u2014 run `kojee-mcp pair <code> --url <broker>`"
-    }
-  );
+      ok: pairedScope.present,
+      detail: pairedScope.present ? `present (per-runtime: ${pairedScope.runtime ?? "?"}) + token-derived keystore` : `MISSING per-runtime slot for ${pairedScope.runtime ?? "?"} \u2014 run \`kojee-mcp connect <code> --runtime ${pairedScope.runtime ?? "<id>"}\``
+    });
+  } else {
+    checks.push({
+      name: "paired config",
+      ok: pairedScope.present,
+      detail: pairedScope.present ? "present (legacy global slot)" : "MISSING \u2014 run `kojee-mcp connect <code> --runtime <id>` (or `kojee-mcp pair`)"
+    });
+  }
   let logPath = null;
   if (!discovery) {
     checks.push({
@@ -326,15 +352,15 @@ function formatDoctorReport(report) {
   return lines.join("\n");
 }
 async function runDoctor() {
-  const { readRecordedRuntime } = await import("./runtime-record-WO4IECM6.js");
+  const { readRecordedRuntime } = await import("./runtime-record-OXRLTOLC.js");
   if (readRecordedRuntime() === "codex") {
-    const { collectCodexDoctorReport, formatCodexDoctorReport } = await import("./doctor-codex-Z5M4SFBG.js");
+    const { collectCodexDoctorReport, formatCodexDoctorReport } = await import("./doctor-codex-HARAAH4Y.js");
     const report2 = collectCodexDoctorReport();
     console.error(formatCodexDoctorReport(report2));
     return report2.verdict === "broken" ? 1 : 0;
   }
   if (readRecordedRuntime() === "openclaw") {
-    const { collectOpenclawDoctorReport, formatOpenclawDoctorReport } = await import("./doctor-openclaw-SS2TMQOX.js");
+    const { collectOpenclawDoctorReport, formatOpenclawDoctorReport } = await import("./doctor-openclaw-LL6NSPLC.js");
     const report2 = collectOpenclawDoctorReport();
     console.error(formatOpenclawDoctorReport(report2));
     return report2.verdict === "broken" ? 1 : 0;

package/dist/{doctor-codex-Z5M4SFBG.js → doctor-codex-HARAAH4Y.js}

@@ -1,15 +1,17 @@
 import {
   defaultCodexConfigPath,
   defaultCodexHooksPath
-} from "./chunk-65KRRDHP.js";
+} from "./chunk-OBIJ6WQP.js";
+import "./chunk-QJFMU4QC.js";
+import "./chunk-D6JKFJ6A.js";
 import "./chunk-SQL56SEB.js";
 import {
   resolveWebhookConfig
 } from "./chunk-V5VZPYMZ.js";
-import "./chunk-BLEGIR35.js";
+import "./chunk-U5HHHRXA.js";
 import {
   CODEX_LISTEN_CAP_MS
-} from "./chunk-Q7T3WAST.js";
+} from "./chunk-QEJUNP3X.js";
 
 // src/doctor-codex.ts
 import fs from "fs";
@@ -39,6 +41,10 @@ function parseCodexEnvFromToml(toml) {
   return env;
 }
 var WIZARD_RERUN = "re-run `kojee-mcp init --runtime codex`";
+function extractPairedConfigPath(toml) {
+  const m = toml.match(/args\s*=\s*\[[^\]]*"--paired-config"\s*,\s*"([^"]+)"/);
+  return m ? m[1].replace(/\\\\/g, "\\") : null;
+}
 function defaultReadFile(path) {
   return () => {
     try {
@@ -100,8 +106,17 @@ function collectCodexDoctorReport(deps = {}) {
   } else {
     checks.push({
       name: "webhook sink",
-      ok: false,
-      detail: `not configured (no KOJEE_WEBHOOK_URL) \u2014 ${WIZARD_RERUN}`
+      ok: true,
+      detail: "optional \u2014 OFF (no KOJEE_WEBHOOK_URL). Codex wake is self-contained: the proxy refreshes the stop-hook pending marker on every event. Configure a receiver only for an extra low-latency push path."
+    });
+  }
+  const pairedPath = extractPairedConfigPath(toml);
+  if (pairedPath) {
+    const present = fs.existsSync(pairedPath);
+    checks.push({
+      name: "paired-config slot",
+      ok: present,
+      detail: present ? `present \u2014 proxy launches with --paired-config ${pairedPath}` : `MISSING referenced config ${pairedPath} \u2014 re-run \`kojee-mcp connect <code> --runtime codex\``
     });
   }
   if (deps.pingReceiver) {
@@ -120,7 +135,9 @@ function formatCodexDoctorReport(report) {
   const lines = [];
   lines.push(`kojee-mcp doctor (codex) \u2014 verdict: ${report.verdict.toUpperCase()}`);
   lines.push("");
-  lines.push("  Wake mode: webhook-sink + stop-hook peek (Codex has no channel injection).");
+  lines.push(
+    "  Wake mode: self-contained (proxy-written pending marker) + stop-hook peek (Codex has no channel injection). Webhook OPTIONAL, never required."
+  );
   lines.push(`  Bounded-listen cap: ${CODEX_LISTEN_CAP_MS}ms (model picks listen vs drain vs ignore).`);
   lines.push("");
   for (const c of report.checks) {

package/dist/doctor-openclaw-LL6NSPLC.js

@@ -0,0 +1,86 @@
+import {
+  MCP_SERVER_NAME,
+  defaultOpenclawConfigPath
+} from "./chunk-E6WMFMM2.js";
+import "./chunk-D6JKFJ6A.js";
+import {
+  resolveOpenclawWakeTarget
+} from "./chunk-NE2F5CKS.js";
+import "./chunk-SQL56SEB.js";
+import {
+  loadPairedConfig,
+  pairedConfigPath,
+  perRuntimeConfigPath
+} from "./chunk-5SZHXYPK.js";
+import "./chunk-U5HHHRXA.js";
+
+// src/doctor-openclaw.ts
+import fs from "fs";
+var WIZARD_RERUN = "re-run `kojee-mcp connect <code> --runtime openclaw`";
+function readOpenclawConfig() {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(defaultOpenclawConfigPath(), "utf8"));
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function loadOpenclawPaired() {
+  const perRuntime = loadPairedConfig(perRuntimeConfigPath("openclaw"));
+  if (perRuntime?.token) return { config: perRuntime, source: "per-runtime" };
+  const global = loadPairedConfig(pairedConfigPath());
+  if (global?.token) return { config: global, source: "global" };
+  return null;
+}
+function collectOpenclawDoctorReport(deps = {}) {
+  const readConfig = deps.readConfig ?? readOpenclawConfig;
+  const resolveWake = deps.resolveWake ?? (() => resolveOpenclawWakeTarget());
+  const loadPaired = deps.loadPaired ?? loadOpenclawPaired;
+  const checks = [];
+  const cfg = readConfig();
+  const mcp = cfg.mcp && typeof cfg.mcp === "object" ? cfg.mcp : {};
+  const servers = mcp.servers && typeof mcp.servers === "object" ? mcp.servers : {};
+  const server = servers[MCP_SERVER_NAME] && typeof servers[MCP_SERVER_NAME] === "object" ? servers[MCP_SERVER_NAME] : null;
+  const args = server && Array.isArray(server.args) ? server.args : [];
+  const pairedConfigThreaded = args.includes("--paired-config");
+  checks.push({
+    name: `~/.openclaw/openclaw.json mcp.servers.${MCP_SERVER_NAME}`,
+    ok: server !== null,
+    detail: server ? pairedConfigThreaded ? "present \u2014 OpenClaw spawns kojee-mcp with --paired-config (per-runtime slot)" : "present (WARN: no --paired-config in args \u2014 the proxy will use the global slot)" : `MISSING mcp.servers.${MCP_SERVER_NAME} block \u2014 ${WIZARD_RERUN}`
+  });
+  const wake = resolveWake();
+  checks.push({
+    name: "hooks wake receiver",
+    ok: wake.ok,
+    detail: wake.ok ? `mounted \u2014 /wake target: ${wake.target.url} (Bearer hooks.token; token value never printed)` : `${wake.reason} \u2014 ${WIZARD_RERUN}`
+  });
+  const paired = loadPaired();
+  checks.push({
+    name: "gateway credential",
+    ok: paired !== null,
+    detail: paired ? `resolves \u2014 source: ${paired.source} paired slot (token value never printed)` : `NONE resolves (no ~/.kojee/agents/openclaw/config.json or ~/.kojee/config.json token) \u2014 ${WIZARD_RERUN}`
+  });
+  const verdict = checks.some((c) => c.ok === false) ? "broken" : checks.some((c) => c.ok === "warn") ? "degraded" : "healthy";
+  return { checks, verdict };
+}
+function formatOpenclawDoctorReport(report) {
+  const mark = (ok) => ok === true ? "\u2713" : ok === "warn" ? "\u26A0" : ok === "unknown" ? "?" : "\u2717";
+  const lines = [];
+  lines.push(`kojee-mcp doctor (openclaw) \u2014 verdict: ${report.verdict.toUpperCase()}`);
+  lines.push("");
+  lines.push("  Wake mode: OpenClaw MCP server + /hooks/wake injector.");
+  lines.push("  OpenClaw spawns kojee-mcp (mcp.servers.kojee); wakes arrive via POST <gateway>/hooks/wake.");
+  lines.push("");
+  for (const c of report.checks) {
+    lines.push(`  ${mark(c.ok)} ${c.name}: ${c.detail}`);
+  }
+  lines.push("");
+  lines.push(
+    "NOTE: live verification (gateway running, proxy spawned) is an owner step \u2014 start the OpenClaw gateway and send a Tandem message."
+  );
+  return lines.join("\n");
+}
+export {
+  collectOpenclawDoctorReport,
+  formatOpenclawDoctorReport
+};

package/dist/{event-log-HOBO3ECB.js → event-log-2NBJEIEP.js}

@@ -2,16 +2,18 @@ import {
   STATUS_LINE_PREFIX,
   monitorHeartbeatPath,
   nudgeSentinelPath,
+  resolveEventLogPath,
   startEventLog,
   statusLogPath,
   sweepStaleEventLogs
-} from "./chunk-DURRQDYI.js";
-import "./chunk-DO42NPNR.js";
-import "./chunk-BLEGIR35.js";
+} from "./chunk-TNZITJAB.js";
+import "./chunk-67F67AQ6.js";
+import "./chunk-U5HHHRXA.js";
 export {
   STATUS_LINE_PREFIX,
   monitorHeartbeatPath,
   nudgeSentinelPath,
+  resolveEventLogPath,
   startEventLog,
   statusLogPath,
   sweepStaleEventLogs

package/dist/{event-stream-SYBUJ5EH.js → event-stream-KRYWEYWO.js}

@@ -5,9 +5,11 @@ import {
   normalizeBackendEvent,
   sanitizeDisplayname,
   serializeCursorMap,
-  startEventStream
-} from "./chunk-XN3IC4B5.js";
-import "./chunk-NR4Y54OL.js";
+  startEventStream,
+  statusReason
+} from "./chunk-FSKGQ6GT.js";
+import "./chunk-Z5LPNJQ6.js";
+import "./chunk-MIEI4PLB.js";
 export {
   UNDICI_DEFAULT_BODY_TIMEOUT_MS,
   createAdaptiveWatchdog,
@@ -15,5 +17,6 @@ export {
   normalizeBackendEvent,
   sanitizeDisplayname,
   serializeCursorMap,
-  startEventStream
+  startEventStream,
+  statusReason
 };

package/dist/index.js

@@ -1,17 +1,19 @@
 import {
   listTandemIds,
   startProxy
-} from "./chunk-BYV7CWNY.js";
-import "./chunk-N35X22G7.js";
-import "./chunk-KH5YEJIM.js";
-import "./chunk-JXMVZEQ7.js";
-import "./chunk-NR4Y54OL.js";
-import "./chunk-CH32ELFX.js";
-import "./chunk-BLEGIR35.js";
-import "./chunk-ALZX3SGI.js";
-import "./chunk-Q7T3WAST.js";
+} from "./chunk-5H75AEZ2.js";
+import "./chunk-OB5T6P24.js";
+import "./chunk-247WFMCJ.js";
+import "./chunk-I67C2HYA.js";
+import "./chunk-Z5LPNJQ6.js";
+import "./chunk-MIEI4PLB.js";
+import "./chunk-6G6YYST6.js";
+import "./chunk-U5HHHRXA.js";
+import "./chunk-SGRVG4HW.js";
+import "./chunk-QEJUNP3X.js";
 import "./chunk-PPTKGWFF.js";
-import "./chunk-VHKPWUX7.js";
+import "./chunk-XJEBJIQE.js";
+import "./chunk-KNEJTD6G.js";
 export {
   listTandemIds,
   startProxy

package/dist/{install-LJY2CHKG.js → install-V7LSQCYZ.js}

@@ -1,6 +1,13 @@
+import {
+  buildHookCommand,
+  isKojeeHookCommand
+} from "./chunk-QJFMU4QC.js";
+import {
+  wrapNpxLauncher
+} from "./chunk-D6JKFJ6A.js";
 import {
   secureFile
-} from "./chunk-BLEGIR35.js";
+} from "./chunk-U5HHHRXA.js";
 
 // src/hooks/install.ts
 import fs from "fs";
@@ -27,8 +34,6 @@ function discoverInstallTargets() {
   }
   return targets;
 }
-var STOP_COMMAND = "npx -y kojee-mcp hook --type=stop";
-var UPS_COMMAND = "npx -y kojee-mcp hook --type=user-prompt-submit";
 var MCP_SERVER_CMD = "npx";
 var MCP_SERVER_ARGS = ["kojee-mcp"];
 var MCP_SERVER_ENV = { KOJEE_RUNTIME: "claude-code" };
@@ -54,14 +59,18 @@ function writeConfig(p, cfg) {
   fs.writeFileSync(p, JSON.stringify(cfg, null, 2), { mode: 384 });
   secureFile(p);
 }
-function hasKojeeEntry(arr, command) {
-  if (!arr) return false;
-  return arr.some((e) => e.hooks.some((h) => h.command === command));
-}
 function installHookEntry(cfg, event, command) {
   cfg.hooks ??= {};
   cfg.hooks[event] ??= [];
-  if (hasKojeeEntry(cfg.hooks[event], command)) return "already-installed";
+  for (const entry of cfg.hooks[event]) {
+    for (const h of entry.hooks) {
+      if (h.command === command) return "already-installed";
+      if (isKojeeHookCommand(h.command)) {
+        h.command = command;
+        return "updated";
+      }
+    }
+  }
   cfg.hooks[event].push({ hooks: [{ type: "command", command }] });
   return "added";
 }
@@ -73,7 +82,7 @@ function uninstallHookEntries(cfg) {
     if (!arr) continue;
     const before = arr.length;
     cfg.hooks[event] = arr.filter(
-      (entry) => !entry.hooks.some((h) => h.command.startsWith("npx -y kojee-mcp hook"))
+      (entry) => !entry.hooks.some((h) => isKojeeHookCommand(h.command))
     );
     if (cfg.hooks[event].length !== before) removed = true;
   }
@@ -82,8 +91,8 @@ function uninstallHookEntries(cfg) {
 function installHooks(opts = {}) {
   const p = opts.hooksPath ?? (opts.configPath ? deriveHooksPath(opts.configPath) : defaultHooksPath());
   const cfg = readConfig(p);
-  const stop = installHookEntry(cfg, "Stop", STOP_COMMAND);
-  const ups = installHookEntry(cfg, "UserPromptSubmit", UPS_COMMAND);
+  const stop = installHookEntry(cfg, "Stop", buildHookCommand("stop"));
+  const ups = installHookEntry(cfg, "UserPromptSubmit", buildHookCommand("user-prompt-submit"));
   writeConfig(p, cfg);
   return { stop, ups };
 }
@@ -98,26 +107,29 @@ function mcpServerArgs(opts) {
   if (opts.token && opts.url) {
     return [...MCP_SERVER_ARGS, "--token", opts.token, "--url", opts.url];
   }
+  if (opts.pairedConfigPath) {
+    return [...MCP_SERVER_ARGS, "--paired-config", opts.pairedConfigPath];
+  }
   return [...MCP_SERVER_ARGS];
 }
 function installMcpServer(opts = {}) {
   const p = opts.configPath ?? defaultConfigPath();
   const cfg = readConfig(p);
   cfg.mcpServers ??= {};
-  const args = mcpServerArgs(opts);
+  const { command, args } = wrapNpxLauncher(MCP_SERVER_CMD, mcpServerArgs(opts));
+  const env = { ...MCP_SERVER_ENV };
   const existing = cfg.mcpServers["kojee"];
   if (existing) {
-    const sameCommand = existing.command === MCP_SERVER_CMD;
+    const sameCommand = existing.command === command;
     const sameArgs = JSON.stringify(existing.args ?? []) === JSON.stringify(args);
-    const sameEnv = JSON.stringify(existing.env ?? {}) === JSON.stringify(MCP_SERVER_ENV);
+    const sameEnv = JSON.stringify(existing.env ?? {}) === JSON.stringify(env);
     if (sameCommand && sameArgs && sameEnv) return "already-installed";
-    return "preserved-different";
+    if (!opts.overwrite) return "preserved-different";
+    cfg.mcpServers["kojee"] = { ...existing, command, args, env };
+    writeConfig(p, cfg);
+    return "updated";
   }
-  cfg.mcpServers["kojee"] = {
-    command: MCP_SERVER_CMD,
-    args,
-    env: { ...MCP_SERVER_ENV }
-  };
+  cfg.mcpServers["kojee"] = { command, args, env };
   writeConfig(p, cfg);
   return "added";
 }
@@ -130,12 +142,13 @@ function uninstallMcpServer(opts = {}) {
   return true;
 }
 function runInit(opts = {}) {
-  const targets = opts.configPath ? [{
+  const discovered = opts.configPath ? [{
     kind: "cli",
     path: opts.configPath,
     exists: true,
     hooksPath: opts.hooksPath ?? deriveHooksPath(opts.configPath)
   }] : discoverInstallTargets();
+  const targets = opts.ensureCli ? discovered.map((t) => t.kind === "cli" ? { ...t, exists: true } : t) : discovered;
   const reports = [];
   for (const t of targets) {
     if (!t.exists) {
@@ -145,7 +158,9 @@ function runInit(opts = {}) {
     const mcpServer = installMcpServer({
       configPath: t.path,
       ...opts.token ? { token: opts.token } : {},
-      ...opts.url ? { url: opts.url } : {}
+      ...opts.url ? { url: opts.url } : {},
+      ...opts.pairedConfigPath ? { pairedConfigPath: opts.pairedConfigPath } : {},
+      ...opts.overwrite ? { overwrite: true } : {}
     });
     let stopHook;
     let upsHook;

package/dist/{keystore-XLEV3FL5.js → keystore-LQNFDHGO.js}

@@ -4,8 +4,8 @@ import {
   generateES256KeyPair,
   loadKeystore,
   saveKeystore
-} from "./chunk-CH32ELFX.js";
-import "./chunk-BLEGIR35.js";
+} from "./chunk-6G6YYST6.js";
+import "./chunk-U5HHHRXA.js";
 export {
   defaultPairedKeystorePath,
   deriveKeystorePath,

package/dist/lib.d.ts

@@ -129,13 +129,16 @@ interface PairedConfig {
     token: string;
     broker_url: string;
     paired_at: string;
+    /** Stamped at connect time; used by doctor + launch cross-check. */
+    runtime?: string;
     principal_id?: string;
     agent_id?: string;
 }
+/** Legacy global paired slot (fallback only). */
 declare function pairedConfigPath(): string;
 declare function loadPairedConfig(filePath?: string): PairedConfig | null;
 
-type Runtime = "claude-code" | "codex" | "unknown";
+type Runtime = "claude-code" | "codex" | "openclaw" | "unknown";
 
 /**
  * Per-harness adapter. Today: minimal — only what's needed for the

package/dist/lib.js

@@ -5,31 +5,34 @@ import {
   normalizeBackendEvent,
   sanitizeDisplayname,
   startEventStream
-} from "./chunk-XN3IC4B5.js";
+} from "./chunk-FSKGQ6GT.js";
 import {
   loadPairedConfig,
   pairedConfigPath
-} from "./chunk-YH27B6SW.js";
+} from "./chunk-5SZHXYPK.js";
 import {
   GatewayClient,
   applyStableSessionId
-} from "./chunk-KH5YEJIM.js";
+} from "./chunk-247WFMCJ.js";
 import {
   AuthModule
-} from "./chunk-JXMVZEQ7.js";
+} from "./chunk-I67C2HYA.js";
 import {
-  createDPoPProof,
   deriveStableSessionId
-} from "./chunk-NR4Y54OL.js";
+} from "./chunk-Z5LPNJQ6.js";
+import {
+  createDPoPProof
+} from "./chunk-MIEI4PLB.js";
 import {
   defaultPairedKeystorePath,
   deriveKeystorePath,
   generateES256KeyPair,
   loadKeystore,
   saveKeystore
-} from "./chunk-CH32ELFX.js";
-import "./chunk-BLEGIR35.js";
+} from "./chunk-6G6YYST6.js";
+import "./chunk-U5HHHRXA.js";
 import "./chunk-PPTKGWFF.js";
+import "./chunk-KNEJTD6G.js";
 export {
   AuthModule,
   GatewayClient,

package/dist/pair-HTCVSMR6.js

@@ -0,0 +1,11 @@
+import {
+  runPair
+} from "./chunk-EIAUW6KO.js";
+import "./chunk-5SZHXYPK.js";
+import "./chunk-I67C2HYA.js";
+import "./chunk-MIEI4PLB.js";
+import "./chunk-6G6YYST6.js";
+import "./chunk-U5HHHRXA.js";
+export {
+  runPair
+};

package/dist/{paired-config-JTFLHMZ2.js → paired-config-GUDDO2CH.js}

@@ -1,11 +1,13 @@
 import {
   loadPairedConfig,
   pairedConfigPath,
+  perRuntimeConfigPath,
   savePairedConfig
-} from "./chunk-YH27B6SW.js";
-import "./chunk-BLEGIR35.js";
+} from "./chunk-5SZHXYPK.js";
+import "./chunk-U5HHHRXA.js";
 export {
   loadPairedConfig,
   pairedConfigPath,
+  perRuntimeConfigPath,
   savePairedConfig
 };

package/dist/{parent-watchdog-TLU355FB.js → parent-watchdog-LTUNF7PD.js}

@@ -1,14 +1,19 @@
 import {
-  findClaudeAncestorPid
-} from "./chunk-VHKPWUX7.js";
+  findClaudeAncestorPid,
+  pidLooksLikeClaude
+} from "./chunk-XJEBJIQE.js";
 
 // src/runtime/parent-watchdog.ts
+function shouldArmWatchdog(ccPid) {
+  return ccPid !== null;
+}
 function defaultIsPidAlive(pid) {
   try {
     process.kill(pid, 0);
     return true;
   } catch (err) {
-    if (err.code === "EPERM") return true;
+    const code = err.code;
+    if (code === "EPERM" || code === "EACCES") return true;
     return false;
   }
 }
@@ -16,9 +21,12 @@ function createParentWatchdog(opts) {
   const intervalMs = opts.intervalMs ?? 7e3;
   const isPidAlive = opts.isPidAlive ?? defaultIsPidAlive;
   const resolveAncestor = opts.resolveAncestor ?? (() => findClaudeAncestorPid());
+  const verifyPidIdentity = opts.verifyPidIdentity ?? pidLooksLikeClaude;
+  const identityCheckEveryNTicks = opts.identityCheckEveryNTicks ?? 4;
   let timer = null;
   let fired = false;
   let checking = false;
+  let tick = 0;
   function stop() {
     if (timer !== null) {
       clearInterval(timer);
@@ -30,7 +38,17 @@ function createParentWatchdog(opts) {
     checking = true;
     try {
       const ccPidAlive = isPidAlive(opts.ccPid);
-      if (ccPidAlive) return;
+      if (ccPidAlive) {
+        tick++;
+        if (tick % identityCheckEveryNTicks !== 0) return;
+        let identity = null;
+        try {
+          identity = await verifyPidIdentity(opts.ccPid);
+        } catch {
+          identity = null;
+        }
+        if (identity !== false) return;
+      }
       let ancestor = null;
       try {
         ancestor = await resolveAncestor();
@@ -61,5 +79,6 @@ function createParentWatchdog(opts) {
 }
 export {
   createParentWatchdog,
-  defaultIsPidAlive
+  defaultIsPidAlive,
+  shouldArmWatchdog
 };