kojee-mcp 0.6.0 → 0.7.1

package/README.md

@@ -162,8 +162,9 @@ npx kojee-mcp init --runtime claude-code --token gw_abc... --url https://rosie-s
 npx kojee-mcp init --runtime codex --webhook-url https://your-receiver/kojee
                                          # Codex: writes ~/.codex/config.toml + a codex-stop hook
 npx kojee-mcp init --runtime hermes  --webhook-url https://your-receiver/kojee
-npx kojee-mcp init --runtime openclaw --webhook-url https://your-receiver/kojee
-                                         # daemon runtimes: print/record the webhook-sink env to export
+                                         # hermes daemon: print/record the webhook-sink env to export
+npx kojee-mcp connect ABCD-1234 --runtime openclaw
+                                         # OpenClaw: writes mcp.servers.kojee + hooks into ~/.openclaw/openclaw.json
 ```
 
 Auth flags (all runtimes): `--token <gw_…>` + `--url <broker>` (token mode), or
@@ -180,12 +181,16 @@ Per-runtime config-path / hooks-path overrides: `--config-path`, `--hooks-path`.
   one. Codex has no Claude-style channel injection, so its wake is the **webhook
   sink + a stop-hook fast PEEK + a model-chosen bounded `tandem_listen` (cap 8s,
   never a blanket long-poll)**. See `docs/RUNTIMES.md`.
-- **hermes / openclaw** — these runtimes have **native channel plugins** (see
-  [Native gateway runtimes](#native-gateway-runtimes-openclaw--hermes)). When you
-  instead run the proxy as a **daemon** feeding a webhook receiver, `init --runtime
-  hermes|openclaw` writes no MCP-config/hooks of ours, validates the webhook env,
-  and prints + records the env to export (secret redacted) into a source-able
-  `~/.kojee/<runtime>.env`.
+- **openclaw** — `connect --runtime openclaw` writes `mcp.servers.kojee` (OpenClaw
+  spawns kojee-mcp AS its MCP server, threading the per-runtime paired slot via
+  `--paired-config`) **and** enables the gateway `hooks` (`hooks.enabled=true` +
+  a `hooks.token`) into `~/.openclaw/openclaw.json`. Wake is a POST to
+  `<gateway>/hooks/wake` (Bearer `hooks.token`) from the openclaw `WakeDelivery`
+  injector — no webhook receiver, no `--webhook-url`.
+- **hermes** — a **daemon** feeding a webhook receiver. `init --runtime hermes`
+  (or `connect --runtime hermes`) validates the webhook env and prints + records
+  the env to export (secret redacted) into a source-able `~/.kojee/hermes.env`.
+  `--webhook-url` is optional (defaults to the hermes-plugin loopback receiver).
 
 `kojee-mcp init --uninstall` is runtime-aware (uses the recorded runtime when
 `--runtime` is omitted). `kojee-mcp doctor` is runtime-aware too.

package/dist/ancestry-A2F5KQ6A.js

@@ -0,0 +1,10 @@
+import {
+  deriveDiscoveryKey,
+  findClaudeAncestorPid,
+  pidLooksLikeClaude
+} from "./chunk-XJEBJIQE.js";
+export {
+  deriveDiscoveryKey,
+  findClaudeAncestorPid,
+  pidLooksLikeClaude
+};

package/dist/cc-session-id-RURNIHHC.js

@@ -0,0 +1,10 @@
+import {
+  SESSION_ID_ENV_VARS,
+  resolveInstanceKey,
+  resolveSharedSessionId
+} from "./chunk-KNEJTD6G.js";
+export {
+  SESSION_ID_ENV_VARS,
+  resolveInstanceKey,
+  resolveSharedSessionId
+};

package/dist/{chunk-KH5YEJIM.js → chunk-247WFMCJ.js}

@@ -1,14 +1,19 @@
 import {
-  createDPoPProof,
   deriveStableSessionId,
   getSessionId,
   setStableSessionId
-} from "./chunk-NR4Y54OL.js";
+} from "./chunk-Z5LPNJQ6.js";
+import {
+  createDPoPProof
+} from "./chunk-MIEI4PLB.js";
 import {
   translateHttpError,
   translateJsonRpcError,
   translateNetworkError
 } from "./chunk-PPTKGWFF.js";
+import {
+  resolveInstanceKey
+} from "./chunk-KNEJTD6G.js";
 
 // src/gateway-client.ts
 import crypto from "crypto";
@@ -189,24 +194,6 @@ var GatewayClient = class {
   }
 };
 
-// src/runtime/cc-session-id.ts
-import { randomUUID } from "crypto";
-var SESSION_ID_ENV_VARS = ["CLAUDE_CODE_SESSION_ID"];
-function sanitizeKey(value) {
-  return value.replace(/[^A-Za-z0-9_-]/g, "");
-}
-function resolveInstanceKey(deps = {}) {
-  const env = deps.env ?? process.env;
-  for (const name of SESSION_ID_ENV_VARS) {
-    const sid = sanitizeKey((env[name] ?? "").trim());
-    if (sid) return sid;
-  }
-  const explicit = sanitizeKey((env.KOJEE_INSTANCE ?? "").trim());
-  if (explicit) return `inst-${explicit}`;
-  const mint = deps.randomUUID ?? randomUUID;
-  return `mint-${mint()}`;
-}
-
 // src/runtime/stable-session.ts
 async function applyStableSessionId(token, deps = {}) {
   let instanceKey = deps.instanceKey;

package/dist/chunk-5DHIUN73.js

@@ -0,0 +1,25 @@
+// src/version.ts
+import fs from "fs";
+import path from "path";
+import { fileURLToPath } from "url";
+var FALLBACK_VERSION = "0.0.0-unknown";
+function resolveVersion() {
+  try {
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    const parsed = JSON.parse(
+      fs.readFileSync(path.join(here, "..", "package.json"), "utf8")
+    );
+    return typeof parsed?.version === "string" && parsed.version ? parsed.version : FALLBACK_VERSION;
+  } catch (err) {
+    process.stderr.write(
+      `kojee-mcp: could not resolve version from package.json, falling back to ${FALLBACK_VERSION}: ${String(err)}
+`
+    );
+    return FALLBACK_VERSION;
+  }
+}
+var VERSION = resolveVersion();
+
+export {
+  VERSION
+};

package/dist/{chunk-YH27B6SW.js → chunk-5SZHXYPK.js}

@@ -1,7 +1,9 @@
 import {
+  createSecureFileSync,
+  renameSyncRetry,
   secureDir,
   secureFile
-} from "./chunk-BLEGIR35.js";
+} from "./chunk-U5HHHRXA.js";
 
 // src/auth/paired-config.ts
 import fs from "fs";
@@ -10,6 +12,9 @@ import path from "path";
 function pairedConfigPath() {
   return path.join(os.homedir(), ".kojee", "config.json");
 }
+function perRuntimeConfigPath(runtime) {
+  return path.join(os.homedir(), ".kojee", "agents", runtime, "config.json");
+}
 function loadPairedConfig(filePath = pairedConfigPath()) {
   try {
     const raw = fs.readFileSync(filePath, "utf8");
@@ -21,13 +26,21 @@ function loadPairedConfig(filePath = pairedConfigPath()) {
 function savePairedConfig(filePath, config) {
   const dir = path.dirname(filePath);
   fs.mkdirSync(dir, { recursive: true, mode: 448 });
+  const kojeeRoot = path.join(os.homedir(), ".kojee");
+  if (fs.existsSync(kojeeRoot)) secureDir(kojeeRoot);
+  const agentsRoot = path.join(kojeeRoot, "agents");
+  if (fs.existsSync(agentsRoot)) secureDir(agentsRoot);
   secureDir(dir);
-  fs.writeFileSync(filePath, JSON.stringify(config, null, 2), { mode: 384 });
-  secureFile(filePath);
+  const tmp = filePath + ".tmp";
+  createSecureFileSync(tmp);
+  fs.writeFileSync(tmp, JSON.stringify(config, null, 2), { mode: 384 });
+  secureFile(tmp);
+  renameSyncRetry(tmp, filePath);
 }
 
 export {
   pairedConfigPath,
+  perRuntimeConfigPath,
   loadPairedConfig,
   savePairedConfig
 };

package/dist/{chunk-DO42NPNR.js → chunk-67F67AQ6.js}

@@ -1,7 +1,7 @@
 import {
   secureDir,
   secureFile
-} from "./chunk-BLEGIR35.js";
+} from "./chunk-U5HHHRXA.js";
 
 // src/tandem/session-discovery.ts
 import fs from "fs";
@@ -50,8 +50,18 @@ function writeDiscoveryByKey(key, entry) {
   secureFile(filePath);
 }
 function cleanupDiscoveryByKey(key) {
+  const filePath = discoveryPathForKey(key);
+  try {
+    const raw = fs.readFileSync(filePath, "utf8");
+    const data = JSON.parse(raw);
+    const owner = data.proxyPid ?? data.pid;
+    if (typeof owner === "number" && owner !== process.pid && isProcessAlive(owner)) {
+      return;
+    }
+  } catch {
+  }
   try {
-    fs.unlinkSync(discoveryPathForKey(key));
+    fs.unlinkSync(filePath);
   } catch {
   }
 }
@@ -69,7 +79,8 @@ function isProcessAlive(pid) {
     process.kill(pid, 0);
     return true;
   } catch (err) {
-    if (err.code === "EPERM") return true;
+    const code = err.code;
+    if (code === "EPERM" || code === "EACCES") return true;
     return false;
   }
 }

package/dist/{chunk-CH32ELFX.js → chunk-6G6YYST6.js}

@@ -1,7 +1,7 @@
 import {
   secureDir,
   secureFile
-} from "./chunk-BLEGIR35.js";
+} from "./chunk-U5HHHRXA.js";
 
 // src/auth/keystore.ts
 import { importJWK, exportJWK, generateKeyPair } from "jose";

package/dist/chunk-D6JKFJ6A.js

@@ -0,0 +1,11 @@
+// src/runtime/npx-launcher.ts
+function wrapNpxLauncher(command, args) {
+  if (process.platform === "win32" && command === "npx") {
+    return { command: "cmd", args: ["/c", "npx", ...args] };
+  }
+  return { command, args };
+}
+
+export {
+  wrapNpxLauncher
+};

package/dist/chunk-E6WMFMM2.js

@@ -0,0 +1,100 @@
+import {
+  wrapNpxLauncher
+} from "./chunk-D6JKFJ6A.js";
+import {
+  kojeeHomeDir
+} from "./chunk-SQL56SEB.js";
+import {
+  secureFile
+} from "./chunk-U5HHHRXA.js";
+
+// src/wizard/capabilities/openclaw-mcp-config.ts
+import crypto from "crypto";
+import fs from "fs";
+import path from "path";
+import os from "os";
+function defaultOpenclawConfigPath() {
+  const p = path.join(kojeeHomeDir(), ".openclaw", "openclaw.json");
+  if (process.platform === "win32" && !/^[a-zA-Z]:/.test(p)) {
+    return path.win32.resolve(path.win32.join(os.homedir(), ".openclaw", "openclaw.json"));
+  }
+  return p;
+}
+var MCP_SERVER_NAME = "kojee";
+function buildKojeeMcpBlock(configPath, pairedConfigPath) {
+  const base = ["-y", "kojee-mcp", ...pairedConfigPath ? ["--paired-config", pairedConfigPath] : []];
+  const { command, args } = wrapNpxLauncher("npx", base);
+  return { command, args, env: { KOJEE_RUNTIME: "openclaw", KOJEE_OPENCLAW_CONFIG: configPath } };
+}
+function readState(configPath) {
+  let raw;
+  try {
+    raw = fs.readFileSync(configPath, "utf8");
+  } catch {
+    return { cfg: {}, unparseable: false };
+  }
+  try {
+    const p = JSON.parse(raw);
+    return { cfg: p && typeof p === "object" ? p : {}, unparseable: false };
+  } catch {
+    return { cfg: {}, unparseable: true };
+  }
+}
+function atomicWrite(filePath, content) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  const tmp = `${filePath}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`;
+  fs.writeFileSync(tmp, content, { mode: 384 });
+  secureFile(tmp);
+  fs.renameSync(tmp, filePath);
+  secureFile(filePath);
+}
+function writeOpenclawMcpConfig(configPath, opts) {
+  const { cfg, unparseable } = readState(configPath);
+  let backedUp;
+  if (unparseable) {
+    const stamp = (opts.now ? opts.now() : /* @__PURE__ */ new Date()).toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
+    backedUp = `${configPath}.corrupt-${stamp}`;
+    fs.copyFileSync(configPath, backedUp);
+    secureFile(backedUp);
+  }
+  const next = { ...cfg };
+  const prevMcp = next.mcp && typeof next.mcp === "object" ? next.mcp : {};
+  const prevServers = prevMcp.servers && typeof prevMcp.servers === "object" ? prevMcp.servers : {};
+  next.mcp = {
+    ...prevMcp,
+    servers: { ...prevServers, [MCP_SERVER_NAME]: buildKojeeMcpBlock(configPath, opts.pairedConfigPath) }
+  };
+  const prevHooks = next.hooks && typeof next.hooks === "object" ? next.hooks : {};
+  const existingToken = typeof prevHooks.token === "string" && prevHooks.token.trim() ? prevHooks.token.trim() : "";
+  const hooksTokenGenerated = existingToken === "";
+  const wakeToken = existingToken || crypto.randomBytes(32).toString("hex");
+  next.hooks = { ...prevHooks, enabled: true, token: wakeToken };
+  atomicWrite(configPath, JSON.stringify(next, null, 2) + "\n");
+  return { hooksTokenGenerated, wakeToken, ...backedUp ? { backedUp } : {} };
+}
+function removeOpenclawMcpServer(configPath) {
+  const { cfg, unparseable } = readState(configPath);
+  if (unparseable) return false;
+  const mcp = cfg.mcp;
+  const servers = mcp?.servers;
+  if (!servers || !(MCP_SERVER_NAME in servers)) return false;
+  const { [MCP_SERVER_NAME]: _drop, ...restServers } = servers;
+  const next = { ...cfg };
+  if (Object.keys(restServers).length > 0) {
+    next.mcp = { ...mcp, servers: restServers };
+  } else {
+    const nextMcp = { ...mcp };
+    delete nextMcp.servers;
+    if (Object.keys(nextMcp).length > 0) next.mcp = nextMcp;
+    else delete next.mcp;
+  }
+  atomicWrite(configPath, JSON.stringify(next, null, 2) + "\n");
+  return true;
+}
+
+export {
+  defaultOpenclawConfigPath,
+  MCP_SERVER_NAME,
+  writeOpenclawMcpConfig,
+  removeOpenclawMcpServer
+};

package/dist/chunk-EBYUJM3H.js

@@ -0,0 +1,14 @@
+// src/hooks/codex-pending-path.ts
+import os from "os";
+import path from "path";
+function codexPendingMarkerPath() {
+  return path.join(os.homedir(), ".kojee", "codex-pending");
+}
+function codexPendingAckPath() {
+  return codexPendingMarkerPath() + ".ack";
+}
+
+export {
+  codexPendingMarkerPath,
+  codexPendingAckPath
+};

package/dist/chunk-EIAUW6KO.js

@@ -0,0 +1,82 @@
+import {
+  loadPairedConfig,
+  savePairedConfig
+} from "./chunk-5SZHXYPK.js";
+import {
+  AuthModule
+} from "./chunk-I67C2HYA.js";
+import {
+  createDPoPProof
+} from "./chunk-MIEI4PLB.js";
+import {
+  loadKeystore
+} from "./chunk-6G6YYST6.js";
+import {
+  renameSyncRetry
+} from "./chunk-U5HHHRXA.js";
+
+// src/tandem/pair.ts
+import fs from "fs";
+async function fetchDisplayIdentity(url, code, keystorePath) {
+  try {
+    const ks = await loadKeystore(keystorePath, url).catch(() => null);
+    if (!ks) return {};
+    const meUrl = `${url}/api/v1/users/me/`;
+    const doFetch = async (nonce) => {
+      const proof = await createDPoPProof(ks.privateKey, ks.kid, "GET", meUrl, nonce, code);
+      return fetch(meUrl, { headers: { Authorization: `DPoP ${code}`, DPoP: proof } });
+    };
+    let res = await doFetch();
+    if (res.status === 401) {
+      const nonce = res.headers.get("DPoP-Nonce");
+      if (nonce) res = await doFetch(nonce);
+    }
+    if (res.ok) {
+      const body = await res.json();
+      return {
+        ...body.principal_id ? { principal_id: body.principal_id } : {},
+        ...body.agent_id ? { agent_id: body.agent_id } : {}
+      };
+    }
+  } catch {
+  }
+  return {};
+}
+async function runPair(opts) {
+  if (!opts.allowOverwrite && loadPairedConfig(opts.configPath) !== null) {
+    throw new Error(
+      `Already paired (config exists at ${opts.configPath}). To re-pair this slot, delete the config file first. For a second account, use --keystore-path /custom/keypair.json.`
+    );
+  }
+  const existing = await loadKeystore(opts.keystorePath, opts.url).catch(() => null);
+  if (!existing) {
+    const tmpKeystore = `${opts.keystorePath}.tmp-${process.pid}`;
+    try {
+      fs.unlinkSync(tmpKeystore);
+    } catch {
+    }
+    const auth = new AuthModule(opts.code, opts.url, tmpKeystore);
+    await auth.ensureEnrolled();
+    renameSyncRetry(tmpKeystore, opts.keystorePath);
+  }
+  const { principal_id, agent_id } = await fetchDisplayIdentity(
+    opts.url,
+    opts.code,
+    opts.keystorePath
+  );
+  const config = {
+    token: opts.code,
+    broker_url: opts.url,
+    paired_at: (/* @__PURE__ */ new Date()).toISOString(),
+    ...opts.runtime ? { runtime: opts.runtime } : {},
+    ...principal_id ? { principal_id } : {},
+    ...agent_id ? { agent_id } : {}
+  };
+  savePairedConfig(opts.configPath, config);
+  const message = principal_id && agent_id ? `Paired as ${principal_id} (${agent_id}). Keypair: ${opts.keystorePath}. Config: ${opts.configPath}.` : `Paired. Keypair: ${opts.keystorePath}. Config: ${opts.configPath}.`;
+  return { message };
+}
+
+export {
+  runPair
+};

package/dist/chunk-EIH2LNF4.js

@@ -0,0 +1,45 @@
+import {
+  loadPairedConfig
+} from "./chunk-5SZHXYPK.js";
+import {
+  deriveKeystorePath
+} from "./chunk-6G6YYST6.js";
+
+// src/auth/resolve-slot.ts
+import fs from "fs";
+import os from "os";
+import path from "path";
+var CONNECT_RUNTIMES = ["claude-code", "codex", "openclaw"];
+function isConnectRuntime(v) {
+  return v !== void 0 && CONNECT_RUNTIMES.includes(v);
+}
+function resolvePairedSlot(opts) {
+  if (opts.pairedConfig) {
+    return { configPath: path.resolve(opts.pairedConfig), scope: "paired" };
+  }
+  const dir = opts.kojeeDir ?? path.join(os.homedir(), ".kojee");
+  if (isConnectRuntime(opts.runtime)) {
+    const perRuntime = path.join(dir, "agents", opts.runtime, "config.json");
+    if (fs.existsSync(perRuntime)) return { configPath: perRuntime, scope: "paired" };
+  }
+  return { configPath: path.join(dir, "config.json"), scope: "legacy" };
+}
+function resolveLaunchCreds(opts) {
+  const { configPath } = resolvePairedSlot({ pairedConfig: opts.pairedConfig });
+  const cfg = loadPairedConfig(configPath);
+  if (!cfg || typeof cfg.token !== "string" || cfg.token === "") {
+    return {
+      ok: false,
+      configPath,
+      error: `Not connected for this runtime (paired-config: ${configPath}) \u2014 run \`kojee-mcp connect <code> --runtime <id>\`.`
+    };
+  }
+  const url = (opts.url ?? cfg.broker_url).replace(/\/+$/, "");
+  return { ok: true, token: cfg.token, url, keystorePath: deriveKeystorePath(cfg.token), configPath };
+}
+
+export {
+  CONNECT_RUNTIMES,
+  resolvePairedSlot,
+  resolveLaunchCreds
+};

package/dist/{chunk-BYV7CWNY.js → chunk-FBJCPRVH.js}

@@ -1,20 +1,20 @@
 import {
   claudeCodeAdapter
-} from "./chunk-N35X22G7.js";
+} from "./chunk-UPJV7GBE.js";
 import {
   GatewayClient,
   applyStableSessionId
-} from "./chunk-KH5YEJIM.js";
+} from "./chunk-247WFMCJ.js";
 import {
   AuthModule
-} from "./chunk-JXMVZEQ7.js";
+} from "./chunk-I67C2HYA.js";
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-ALZX3SGI.js";
+} from "./chunk-GNLCUJBK.js";
 import {
   findClaudeAncestorPid
-} from "./chunk-VHKPWUX7.js";
+} from "./chunk-XJEBJIQE.js";
 
 // src/index.ts
 import fs from "fs";
@@ -93,6 +93,7 @@ import psList from "ps-list";
 async function detectRuntime(env = process.env) {
   if (env["KOJEE_RUNTIME"] === "claude-code") return "claude-code";
   if (env["KOJEE_RUNTIME"] === "codex") return "codex";
+  if (env["KOJEE_RUNTIME"] === "openclaw") return "openclaw";
   if (env["CLAUDE_CODE_SESSION_ID"]) return "claude-code";
   const ancestor = await detectRuntimeFromAncestry();
   if (ancestor) return ancestor;
@@ -132,6 +133,17 @@ var codexAdapter = {
   }
 };
 
+// src/adapters/openclaw.ts
+var openclawAdapter = {
+  runtime: "openclaw",
+  supportsChannels: false,
+  formatTandemEvent() {
+    throw new Error(
+      "openclawAdapter.formatTandemEvent() is unreachable \u2014 OpenClaw receives events via the /wake injector delivery, not channels; server.ts gates this on supportsChannels."
+    );
+  }
+};
+
 // src/adapters/unknown.ts
 var unknownAdapter = {
   runtime: "unknown",
@@ -155,6 +167,7 @@ async function selectAdapter() {
   const runtime = await detectRuntime();
   if (runtime === "claude-code") return claudeCodeAdapter;
   if (runtime === "codex") return codexAdapter;
+  if (runtime === "openclaw") return openclawAdapter;
   return unknownAdapter;
 }
 async function listTandemIds(gateway) {
@@ -238,7 +251,7 @@ async function startProxy(config) {
   }
   console.error(`[kojee-mcp] Tandem memberships: ${tandemMembershipCount === -1 ? "unknown" : tandemMembershipCount}`);
   let server;
-  const { selectDelivery } = await import("./registry-YLOFZDI2.js");
+  const { selectDelivery } = await import("./registry-ZZZ26WGA.js");
   const delivery = selectDelivery(adapter.runtime, {
     supportsChannels: adapter.supportsChannels
   });
@@ -274,8 +287,8 @@ async function startProxy(config) {
   process.on("SIGHUP", () => shutdown("SIGHUP"));
   process.on("SIGINT", () => shutdown("SIGINT"));
   process.on("SIGTERM", () => shutdown("SIGTERM"));
-  if (ccPid !== null) {
-    const { createParentWatchdog } = await import("./parent-watchdog-TLU355FB.js");
+  const { createParentWatchdog, shouldArmWatchdog } = await import("./parent-watchdog-LTUNF7PD.js");
+  if (shouldArmWatchdog(ccPid)) {
     const watchdog = createParentWatchdog({
       ccPid,
       onParentGone: () => shutdown("parent (Claude Code) gone")
@@ -284,7 +297,7 @@ async function startProxy(config) {
     teardownSteps.push(() => watchdog.stop());
   } else {
     console.error(
-      "[kojee-mcp] no Claude Code ancestor found \u2014 parent-liveness watchdog NOT armed (stdin/signal handlers still cover clean exits)"
+      "[kojee-mcp] no resolvable Claude ancestor (Windows fallback) \u2014 parent-liveness watchdog not armed; stdin close/end + SIGHUP/SIGINT/SIGTERM cover shutdown, and per-window wake is preserved via the session-id discovery key."
     );
   }
   await startMcpServer(server);

package/dist/{chunk-XN3IC4B5.js → chunk-FSKGQ6GT.js}

@@ -1,7 +1,9 @@
 import {
-  createDPoPProof,
   getSessionId
-} from "./chunk-NR4Y54OL.js";
+} from "./chunk-Z5LPNJQ6.js";
+import {
+  createDPoPProof
+} from "./chunk-MIEI4PLB.js";
 
 // src/tandem/event-stream.ts
 import { Agent } from "undici";
@@ -116,7 +118,13 @@ async function startEventStream(opts) {
         if (!opened && stopped) return;
       } catch (err) {
         if (stopped) return;
-        console.error("[event-stream] disconnect:", err.message);
+        console.error(
+          "[event-stream] disconnect:",
+          err?.message,
+          // Node/undici stash the real transport error here (errno/TLS); the
+          // top-level message is a generic "fetch failed" that drops it.
+          err?.cause ?? ""
+        );
         state.connected = false;
         await emitStatus(opts, `status=disconnected reason=${statusReason(err)}`);
       }
@@ -300,8 +308,24 @@ async function emitStatus(opts, fields) {
   }
 }
 function statusReason(err) {
-  const msg = err?.message ?? String(err);
-  return msg.replace(/\s+/g, "_").slice(0, 60);
+  const sanitize = (s) => s.replace(/\s+/g, "_");
+  const base = sanitize(err?.message ?? String(err));
+  const cause = err?.cause;
+  let token = base;
+  if (cause != null) {
+    let causePart;
+    if (typeof cause === "string") {
+      causePart = cause;
+    } else {
+      const code = cause.code;
+      const message = cause.message;
+      if (typeof code === "string" && code) causePart = code;
+      else if (typeof message === "string" && message) causePart = message;
+      else causePart = String(cause);
+    }
+    token = `${base}:${sanitize(causePart)}`;
+  }
+  return token.slice(0, 80);
 }
 function serializeCursorMap(cursors) {
   return [...cursors.entries()].map(([tandemId, cursor]) => `${tandemId}:${cursor}`).join(",");
@@ -423,6 +447,7 @@ export {
   createAdaptiveWatchdog,
   createBackoffController,
   startEventStream,
+  statusReason,
   serializeCursorMap,
   sanitizeDisplayname,
   normalizeBackendEvent

package/dist/{chunk-GI2CKKBL.js → chunk-GKXHKR3B.js}

@@ -1,7 +1,7 @@
 import {
   secureDir,
   secureFile
-} from "./chunk-BLEGIR35.js";
+} from "./chunk-U5HHHRXA.js";
 
 // src/tandem/control-token.ts
 import crypto from "crypto";