kojee-mcp 0.6.0 → 0.7.1

package/dist/{setup-handler-7HOFAD7C.js → chunk-UFHGZUST.js}

@@ -1,19 +1,22 @@
 import {
-  clearRuntimeRecord,
-  readRecordedRuntime,
-  recordRuntime
-} from "./chunk-EW72ZNQL.js";
+  removeOpenclawMcpServer,
+  writeOpenclawMcpConfig
+} from "./chunk-E6WMFMM2.js";
 import {
   buildCodexMcpServerTable,
   buildCodexStopHookBlock,
+  isPlaceholderWebhookUrl,
   removeCodexConfig,
   writeCodexConfig
-} from "./chunk-65KRRDHP.js";
+} from "./chunk-KPMD72FY.js";
 import {
-  CHANNEL_ID,
-  removeOpenclawChannel,
-  writeOpenclawChannelConfig
-} from "./chunk-CLKCNV2A.js";
+  CONNECT_RUNTIMES
+} from "./chunk-EIH2LNF4.js";
+import {
+  clearRuntimeRecord,
+  readRecordedRuntime,
+  recordRuntime
+} from "./chunk-RDLF4NQC.js";
 import {
   kojeeHomeDir
 } from "./chunk-SQL56SEB.js";
@@ -26,21 +29,265 @@ import {
   resolveWebhookConfig
 } from "./chunk-V5VZPYMZ.js";
 import {
-  loadPairedConfig
-} from "./chunk-YH27B6SW.js";
+  loadPairedConfig,
+  pairedConfigPath,
+  perRuntimeConfigPath
+} from "./chunk-5SZHXYPK.js";
+import {
+  defaultPairedKeystorePath,
+  deriveKeystorePath
+} from "./chunk-6G6YYST6.js";
+import {
+  secureFile,
+  unlinkSyncRetry
+} from "./chunk-U5HHHRXA.js";
 import {
-  secureFile
-} from "./chunk-BLEGIR35.js";
+  VERSION
+} from "./chunk-5DHIUN73.js";
 import {
   CODEX_LISTEN_CAP_MS,
+  buildCondensedTandemRules,
   buildWebhookReceiverNote
-} from "./chunk-Q7T3WAST.js";
+} from "./chunk-SSW5AQSR.js";
+
+// src/wizard/pair-slot.ts
+import fs from "fs";
+import os from "os";
+import path from "path";
+function absPerRuntimeConfigPath(runtime) {
+  const p = path.resolve(perRuntimeConfigPath(runtime));
+  if (process.platform === "win32" && !/^[a-zA-Z]:/.test(p)) {
+    return path.resolve(path.join(os.homedir(), ".kojee", "agents", runtime, "config.json"));
+  }
+  return p;
+}
+function reconcileConnectPairSlot(runtime, code) {
+  const messages = [];
+  for (const other of CONNECT_RUNTIMES) {
+    if (other === runtime) continue;
+    const sibling = loadPairedConfig(perRuntimeConfigPath(other));
+    if (sibling?.token === code) {
+      return {
+        ok: false,
+        output: `This pair code is already connected as ${other}; use a distinct per-agent code for ${runtime}. The dashboard mints one pair code per agent.`,
+        exitCode: 2
+      };
+    }
+  }
+  if (!CONNECT_RUNTIMES.includes(runtime)) {
+    return { ok: true, messages };
+  }
+  const legacy = loadPairedConfig(pairedConfigPath());
+  if (legacy && legacy.token === code) {
+    if (legacy.runtime === "hermes") {
+      return {
+        ok: false,
+        output: `This pair code backs the live hermes connection (${pairedConfigPath()}); retiring it would silently break the hermes daemon. Use a distinct per-agent code for ${runtime}. The dashboard mints one pair code per agent.`,
+        exitCode: 2
+      };
+    }
+    try {
+      unlinkSyncRetry(pairedConfigPath());
+    } catch (err) {
+      const e = err;
+      if (e.code !== "ENOENT") {
+        return {
+          ok: false,
+          output: `Aborted: could not retire the legacy global config at ${pairedConfigPath()} (${e.message}). Close any running kojee proxy and retry.`,
+          exitCode: 1
+        };
+      }
+    }
+    const legacyKeystore = defaultPairedKeystorePath();
+    const target = deriveKeystorePath(code);
+    try {
+      if (fs.existsSync(legacyKeystore) && !fs.existsSync(target)) {
+        fs.renameSync(legacyKeystore, target);
+      }
+    } catch {
+    }
+    messages.push("Migrated the legacy global slot into this per-runtime connection.");
+  }
+  return { ok: true, messages };
+}
+function pairSlotFor(runtime, code) {
+  if (CONNECT_RUNTIMES.includes(runtime)) {
+    const configPath = absPerRuntimeConfigPath(runtime);
+    return {
+      configPath,
+      keystorePath: deriveKeystorePath(code),
+      runtime,
+      allowOverwrite: true,
+      pairedConfigPath: configPath
+    };
+  }
+  return {
+    configPath: pairedConfigPath(),
+    keystorePath: defaultPairedKeystorePath(),
+    // F2: stamp the pairing runtime into the global PairedConfig so a later
+    // connect-runtime reconcile can recognize a live hermes slot and refuse to
+    // retire it (see reconcileConnectPairSlot).
+    runtime,
+    allowOverwrite: false
+  };
+}
 
 // src/wizard/wizard.ts
-import crypto2 from "crypto";
-import fs4 from "fs";
-import path5 from "path";
+import crypto3 from "crypto";
+import fs6 from "fs";
+import path7 from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+
+// src/wizard/skill-install.ts
+import crypto from "crypto";
+import fs2 from "fs";
+import path2 from "path";
 import { fileURLToPath } from "url";
+var SKILL_NAME = "using-tandems";
+var SKILL_MARKER_PREFIX = "kojee-mcp:skill using-tandems";
+function hashSkillBody(body) {
+  return crypto.createHash("sha256").update(body, "utf8").digest("hex").slice(0, 12);
+}
+function bundledSkillSourcePath() {
+  const here = path2.dirname(fileURLToPath(import.meta.url));
+  const candidates = [
+    path2.join(here, "..", "skills", SKILL_NAME, "SKILL.md"),
+    path2.join(here, "..", "..", "skills", SKILL_NAME, "SKILL.md")
+  ];
+  for (const c of candidates) {
+    if (fs2.existsSync(c)) return c;
+  }
+  throw new Error(
+    `bundled skill '${SKILL_NAME}' not found (looked at: ${candidates.join(", ")}) \u2014 the package is missing its skills/ payload; reinstall kojee-mcp.`
+  );
+}
+function readBundledSkill() {
+  const body = fs2.readFileSync(bundledSkillSourcePath(), "utf8").replace(/\s+$/, "") + "\n";
+  return { body, version: VERSION, hash: hashSkillBody(body) };
+}
+function markerLine(version, hash) {
+  return `<!-- ${SKILL_MARKER_PREFIX} v${version} sha256:${hash} \u2014 managed by kojee-mcp; your edits are preserved (a modified file is never auto-updated or auto-removed) -->`;
+}
+function renderInstalledSkill(b) {
+  return `${b.body}
+${markerLine(b.version, hashSkillBody(b.body))}
+`;
+}
+var MARKER_RE = new RegExp(`<!-- ${SKILL_MARKER_PREFIX} v(\\S+) sha256:([0-9a-f]{12})[^>]*-->`);
+function parseInstalledSkill(content) {
+  const m = MARKER_RE.exec(content);
+  if (!m) return null;
+  const before = content.slice(0, m.index);
+  const after = content.slice(m.index + m[0].length);
+  const body = (before + after).replace(/\s+$/, "") + "\n";
+  return { version: m[1], hash: m[2], body };
+}
+function compareVersions(a, b) {
+  const parse = (v) => (v.split("-")[0] ?? "").split(".").map((n) => parseInt(n, 10) || 0);
+  const x = parse(a);
+  const y = parse(b);
+  for (let i = 0; i < 3; i++) {
+    const d = (x[i] ?? 0) - (y[i] ?? 0);
+    if (d !== 0) return d < 0 ? -1 : 1;
+  }
+  return 0;
+}
+function readDest(dest) {
+  try {
+    return { existing: fs2.readFileSync(dest, "utf8"), unreadable: false };
+  } catch (err) {
+    if (err.code === "ENOENT") return { existing: null, unreadable: false };
+    return { existing: null, unreadable: true };
+  }
+}
+function installSkillFile(skillsRoot, bundled = readBundledSkill()) {
+  const dir = path2.join(skillsRoot, SKILL_NAME);
+  const dest = path2.join(dir, "SKILL.md");
+  const { existing, unreadable } = readDest(dest);
+  if (unreadable) return { status: "skipped-unreadable", path: dest };
+  if (existing === null) {
+    fs2.mkdirSync(dir, { recursive: true });
+    fs2.writeFileSync(dest, renderInstalledSkill(bundled));
+    return { status: "installed", path: dest };
+  }
+  const parsed = parseInstalledSkill(existing);
+  if (!parsed) return { status: "skipped-unmanaged", path: dest };
+  if (hashSkillBody(parsed.body) !== parsed.hash) return { status: "skipped-modified", path: dest };
+  const cmp = compareVersions(bundled.version, parsed.version);
+  if (cmp < 0) return { status: "kept-newer", path: dest };
+  if (cmp === 0 && hashSkillBody(bundled.body) === parsed.hash)
+    return { status: "up-to-date", path: dest };
+  fs2.writeFileSync(dest, renderInstalledSkill(bundled));
+  return { status: "updated", path: dest };
+}
+function removeSkillFile(skillsRoot) {
+  const dir = path2.join(skillsRoot, SKILL_NAME);
+  const dest = path2.join(dir, "SKILL.md");
+  const { existing, unreadable } = readDest(dest);
+  if (unreadable) return { status: "skipped-unreadable", path: dest };
+  if (existing === null) return { status: "not-found", path: dest };
+  const parsed = parseInstalledSkill(existing);
+  if (!parsed) return { status: "skipped-unmanaged", path: dest };
+  if (hashSkillBody(parsed.body) !== parsed.hash) return { status: "skipped-modified", path: dest };
+  fs2.unlinkSync(dest);
+  try {
+    fs2.rmdirSync(dir);
+  } catch {
+  }
+  return { status: "removed", path: dest };
+}
+function skillsRootFor(runtime, homeDir = kojeeHomeDir()) {
+  if (runtime === "claude-code") return path2.join(homeDir, ".claude", "skills");
+  if (runtime === "codex") return path2.join(homeDir, ".agents", "skills");
+  return null;
+}
+var LABEL = `skill (${SKILL_NAME})`;
+function installSkillForRuntime(runtime, skillsRootOverride) {
+  const root = skillsRootOverride ?? skillsRootFor(runtime);
+  if (!root) return null;
+  try {
+    const r = installSkillFile(root);
+    switch (r.status) {
+      case "installed":
+        return `${LABEL}: \u2713 installed \u2192 ${r.path}`;
+      case "updated":
+        return `${LABEL}: \u21BB updated to v${VERSION} \u2192 ${r.path}`;
+      case "up-to-date":
+        return `${LABEL}: \u21BB up to date (v${VERSION})`;
+      case "kept-newer":
+        return `${LABEL}: \u2014 kept (installed copy is newer than this proxy's v${VERSION})`;
+      case "skipped-unmanaged":
+        return `${LABEL}: \u26A0 skipped \u2014 ${r.path} exists without a kojee-mcp marker (not ours; left untouched)`;
+      case "skipped-modified":
+        return `${LABEL}: \u26A0 skipped \u2014 ${r.path} was modified locally (edits preserved; delete the file to receive updates)`;
+      case "skipped-unreadable":
+        return `${LABEL}: \u26A0 skipped \u2014 ${r.path} exists but could not be read (not verifying ownership \u2192 not touching it)`;
+    }
+  } catch (err) {
+    return `${LABEL}: WARNING \u2014 could not install (${err.message}); the runtime still works without it.`;
+  }
+}
+function removeSkillForRuntime(runtime, skillsRootOverride) {
+  const root = skillsRootOverride ?? skillsRootFor(runtime);
+  if (!root) return null;
+  try {
+    const r = removeSkillFile(root);
+    switch (r.status) {
+      case "removed":
+        return `${LABEL}: \u2713 removed ${r.path}`;
+      case "not-found":
+        return `${LABEL}: \u2014 not found`;
+      case "skipped-unmanaged":
+        return `${LABEL}: \u26A0 left in place \u2014 ${r.path} has no kojee-mcp marker (not ours)`;
+      case "skipped-modified":
+        return `${LABEL}: \u26A0 left in place \u2014 ${r.path} was modified locally (never deleting your edits; remove it manually)`;
+      case "skipped-unreadable":
+        return `${LABEL}: \u26A0 left in place \u2014 ${r.path} exists but could not be read (cannot verify it's ours)`;
+    }
+  } catch (err) {
+    return `${LABEL}: WARNING \u2014 could not remove (${err.message}).`;
+  }
+}
 
 // src/wizard/registry.ts
 var installers = /* @__PURE__ */ new Map();
@@ -55,16 +302,16 @@ function runtimeUsesWebhook(id) {
 }
 
 // src/wizard/capabilities/webhook-secret.ts
-import crypto from "crypto";
-import fs from "fs";
-import path from "path";
+import crypto2 from "crypto";
+import fs3 from "fs";
+import path3 from "path";
 function generateSecret() {
-  return crypto.randomBytes(32).toString("hex");
+  return crypto2.randomBytes(32).toString("hex");
 }
 function readSecretFromEnv(envPath) {
   let body;
   try {
-    body = fs.readFileSync(envPath, "utf8");
+    body = fs3.readFileSync(envPath, "utf8");
   } catch {
     return void 0;
   }
@@ -77,10 +324,10 @@ function shellSingleQuote(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 function upsertEnvFile(filePath, vars, opts = {}) {
-  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs3.mkdirSync(path3.dirname(filePath), { recursive: true });
   let lines = [];
   try {
-    lines = fs.readFileSync(filePath, "utf8").split("\n");
+    lines = fs3.readFileSync(filePath, "utf8").split("\n");
   } catch {
   }
   if (opts.header && !lines.some((l) => l === opts.header)) lines.unshift(opts.header);
@@ -92,7 +339,7 @@ function upsertEnvFile(filePath, vars, opts = {}) {
     if (idx >= 0) lines[idx] = line;
     else lines.push(line);
   }
-  fs.writeFileSync(filePath, lines.join("\n") + "\n", { mode: 384 });
+  fs3.writeFileSync(filePath, lines.join("\n") + "\n", { mode: 384 });
 }
 function writeWebhookSecretBothSides(opts) {
   const existing = opts.existingSecret ?? readSecretFromEnv(opts.daemonEnvPath) ?? readSecretFromEnv(opts.adapterEnvPath);
@@ -120,11 +367,11 @@ function writeWebhookSecretBothSides(opts) {
 }
 
 // src/wizard/installers/hermes.ts
-import path4 from "path";
+import path6 from "path";
 
 // src/wizard/plugin-payload.ts
-import fs2 from "fs";
-import path2 from "path";
+import fs4 from "fs";
+import path4 from "path";
 var HERMES_PAYLOAD_FILES = [
   "__init__.py",
   "adapter.py",
@@ -132,24 +379,24 @@ var HERMES_PAYLOAD_FILES = [
   "plugin.yaml"
 ];
 function stagePluginPayload(opts) {
-  fs2.mkdirSync(opts.destDir, { recursive: true });
+  fs4.mkdirSync(opts.destDir, { recursive: true });
   const written = [];
   for (const file of opts.files) {
-    const src = path2.join(opts.srcDir, file);
-    if (!fs2.existsSync(src)) {
+    const src = path4.join(opts.srcDir, file);
+    if (!fs4.existsSync(src)) {
       throw new Error(
         `stagePluginPayload: missing payload file '${file}' in ${opts.srcDir}`
       );
     }
-    const dest = path2.join(opts.destDir, file);
-    fs2.copyFileSync(src, dest);
+    const dest = path4.join(opts.destDir, file);
+    fs4.copyFileSync(src, dest);
     written.push(dest);
   }
   return written;
 }
 function resolveBundledPayloadDir(runtime, baseDir) {
-  const dir = path2.join(baseDir, "plugins", runtime);
-  if (!fs2.existsSync(dir) || !fs2.statSync(dir).isDirectory()) {
+  const dir = path4.join(baseDir, "plugins", runtime);
+  if (!fs4.existsSync(dir) || !fs4.statSync(dir).isDirectory()) {
     throw new Error(
       `resolveBundledPayloadDir: no bundled payload for '${runtime}' at ${dir} \u2014 run the build (npm run build) so dist/plugins is staged.`
     );
@@ -157,10 +404,10 @@ function resolveBundledPayloadDir(runtime, baseDir) {
   return dir;
 }
 function missingPayloadFiles(runtime, baseDir, files) {
-  const dir = path2.join(baseDir, "plugins", runtime);
-  const dirOk = fs2.existsSync(dir) && fs2.statSync(dir).isDirectory();
+  const dir = path4.join(baseDir, "plugins", runtime);
+  const dirOk = fs4.existsSync(dir) && fs4.statSync(dir).isDirectory();
   if (!dirOk) return [...files];
-  return files.filter((f) => !fs2.existsSync(path2.join(dir, f)));
+  return files.filter((f) => !fs4.existsSync(path4.join(dir, f)));
 }
 function installBundledPayload(opts) {
   const srcDir = resolveBundledPayloadDir(opts.runtime, opts.baseDir);
@@ -168,8 +415,8 @@ function installBundledPayload(opts) {
 }
 
 // src/wizard/service.ts
-import fs3 from "fs";
-import path3 from "path";
+import fs5 from "fs";
+import path5 from "path";
 function systemdUnit(spec) {
   return [
     "[Unit]",
@@ -216,7 +463,7 @@ function launchdPlist(spec, label) {
 }
 function planService(platform, spec) {
   if (platform === "linux") {
-    const unitPath = path3.join(
+    const unitPath = path5.join(
       spec.homeDir,
       ".config",
       "systemd",
@@ -233,7 +480,7 @@ function planService(platform, spec) {
   }
   if (platform === "darwin") {
     const label = darwinLabel(spec.serviceName);
-    const unitPath = path3.join(spec.homeDir, "Library", "LaunchAgents", `${label}.plist`);
+    const unitPath = path5.join(spec.homeDir, "Library", "LaunchAgents", `${label}.plist`);
     return {
       supported: true,
       unitPath,
@@ -253,23 +500,23 @@ function planService(platform, spec) {
 function writeService(platform, spec) {
   const plan = planService(platform, spec);
   if (plan.supported && plan.unitPath && plan.unitContent !== void 0) {
-    fs3.mkdirSync(path3.dirname(plan.unitPath), { recursive: true });
-    fs3.writeFileSync(plan.unitPath, plan.unitContent, { mode: 420 });
+    fs5.mkdirSync(path5.dirname(plan.unitPath), { recursive: true });
+    fs5.writeFileSync(plan.unitPath, plan.unitContent, { mode: 420 });
   }
   return plan;
 }
 
 // src/wizard/installers/hermes.ts
 function installHermes(inp) {
-  const daemonEnv = path4.join(inp.homeDir, ".kojee", "hermes.env");
-  const adapterEnv = path4.join(inp.homeDir, ".hermes", ".env");
-  const pluginDir = path4.join(inp.homeDir, ".hermes", "plugins", "kojee-tandem");
+  const daemonEnv = path6.join(inp.homeDir, ".kojee", "hermes.env");
+  const adapterEnv = path6.join(inp.homeDir, ".hermes", ".env");
+  const pluginDir = path6.join(inp.homeDir, ".hermes", "plugins", "kojee-tandem");
   if (!inp.skipPayload) {
     const missing = missingPayloadFiles("hermes", inp.payloadBaseDir, HERMES_PAYLOAD_FILES);
     if (missing.length > 0) {
       return {
         runtime: "hermes",
-        output: `hermes install ERROR: the bundled plugin payload is incomplete \u2014 missing ${missing.join(", ")} under ${path4.join(inp.payloadBaseDir, "plugins", "hermes")}. No changes were written. Run \`npm run build\` to stage dist/plugins/hermes, then retry.`,
+        output: `hermes install ERROR: the bundled plugin payload is incomplete \u2014 missing ${missing.join(", ")} under ${path6.join(inp.payloadBaseDir, "plugins", "hermes")}. No changes were written. Run \`npm run build\` to stage dist/plugins/hermes, then retry.`,
         exitCode: 2,
         secret: "",
         secretReused: false
@@ -328,68 +575,59 @@ function installHermes(inp) {
 
 // src/wizard/installers/openclaw.ts
 function installOpenclaw(inp) {
-  const gatewayUrl = inp.url ? inp.url.replace(/\/+$/, "") : void 0;
-  const block = {
-    enabled: true,
-    ...gatewayUrl ? { gatewayUrl } : {},
-    // Token-mode → credential lands here (config-first). Paired-mode → omitted.
-    ...inp.token ? { credential: inp.token } : {},
-    tandems: [],
-    selfPrincipals: [],
-    wake: { severities: [], mentionsOnly: false }
-  };
-  const stamp = (inp.now ? inp.now() : /* @__PURE__ */ new Date()).toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
-  const { backedUp } = writeOpenclawChannelConfig(inp.openclawConfigPath, block, { timestamp: stamp });
-  const installCmd = inp.pluginSourceDir ? `openclaw plugins install -l ${inp.pluginSourceDir}` : `openclaw plugins install npm:openclaw-channel-kojee-tandem  (available once published)`;
+  const r = writeOpenclawMcpConfig(inp.openclawConfigPath, {
+    ...inp.pairedConfigPath ? { pairedConfigPath: inp.pairedConfigPath } : {},
+    ...inp.now ? { now: inp.now } : {}
+  });
   const lines = [];
-  if (backedUp) {
+  if (r.backedUp) {
     lines.push(
-      `WARNING: ${inp.openclawConfigPath} was present but could not be parsed as JSON.`,
-      `         The original was backed up to ${backedUp} before writing the kojee-tandem block.`,
-      `         If it held other channels, recover them from that backup and re-merge by hand.`,
+      `WARNING: ${inp.openclawConfigPath} was present but unparseable; backed up to ${r.backedUp} before writing.`,
       ""
     );
   }
   lines.push(
-    "Configured runtime: openclaw (in-process channel plugin)",
-    "Wake mode: native OpenClaw channel \u2014 the plugin streams Tandem events while the gateway is up.",
-    `  channel config:  ${inp.openclawConfigPath} (channels.${CHANNEL_ID})`,
-    inp.token ? `  credential:      written into the channel block (owner-only perms; the plugin's config-first path)` : `  credential:      shared ~/.kojee/config.json (paired) \u2014 not duplicated into the channel block`,
+    "Configured runtime: openclaw (MCP server + /wake injector)",
+    "Wake mode: kojee-mcp runs as OpenClaw's MCP server; Tandem events POST to the local",
+    "           OpenClaw gateway /hooks/wake (Bearer hooks.token) \u2192 the agent wakes.",
+    `  mcp config:  ${inp.openclawConfigPath} (mcp.servers.kojee)`,
+    inp.pairedConfigPath ? `  credentials: per-runtime paired slot (${inp.pairedConfigPath})` : `  credentials: shared ~/.kojee/config.json (paired)`,
+    `  hooks token: ${r.hooksTokenGenerated ? "generated + hooks.enabled=true (new)" : "preserved existing"}`,
     "",
     "Next steps (openclaw):",
-    `  - Install the plugin via OpenClaw's own plugin manager:  ${installCmd}`,
-    "  - Reload the gateway to load the plugin:  openclaw gateway restart",
-    "  - Verify:  openclaw plugins inspect kojee-tandem  /  openclaw channels status"
+    "  - Run OpenClaw as its GATEWAY DAEMON (its default mode) \u2014 the /wake injector only",
+    "    wakes a running gateway. If the gateway is down, nudges are dropped until it restarts.",
+    "  - Restart the OpenClaw gateway to spawn the kojee MCP server: openclaw gateway restart",
+    "  - Verify: openclaw mcp list  (kojee should be listed)  /  kojee-mcp doctor",
+    "",
+    // Belt-and-suspenders: the same condensed rules ride the kojee MCP server's
+    // `instructions` field (buildNonChannelInstructions), but not every MCP host
+    // surfaces server instructions to the agent — print them here too so the
+    // operator can paste them into the agent's own instructions if needed.
+    "Agent ground rules (also delivered via the kojee MCP server's instructions;",
+    "add to your OpenClaw agent's instructions if it doesn't surface those):",
+    ...buildCondensedTandemRules().split("\n").map((l) => `  ${l}`)
   );
-  return {
-    runtime: "openclaw",
-    output: lines.join("\n"),
-    exitCode: 0,
-    configPath: inp.openclawConfigPath
-  };
+  return { runtime: "openclaw", output: lines.join("\n"), exitCode: 0, configPath: inp.openclawConfigPath };
 }
 function uninstallOpenclaw(inp) {
-  const removed = removeOpenclawChannel(inp.openclawConfigPath);
-  const lines = ["Uninstalling runtime: openclaw (in-process channel plugin)"];
-  lines.push(
-    removed ? `  removed channels.${CHANNEL_ID} from ${inp.openclawConfigPath} (sibling channels preserved)` : `  no channels.${CHANNEL_ID} block found in ${inp.openclawConfigPath} \u2014 nothing to remove`
-  );
-  lines.push("");
-  lines.push("Next steps (openclaw):");
-  lines.push("  - Remove the plugin via OpenClaw's own plugin manager:  openclaw plugins uninstall kojee-tandem");
-  lines.push("  - Reload the gateway:  openclaw gateway restart");
-  return {
-    runtime: "openclaw",
-    output: lines.join("\n"),
-    exitCode: 0,
-    configPath: inp.openclawConfigPath
-  };
+  const removed = removeOpenclawMcpServer(inp.openclawConfigPath);
+  const lines = [
+    "Uninstalling runtime: openclaw (MCP server + /wake injector)",
+    removed ? `  removed mcp.servers.kojee from ${inp.openclawConfigPath} (hooks + siblings preserved)` : `  no mcp.servers.kojee in ${inp.openclawConfigPath} \u2014 nothing to remove`,
+    "",
+    "Next steps (openclaw):",
+    "  - Restart the OpenClaw gateway: openclaw gateway restart",
+    "  - hooks.enabled/token were left intact (you may use hooks for other integrations)."
+  ];
+  return { runtime: "openclaw", output: lines.join("\n"), exitCode: 0, configPath: inp.openclawConfigPath };
 }
 
 // src/wizard/wizard.ts
 var DEFAULT_BROKER_URL = "https://rosie-staging.kojee.net";
+var HERMES_DEFAULT_WEBHOOK_URL = "http://127.0.0.1:8645/kojee-tandem";
 function generateWebhookSecret() {
-  return crypto2.randomBytes(32).toString("hex");
+  return crypto3.randomBytes(32).toString("hex");
 }
 async function resolveRuntime(opts) {
   if (opts.runtime !== void 0) {
@@ -411,7 +649,8 @@ async function resolveRuntime(opts) {
 }
 function resolveWizardWebhook(opts) {
   const env = opts.env ?? process.env;
-  const url = (opts.webhookUrl ?? env["KOJEE_WEBHOOK_URL"] ?? "").trim();
+  const envUrl = (env["KOJEE_WEBHOOK_URL"] ?? "").trim();
+  const url = (opts.webhookUrl ?? (isPlaceholderWebhookUrl(envUrl) ? "" : envUrl)).trim();
   let secret = (opts.webhookSecret ?? env["KOJEE_WEBHOOK_SECRET"] ?? "").trim();
   if (url && !secret) secret = generateWebhookSecret();
   const sigFormat = (opts.webhookSignatureFormat ?? env["KOJEE_WEBHOOK_SIGNATURE_FORMAT"] ?? "").trim();
@@ -472,15 +711,25 @@ async function gatherGuidedInputs(runtime, opts) {
     } else {
       const code = opts.promptPairCode ? (await opts.promptPairCode()).trim() : "";
       if (!code) return { error: "No pair code entered. Re-run `kojee-mcp init` and enter a pair code, or choose token mode." };
-      const pair = opts.runPair ?? (async (a) => {
-        const { runPair } = await import("./pair-P4ILCMT7.js");
-        const { pairedConfigPath } = await import("./paired-config-JTFLHMZ2.js");
-        const { defaultPairedKeystorePath } = await import("./keystore-XLEV3FL5.js");
-        return runPair({ code: a.code, url: a.url, keystorePath: defaultPairedKeystorePath(), configPath: pairedConfigPath() });
+      const reconcile = reconcileConnectPairSlot(runtime, code);
+      if (!reconcile.ok) return { error: reconcile.output };
+      for (const m of reconcile.messages) preamble.push(m);
+      const slot = pairSlotFor(runtime, code);
+      const pair = opts.runPair ?? (async (o) => {
+        const { runPair } = await import("./pair-HTCVSMR6.js");
+        return runPair(o);
       });
       try {
-        const { message } = await pair({ code, url: brokerUrl });
+        const { message } = await pair({
+          code,
+          url: brokerUrl,
+          keystorePath: slot.keystorePath,
+          configPath: slot.configPath,
+          ...slot.runtime ? { runtime: slot.runtime } : {},
+          ...slot.allowOverwrite ? { allowOverwrite: true } : {}
+        });
         preamble.push(`Auth: pair mode \u2014 ${message}`);
+        if (slot.pairedConfigPath) next.pairedConfigPath = slot.pairedConfigPath;
       } catch (err) {
         return { error: `Pairing failed: ${err.message}` };
       }
@@ -513,20 +762,26 @@ async function runWizard(opts) {
   }
   const installer = getInstaller(runtime);
   const result = installer ? await installer.install({ opts: effective }) : { runtime, output: `No installer registered for runtime '${runtime}'`, exitCode: 2 };
+  const skillLine = result.exitCode === 0 ? installSkillForRuntime(runtime, effective.skillsRoot) : null;
+  const body = skillLine ? `${result.output}
+
+${skillLine}` : result.output;
   if (preamble.length > 0 && result.exitCode === 0) {
     return {
       runtime,
-      output: [...preamble, "", result.output, "", whatHappensNext(runtime, effective)].join("\n"),
+      output: [...preamble, "", body, "", whatHappensNext(runtime, effective)].join("\n"),
       exitCode: result.exitCode
     };
   }
-  return { runtime, output: result.output, exitCode: result.exitCode };
+  return { runtime, output: body, exitCode: result.exitCode };
 }
 function whatHappensNext(runtime, opts) {
   const lines = ["What happens next:"];
   lines.push("  - Restart your runtime so it picks up the new kojee config.");
   if (opts.token) {
     lines.push("  - First boot enrolls this token's own keystore (~/.kojee/keypair-<hash>.json).");
+  } else if (opts.pairedConfigPath) {
+    lines.push(`  - The proxy uses your paired credentials (${opts.pairedConfigPath}).`);
   } else {
     lines.push("  - The proxy uses your paired credentials (~/.kojee/config.json + keypair.json).");
   }
@@ -534,13 +789,18 @@ function whatHappensNext(runtime, opts) {
   return lines.join("\n");
 }
 async function configureClaudeCode(opts) {
-  const { runInit } = await import("./install-LJY2CHKG.js");
+  const { runInit } = await import("./install-V7LSQCYZ.js");
   const report = runInit({
     ...opts.configPath ? { configPath: opts.configPath } : {},
     ...opts.hooksPath ? { hooksPath: opts.hooksPath } : {},
     // Token mode threads --token/--url into the written args (per-token
     // keystore). Paired mode leaves both unset ⇒ args stay `["kojee-mcp"]`.
-    ...opts.token && opts.url ? { token: opts.token, url: opts.url } : {}
+    ...opts.token && opts.url ? { token: opts.token, url: opts.url } : {},
+    // Per-runtime paired mode (connect): embed --paired-config, overwrite a
+    // stale entry so a re-connect can never leave a launcher reading old creds,
+    // and ensureCli so a fresh box with no ~/.claude.json still gets the
+    // launcher WRITTEN (never a silent "not-found" that drops the wrong slot).
+    ...opts.pairedConfigPath ? { pairedConfigPath: opts.pairedConfigPath, overwrite: true, ensureCli: true } : {}
   });
   recordRuntime("claude-code");
   return { runtime: "claude-code", output: formatClaudeInit(report), exitCode: 0 };
@@ -549,6 +809,7 @@ function formatClaudeInit(report) {
   const tick = (s) => {
     if (s === "added") return "\u2713 added";
     if (s === "already-installed") return "\u21BB already installed";
+    if (s === "updated") return "\u21BB updated";
     if (s === "preserved-different") return "\u26A0 preserved (existing entry differs \u2014 left untouched)";
     if (s === "not-found") return "\u2014 not found";
     return s ?? "\u2014";
@@ -586,44 +847,60 @@ function configureCodex(opts) {
   if (wh.error) {
     return { runtime: "codex", output: `webhook env ERROR: ${wh.error}`, exitCode: 2 };
   }
-  const url = wh.url || "https://YOUR-CODEX-WEBHOOK-RECEIVER.local/kojee";
-  const secret = wh.secret || generateWebhookSecret();
+  const connectPairedMode = !!opts.pairedConfigPath && !wh.url && !wh.secret;
+  const hasRealUrl = !!wh.url && !isPlaceholderWebhookUrl(wh.url);
+  const url = connectPairedMode || !hasRealUrl ? void 0 : wh.url;
+  const secret = connectPairedMode || !hasRealUrl ? void 0 : wh.secret || generateWebhookSecret();
   const tokenArgs = opts.token && opts.url ? { token: opts.token, url: opts.url } : {};
+  const pairedArgs = opts.pairedConfigPath ? { pairedConfigPath: opts.pairedConfigPath } : {};
   writeCodexConfig({
     ...opts.configPath ? { configPath: opts.configPath } : {},
     ...opts.hooksPath ? { hooksPath: opts.hooksPath } : {},
-    webhookUrl: url,
-    webhookSecret: secret,
+    ...url !== void 0 ? { webhookUrl: url } : {},
+    ...secret !== void 0 ? { webhookSecret: secret } : {},
     ...wh.signatureEnv.length > 0 ? { signatureEnv: wh.signatureEnv } : {},
-    ...tokenArgs
+    ...tokenArgs,
+    ...pairedArgs
   });
   recordRuntime("codex");
   const lines = [];
   lines.push("Configured runtime: codex");
-  lines.push("Wake mode: webhook-sink + stop-hook peek (Codex has no channel injection).");
+  lines.push(
+    "Wake mode: self-contained (proxy-written pending marker) + stop-hook peek. Webhook OPTIONAL \u2014 an extra low-latency push path, never required."
+  );
   lines.push("");
   lines.push("Wrote [mcp_servers.kojee] to ~/.codex/config.toml:");
   lines.push(indent(buildCodexMcpServerTable({
-    webhookUrl: url,
-    webhookSecret: "<redacted>",
+    // In connectPairedMode the webhook env is left untouched — print neither key
+    // (they are preserved from the existing config, not owned this run).
+    ...url !== void 0 ? { webhookUrl: url } : {},
+    ...secret !== void 0 ? { webhookSecret: "<redacted>" } : {},
     ...wh.signatureEnv.length > 0 ? { signatureEnv: wh.signatureEnv } : {},
     // Redact the gateway token in the human-readable printed copy (it ends up
     // in result.output → cli.ts console.error). The WRITTEN config above keeps
     // the real token; only this printed report is redacted, like webhookSecret.
-    ...tokenArgs.token ? { token: "<redacted>", url: tokenArgs.url } : {}
+    ...tokenArgs.token ? { token: "<redacted>", url: tokenArgs.url } : {},
+    // A paired-config path is not a secret — print it verbatim.
+    ...pairedArgs
   })));
   if (wh.warning) lines.push(`webhook WARNING: ${wh.warning}`);
   lines.push("");
   lines.push("Wrote the Codex Stop hook (~/.codex/hooks.json; inline TOML form):");
   lines.push(indent(buildCodexStopHookBlock()));
   lines.push("");
-  lines.push(`webhook: ${wh.url ? wh.redactedSummary : "(receiver URL not set \u2014 fill KOJEE_WEBHOOK_URL above)"}`);
+  lines.push(
+    connectPairedMode ? "webhook: (unchanged \u2014 `connect` rewrites only the credential args, not the wake path)" : `webhook: ${wh.url ? wh.redactedSummary : "OPTIONAL \u2014 not configured (wake is self-contained; set KOJEE_WEBHOOK_URL only for an extra low-latency push path)"}`
+  );
   lines.push(`bounded-listen cap: ${CODEX_LISTEN_CAP_MS}ms (the model picks listen vs drain vs ignore).`);
   lines.push("");
   lines.push("Next steps (codex):");
   lines.push("  Restart Codex (or start a new `codex` / `codex exec` session) to load the MCP server and hook.");
-  lines.push("  Stand up your webhook receiver at KOJEE_WEBHOOK_URL \u2014 contract:");
-  lines.push(indent(buildWebhookReceiverNote({ header: wh.signatureHeader, prefix: wh.signaturePrefix })));
+  if (wh.url) {
+    lines.push("  Stand up your webhook receiver at KOJEE_WEBHOOK_URL \u2014 contract:");
+    lines.push(indent(buildWebhookReceiverNote({ header: wh.signatureHeader, prefix: wh.signaturePrefix })));
+  } else {
+    lines.push("  (Optional) For an extra low-latency push path, re-run with --webhook-url <receiver>; wake works without it.");
+  }
   lines.push("  Verify: kojee-mcp doctor");
   lines.push("");
   lines.push(CODEX_UNVERIFIED_NOTE);
@@ -652,7 +929,7 @@ function buildDaemonEnvBlock(runtime, wh, envFile) {
   return lines;
 }
 function distDir() {
-  return path5.dirname(fileURLToPath(import.meta.url));
+  return path7.dirname(fileURLToPath2(import.meta.url));
 }
 function resolveBinPath() {
   const entry = process.argv[1];
@@ -660,14 +937,30 @@ function resolveBinPath() {
 }
 function configureHermes(opts) {
   const runtime = "hermes";
-  const wh = resolveWizardWebhook(opts);
+  const env0 = opts.env ?? process.env;
+  const suppliedUrl = (opts.webhookUrl ?? env0["KOJEE_WEBHOOK_URL"] ?? "").trim();
+  const effectiveOpts = suppliedUrl ? opts : { ...opts, webhookUrl: HERMES_DEFAULT_WEBHOOK_URL };
+  const wh = resolveWizardWebhook(effectiveOpts);
   if (wh.error) {
     return { runtime, output: `webhook env ERROR: ${wh.error}`, exitCode: 2 };
   }
+  opts = effectiveOpts;
   const lines = [];
   lines.push(`Configured runtime: ${runtime}`);
   lines.push("Wake mode: webhook sink (daemon-consumed). NO MCP-config file, NO hooks written.");
   lines.push("");
+  if (!suppliedUrl) {
+    lines.push(
+      "WARNING: no --webhook-url was supplied, so the webhook sink DEFAULTS to the fixed",
+      `loopback port ${HERMES_DEFAULT_WEBHOOK_URL} (the hermes-plugin listener). Every Tandem`,
+      "event body is POSTed there. On a multi-user host, another local user or process that",
+      "binds that port while the hermes plugin is down (before first start, or after a crash)",
+      "receives those event bodies plus valid signature/body pairs replayable against the real",
+      "receiver. If that risk applies to this host, re-run with an explicit --webhook-url",
+      "pointing at a receiver you control, and keep the hermes plugin running.",
+      ""
+    );
+  }
   if (wh.warning) lines.push(`webhook WARNING: ${wh.warning}`);
   if (wh.url) {
     const home = kojeeHomeDir();
@@ -697,10 +990,13 @@ function configureHermes(opts) {
       return { runtime, output: lines.join("\n"), exitCode: install.exitCode };
     }
     recordRuntime(runtime);
-    const envFile = path5.join(home, ".kojee", "hermes.env");
+    const envFile = path7.join(home, ".kojee", "hermes.env");
     lines.push(...buildDaemonEnvBlock(runtime, wh, envFile));
     lines.push("");
     lines.push(install.output);
+    lines.push("");
+    lines.push("Agent ground rules (add to your hermes agent's instructions \u2014 hermes has no skill loader):");
+    lines.push(indent(buildCondensedTandemRules()));
     return { runtime, output: lines.join("\n"), exitCode: install.exitCode };
   }
   recordRuntime(runtime);
@@ -710,33 +1006,19 @@ function configureHermes(opts) {
   lines.push("  Re-run with --webhook-url once your receiver is up to complete the install");
   lines.push("  (writes both env files, copies the plugin, installs the daemon service).");
   lines.push("  Verify: kojee-mcp doctor (after the daemon is up).");
+  lines.push("");
+  lines.push("Agent ground rules (add to your hermes agent's instructions \u2014 hermes has no skill loader):");
+  lines.push(indent(buildCondensedTandemRules()));
   return { runtime, output: lines.join("\n"), exitCode: 0 };
 }
 function openclawConfigPath(opts) {
-  return opts.openclawConfigPath ?? path5.join(kojeeHomeDir(), ".openclaw", "config.json");
-}
-function resolveOpenclawPluginSourceDir() {
-  const candidates = [
-    path5.resolve(distDir(), "..", "..", "integrations", "openclaw-plugin"),
-    path5.resolve(distDir(), "..", "..", "..", "integrations", "openclaw-plugin")
-  ];
-  for (const dir of candidates) {
-    if (fs4.existsSync(path5.join(dir, "openclaw.plugin.json"))) return dir;
-  }
-  return void 0;
+  return opts.openclawConfigPath ?? path7.join(kojeeHomeDir(), ".openclaw", "openclaw.json");
 }
 function configureOpenclaw(opts) {
   const runtime = "openclaw";
-  const env = opts.env ?? process.env;
-  const token = (opts.token ?? "").trim();
-  const url = (opts.url ?? env["KOJEE_GATEWAY_URL"] ?? "").trim();
-  const pluginSourceDir = resolveOpenclawPluginSourceDir();
   const install = installOpenclaw({
-    homeDir: kojeeHomeDir(),
     openclawConfigPath: openclawConfigPath(opts),
-    ...url ? { url } : {},
-    ...token ? { token } : {},
-    ...pluginSourceDir ? { pluginSourceDir } : {}
+    ...opts.pairedConfigPath ? { pairedConfigPath: opts.pairedConfigPath } : {}
   });
   recordRuntime(runtime);
   return { runtime, output: install.output, exitCode: install.exitCode };
@@ -745,7 +1027,7 @@ async function runWizardUninstall(runtime, opts) {
   const effective = opts.runtime !== void 0 ? runtime : readRecordedRuntime() ?? runtime;
   const lines = [`Uninstalling runtime: ${effective}`];
   if (effective === "claude-code") {
-    const { runUninstall } = await import("./install-LJY2CHKG.js");
+    const { runUninstall } = await import("./install-V7LSQCYZ.js");
     const report = runUninstall({
       ...opts.configPath ? { configPath: opts.configPath } : {},
       ...opts.hooksPath ? { hooksPath: opts.hooksPath } : {}
@@ -774,13 +1056,15 @@ async function runWizardUninstall(runtime, opts) {
   } else {
     lines.push("  (hermes writes no MCP-config or hooks \u2014 nothing to tear down.");
     lines.push("   Stop the daemon and unset KOJEE_WEBHOOK_URL/SECRET to disable the sink.)");
-    const envPath = path5.join(kojeeHomeDir(), ".kojee", `${effective}.env`);
+    const envPath = path7.join(kojeeHomeDir(), ".kojee", `${effective}.env`);
     try {
-      fs4.unlinkSync(envPath);
+      fs6.unlinkSync(envPath);
       lines.push(`  removed ${envPath}`);
     } catch {
     }
   }
+  const skillLine = removeSkillForRuntime(effective, opts.skillsRoot);
+  if (skillLine) lines.push(skillLine);
   clearRuntimeRecord();
   return { runtime: effective, output: lines.join("\n"), exitCode: 0 };
 }
@@ -824,119 +1108,13 @@ registerBuiltinInstaller(
 registerBuiltinInstaller(
   "openclaw",
   "OpenClaw",
-  ["pair-credential", "in-process-plugin"],
+  ["pair-credential", "mcp-config-write"],
   (o) => configureOpenclaw(o)
 );
 
-// src/wizard/setup-handler.ts
-var SETUP_SUPPORTED_RUNTIMES = ["claude-code", "codex"];
-function isSetupRuntime(value) {
-  return SETUP_SUPPORTED_RUNTIMES.includes(value);
-}
-function resolvePairCode(opts) {
-  return opts.pair ?? opts.pairCode;
-}
-async function defaultRunPair(args) {
-  const { runPair } = await import("./pair-P4ILCMT7.js");
-  const { pairedConfigPath } = await import("./paired-config-JTFLHMZ2.js");
-  const { defaultPairedKeystorePath } = await import("./keystore-XLEV3FL5.js");
-  return runPair({
-    code: args.code,
-    url: args.url,
-    keystorePath: defaultPairedKeystorePath(),
-    configPath: pairedConfigPath()
-  });
-}
-async function runSetup(opts) {
-  const messages = [];
-  const requested = opts.runtime ?? "claude-code";
-  if (opts.verb === "setup" && opts.runtime !== void 0 && !isSetupRuntime(opts.runtime)) {
-    const supported = SETUP_SUPPORTED_RUNTIMES.join(", ");
-    const output = isWizardRuntime(opts.runtime) ? `\`setup\` does not support --runtime ${opts.runtime} yet (coming soon). Supported by \`setup\`: ${supported}. For ${opts.runtime}, use \`kojee-mcp init --runtime ${opts.runtime}\` for now.` : `Unknown --runtime "${opts.runtime}". \`setup\` supports: ${supported}. (For hermes/openclaw use \`kojee-mcp init\`.)`;
-    return { runtime: requested, messages, output, exitCode: 2 };
-  }
-  if (opts.token !== void 0 && (opts.url === void 0 || opts.url.trim() === "") && !opts.uninstall) {
-    return {
-      runtime: requested,
-      messages,
-      output: "--token requires --url (the broker URL the Kojee UI gave you). Re-run with --url <broker-url>. Nothing was written.",
-      exitCode: 2
-    };
-  }
-  const url = opts.url ? opts.url.replace(/\/+$/, "") : void 0;
-  if (opts.pairCode && !opts.uninstall) {
-    const pair = opts.runPair ?? defaultRunPair;
-    const pairUrl = url ?? DEFAULT_BROKER_URL;
-    try {
-      const r = await pair({ code: opts.pairCode, url: pairUrl });
-      messages.push(r.message);
-    } catch (err) {
-      return {
-        runtime: requested,
-        messages,
-        output: `Pairing failed: ${err.message}`,
-        exitCode: 1
-      };
-    }
-  }
-  const loadCfg = opts.loadPairedConfig ?? loadPairedConfig;
-  const hasCredential = loadCfg() !== null || opts.token !== void 0;
-  if (!hasCredential && !opts.interactive && !opts.uninstall) {
-    return {
-      runtime: requested,
-      messages,
-      output: "Not paired. Run `kojee-mcp pair <code> --url <broker>` first, then re-run \u2014 or pass --pair <code> (or --token <T> --url <U>), or run in a terminal for the guided wizard.",
-      exitCode: 1
-    };
-  }
-  const result = await runWizard({
-    ...opts.runtime !== void 0 ? { runtime: opts.runtime } : {},
-    ...opts.uninstall ? { uninstall: true } : {},
-    ...opts.configPath ? { configPath: opts.configPath } : {},
-    ...opts.hooksPath ? { hooksPath: opts.hooksPath } : {},
-    // Token mode (token + url) threads --token/--url into the written config.
-    ...opts.token ? { token: opts.token } : {},
-    ...url ? { url } : {},
-    ...opts.webhookUrl ? { webhookUrl: opts.webhookUrl } : {},
-    ...opts.webhookSecret ? { webhookSecret: opts.webhookSecret } : {},
-    ...opts.webhookSignatureFormat ? { webhookSignatureFormat: opts.webhookSignatureFormat } : {},
-    ...opts.webhookSignatureHeader ? { webhookSignatureHeader: opts.webhookSignatureHeader } : {},
-    ...opts.webhookSignaturePrefix !== void 0 ? { webhookSignaturePrefix: opts.webhookSignaturePrefix } : {},
-    interactive: opts.interactive,
-    ...opts.interactive && opts.prompts ? opts.prompts : {}
-  });
-  if (opts.verb === "setup" && result.exitCode === 0 && !opts.uninstall) {
-    return {
-      runtime: result.runtime,
-      messages,
-      output: crispSetupSummary(result.runtime, opts, url),
-      exitCode: 0
-    };
-  }
-  return { runtime: result.runtime, messages, output: result.output, exitCode: result.exitCode };
-}
-function crispSetupSummary(runtime, opts, url) {
-  const authLine = opts.token ? `  Auth:        token mode (--token/--url${url ? `, ${url}` : ""})` : "  Auth:        paired credentials (~/.kojee/config.json)";
-  const lines = [];
-  if (runtime === "codex") {
-    lines.push("\u2713 kojee is set up for Codex.");
-    lines.push(`  MCP config:  ${opts.configPath ?? "~/.codex/config.toml"}  ([mcp_servers.kojee])`);
-    lines.push(`  Stop hook:   ${opts.hooksPath ?? "~/.codex/hooks.json"}  (codex-stop)`);
-    lines.push(authLine);
-    lines.push("");
-    lines.push("Next: restart Codex to connect.");
-  } else {
-    lines.push("\u2713 kojee is set up for Claude Code.");
-    lines.push(`  MCP config:  ${opts.configPath ?? "~/.claude.json"}  (mcpServers.kojee)`);
-    lines.push(`  Hooks:       ${opts.hooksPath ?? "~/.claude/settings.json"}  (Stop + UserPromptSubmit)`);
-    lines.push(authLine);
-    lines.push("");
-    lines.push("Next: restart Claude Code to connect.");
-  }
-  return lines.join("\n");
-}
 export {
-  SETUP_SUPPORTED_RUNTIMES,
-  resolvePairCode,
-  runSetup
+  reconcileConnectPairSlot,
+  pairSlotFor,
+  DEFAULT_BROKER_URL,
+  runWizard
 };