mobygate 0.7.2 → 0.8.0

package/CHANGELOG.md

@@ -4,6 +4,151 @@ All notable changes to mobygate are documented here. Format loosely follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version numbers are
 [Semantic Versioning](https://semver.org/).
 
+## [0.8.0] — 2026-04-25
+
+Auto-wire third-party clients to use mobygate. The "find your client's
+config file → paste this JSON → restart" dance is replaced by
+`mobygate connect`.
+
+### Added
+
+- **`mobygate connect` CLI** — auto-detects supported clients on the
+  system, plans the minimal config edit to register mobygate as a
+  provider, and applies it atomically with a backup. Subcommands:
+  - `mobygate connect` — interactive, lists detected clients and asks
+    which to wire (default: all)
+  - `mobygate connect <id>` — wire one specific client
+  - `mobygate connect --all` — every detected client, no prompts
+  - `mobygate connect --dry-run` — show planned diff, don't write
+  - `mobygate connect --yes` — skip the per-client confirm prompt
+  - `mobygate connect --no-default` — register the provider but don't
+    change the client's active default model
+  - `mobygate disconnect <id>` — remove our entries cleanly
+- **Auto-wire prompt at the end of `mobygate init`** — after services
+  start, if any supported client is detected, init asks "wire them
+  up?" before printing Done. Skipped in `--yes` mode (we don't edit
+  third-party configs in non-interactive flows without explicit opt-in).
+- **Hermes connector** (`lib/connectors/hermes.js`) — registers the
+  `moby` provider in `~/.hermes/config.yaml`. Hermes only speaks the
+  OpenAI-compat wire format, so a single provider entry covers it.
+- **OpenClaw connector** (`lib/connectors/openclaw.js`) — registers
+  BOTH `moby` (OpenAI-compat) and `moby-native` (Anthropic-messages)
+  in `~/.openclaw/openclaw.json`. With `setDefault`, points OpenClaw's
+  main + default at `moby-native/claude-opus-4-7` — the wire format
+  that unlocks vision, native tool calls, and reasoning blocks.
+
+### Provider naming
+
+All registered entries use the `moby` prefix to be unmistakably from
+mobygate:
+- **`moby`** — OpenAI-compat surface (POST /v1/chat/completions)
+- **`moby-native`** — Anthropic-messages surface (POST /v1/messages)
+
+### Safety
+
+Every config write goes through `lib/connectors/safety.js`:
+- Timestamped backup at `<file>.mobygate-backup-<ISO>` before any write
+- Atomic write via temp file + rename
+- Read-back verification that the on-disk content matches what we
+  intended to write
+- Idempotent — running `connect` twice doesn't duplicate entries; we
+  detect existing moby entries by key and update vs append
+
+### Caveats
+
+- **YAML comments are not preserved.** Hermes config uses YAML, and
+  `js-yaml` parse-then-emit drops comments and blank lines. The
+  auto-backup catches this — the connector also warns on first
+  detection. Comment-preserving YAML is a v0.8.x candidate.
+- **Custom config locations not yet supported.** Connectors probe
+  `~/.hermes/` and `~/.openclaw/`. If you've installed a client to a
+  non-standard path, you'd still need to wire it manually, or set
+  `HERMES_HOME` / `OPENCLAW_HOME` env vars (which the connectors
+  honor).
+- **No `verify()` step yet.** The connector contract has slots for it,
+  but v0.8.0 doesn't fire a real test request through the wired
+  client. Verification is on the v0.8.x roadmap.
+
+### v0.8.x backlog (deferred)
+
+- More connectors (pi-agent, Goose, Aider, Cursor — anything that
+  takes a custom OpenAI-compat baseURL)
+- `verify()` step that exercises the new provider end-to-end
+- Comment-preserving YAML for Hermes
+- Auxiliary-client routing helpers (pin Hermes vision/compression to
+  Sonnet/Haiku via mobygate to save Opus quota)
+- `mobygate doctor` extended to check connection health per client
+
+## [0.7.3] — 2026-04-25
+
+Hotfix bundle from a thorough security + bugs + ops audit. Six items.
+
+### Fixed (security)
+
+- **Same-origin gate on control-plane endpoints.** `/update/apply`,
+  `/auth/refresh`, `DELETE /sessions(/:key)`, `/dashboard/logs`, and
+  `/events` now require the request's `Host` header to be localhost
+  and (when present) the `Origin` header to match. This blocks the
+  DNS-rebinding scenario where a malicious site reroutes its DNS to
+  `127.0.0.1` and triggers `npm install -g`, drains Claude Max quota
+  via auth-refresh spam, or tails prompt content from server logs
+  through any browser tab the user has open. Proxy endpoints
+  (`/v1/chat/completions`, `/v1/messages`, `/v1/models`, `/health`)
+  stay open for client traffic.
+
+### Fixed (operational)
+
+- **Dashboard "Update now" silently no-op'd on Windows.** `lib/updater.js`
+  hardcoded `WIN_SERVER_TASK = 'ai.mobygate.server'` while the task
+  `lib/platform.js` actually registers is `'mobygate-server'`. The
+  cmd.exe `&&` chain short-circuited on the failed `schtasks /End`
+  and never ran `npm install`. Now imports `WIN_LABELS` and
+  `LINUX_UNITS` directly from platform.js, single-source-of-truth.
+- **`mobygate stop` and `mobygate update` now stop BOTH services**
+  (server + auth-refresh) on all three platforms. Earlier the auth
+  task could fire mid-update on Windows, grab file handles in
+  `node_modules\mobygate`, and trigger EBUSY — root cause of the
+  v0.6/v0.7 EBUSY churn. The dashboard `/update/apply` flow also
+  stops both services in the detached child script.
+- **Mac auth-refresh plist now generated programmatically.** Earlier
+  releases shipped a static plist template (`launchd/ai.mobygate.auth-refresh.plist`)
+  with hardcoded paths from Farhan's machine and sed-replaced them
+  at install time. Anyone whose username, install path, or fnm
+  Node version didn't EXACTLY match the patterns ended up with a
+  plist pointing at non-existent paths and the cron silently
+  failed forever. New `writeMacAuthRefreshPlist()` in `lib/platform.js`
+  mirrors `writeMacServerPlist`, generates from the user's actual
+  paths, portable across any user.
+
+### Fixed (bugs)
+
+- **Image + 401 auth-retry no longer hangs / returns empty.** When a
+  multimodal request hit the SDK right as the OAuth token expired,
+  `runWithAuthRetry` would invoke `runQuery` a second time with the
+  same already-exhausted async iterator (multimodal returns a
+  single-use generator). The SDK got an empty user message and the
+  client received an empty response. `prompt` is now built lazily
+  inside `runQuery` so each retry attempt rebuilds the iterator.
+  All four handlers fixed.
+- **400 instead of "model responds to its own reply"** when a resumed
+  request's history terminates with an assistant turn. Earlier
+  `messagesToPrompt` in resume mode fell back to extracting whatever
+  was at `messages[-1]`, sending the assistant's previous reply to
+  the SDK as the new user prompt. Now both `messagesToPrompt`
+  (OpenAI) and `anthropicMessagesToPrompt` (Anthropic) return a
+  structured `{ promptText, error }` and the handler returns 400
+  with a readable message when the trailing turn isn't user/tool.
+
+### Notes
+
+- For LAN-exposed installs (`bind: 0.0.0.0`), the same-origin gate
+  is necessary but not sufficient — anyone on the LAN can still hit
+  endpoints with a faked `Host` header. A real `MOBYGATE_TOKEN` for
+  LAN auth is queued for a follow-up release.
+- The `launchd/ai.mobygate.auth-refresh.plist` template file is now
+  unused. Left in the package for backward compatibility — won't
+  ship in a future release.
+
 ## [0.7.2] — 2026-04-25
 
 ### Fixed

package/bin/mobygate.js

@@ -28,7 +28,7 @@ import { loadConfig, writeConfig, writeState, readState, CONFIG_DIR, CONFIG_PATH
 import {
   PLATFORM, IS_MAC, IS_LINUX, IS_WIN,
   resolveNodeBin,
-  writeMacServerPlist, launchctlLoad, launchctlUnload,
+  writeMacServerPlist, writeMacAuthRefreshPlist, launchctlLoad, launchctlUnload,
   plistPathForLabel, queryLaunchd, uninstallAllServices,
   installWindowsServices, uninstallWindowsServices,
   queryWindowsTask, startWindowsTask, stopWindowsTask, WIN_LABELS,
@@ -39,6 +39,13 @@ import {
 } from '../lib/platform.js';
 import { getAuthStatus, forceRefresh } from '../scripts/auth-helper.js';
 import { banner, compactBanner } from '../lib/ascii.js';
+import {
+  CONNECTORS,
+  detectAll as detectAllConnectors,
+  getConnector,
+  DEFAULT_BASE_URL as MOBY_BASE_URL,
+  DEFAULT_API_KEY as MOBY_API_KEY,
+} from '../lib/connectors/index.js';
 
 const __filename = fileURLToPath(import.meta.url);
 const REPO_ROOT = resolve(dirname(__filename), '..');
@@ -204,21 +211,18 @@ async function cmdInit() {
     launchctlLoad(serverPlist);
     ok(`Installed ${SERVER_LABEL} (launchd)`);
 
-    // Auth refresh plist (we ship a template in launchd/ — copy + rewrite
-    // WorkingDirectory, node path, and log paths to match this install).
-    const authSrc = join(REPO_ROOT, 'launchd', 'ai.mobygate.auth-refresh.plist');
-    if (existsSync(authSrc)) {
-      const authDst = plistPathForLabel(AUTH_LABEL);
-      const tmpl = readFileSync(authSrc, 'utf8')
-        // WorkingDirectory + any path that referenced the repo root
-        .replace(/\/Users\/farhan\/openclaude\/claude-max-sdk-proxy\/logs/g, logsDir)
-        .replace(/\/Users\/farhan\/openclaude\/claude-max-sdk-proxy/g, REPO_ROOT)
-        // node binary baked into ProgramArguments
-        .replace(/\/Users\/farhan\/\.local\/share\/fnm\/aliases\/default\/bin\/node/g, nodeBin);
-      writeFileSync(authDst, tmpl);
-      launchctlLoad(authDst);
-      ok(`Installed ${AUTH_LABEL} (launchd, every ${existing.auth_refresh_interval_hours}h)`);
-    }
+    // Auth refresh plist — generated programmatically with the user's
+    // actual paths. Earlier we shipped a static template and sed-replaced
+    // hardcoded paths inside it, which silently broke for anyone whose
+    // username/install-path/fnm-version didn't EXACTLY match Farhan's.
+    const authPlist = writeMacAuthRefreshPlist({
+      installPath: REPO_ROOT,
+      nodeBin,
+      logsDir,
+      intervalHours: existing.auth_refresh_interval_hours,
+    });
+    launchctlLoad(authPlist);
+    ok(`Installed ${AUTH_LABEL} (launchd, every ${existing.auth_refresh_interval_hours}h)`);
   } else if (IS_WIN) {
     // Register Task Scheduler entries and kick the server task now.
     const r = installWindowsServices({
@@ -283,6 +287,54 @@ async function cmdInit() {
     info('Start the server manually (see instructions above) then run `mobygate status`.');
   }
 
+  // ---- Auto-wire detected clients (Hermes, OpenClaw, etc.) ----
+  // Skip in non-interactive mode (--yes) — those flows shouldn't surprise
+  // the user by editing third-party config files. They can still run
+  // `mobygate connect --all --yes` explicitly afterward.
+  if (!nonInteractive) {
+    try {
+      const detected = await detectAllConnectors();
+      const present = detected.filter((d) => d.detection !== null);
+      if (present.length > 0) {
+        section('Detected clients');
+        for (const { connector, detection } of present) {
+          print(`  ${c.green('✓')} ${c.bold(connector.displayName)} ${c.dim('at ' + detection.configPath)}`);
+        }
+        print('');
+        const wire = await confirm('Auto-wire these to use mobygate?', true);
+        if (wire) {
+          for (const { connector } of present) {
+            try {
+              const plan = await connector.plan({
+                baseUrl: MOBY_BASE_URL,
+                apiKey: MOBY_API_KEY,
+                setDefault: true,
+              });
+              if (plan.skip) { warn(`${connector.displayName}: ${plan.reason}`); continue; }
+              for (const w of plan.warnings || []) warn(w);
+              const result = await connector.apply(plan);
+              if (result.applied) {
+                ok(`Wired ${connector.displayName} → ${result.configPath}`);
+                if (result.backupPath) print(c.dim(`  backup: ${result.backupPath}`));
+              } else {
+                warn(`${connector.displayName}: ${result.reason}`);
+              }
+            } catch (e) {
+              warn(`${connector.displayName}: ${e.message}`);
+            }
+          }
+          print('');
+          info('Restart the wired clients so they pick up the new provider.');
+        } else {
+          print(c.dim('Skipped — run `mobygate connect` later to wire them on demand.'));
+        }
+      }
+    } catch (e) {
+      // Detection failures should never block init.
+      warn(`Connector detection failed: ${e.message}`);
+    }
+  }
+
   section('Done');
   print(`Dashboard: ${c.cyan(`http://localhost:${port}`)}`);
   print(`Configure: ${c.cyan(CONFIG_PATH)}`);
@@ -320,25 +372,47 @@ function cmdStart() {
 }
 
 function cmdStop() {
+  // Stop BOTH services: the server AND the auth-refresh task. Earlier
+  // releases only stopped the server, leaving the 4-hourly auth-refresh
+  // cron free to fire mid-update and grab file handles in node_modules
+  // — that was the root cause of the v0.6/v0.7 EBUSY churn on Windows.
+  // We tolerate "not running" failures on both since the user just
+  // wants the end state of "nothing mobygate is running."
   if (IS_MAC) {
-    const p = plistPathForLabel(SERVER_LABEL);
-    launchctlUnload(p);
+    const serverPlist = plistPathForLabel(SERVER_LABEL);
+    const authPlist   = plistPathForLabel(AUTH_LABEL);
+    launchctlUnload(serverPlist);
+    launchctlUnload(authPlist);
     ok(`Unloaded ${SERVER_LABEL}`);
+    ok(`Unloaded ${AUTH_LABEL}`);
   } else if (IS_WIN) {
-    const r = stopWindowsTask(WIN_LABELS.server);
-    if (!r.ok) return die(`Failed to stop ${WIN_LABELS.server}: ${r.stderr || 'unknown'}`);
-    ok(`Stopped ${WIN_LABELS.server}`);
+    const rServer = stopWindowsTask(WIN_LABELS.server);
+    const rAuth   = stopWindowsTask(WIN_LABELS.auth);
+    if (rServer.ok) ok(`Stopped ${WIN_LABELS.server}`);
+    else warn(`${WIN_LABELS.server}: ${rServer.stderr || 'not running or already stopped'}`);
+    if (rAuth.ok) ok(`Stopped ${WIN_LABELS.auth}`);
+    else warn(`${WIN_LABELS.auth}: ${rAuth.stderr || 'not running or already stopped'}`);
   } else if (IS_LINUX) {
-    const r = stopLinuxUnit(LINUX_UNITS.server);
-    if (!r.ok) return die(`Failed to stop ${LINUX_UNITS.server}: ${r.stderr || 'unknown'}`);
-    ok(`Stopped ${LINUX_UNITS.server}`);
+    const rServer = stopLinuxUnit(LINUX_UNITS.server);
+    if (rServer.ok) ok(`Stopped ${LINUX_UNITS.server}`);
+    else warn(`${LINUX_UNITS.server}: ${rServer.stderr || 'not running or already stopped'}`);
+    if (LINUX_UNITS.timer) {
+      const rTimer = stopLinuxUnit(LINUX_UNITS.timer);
+      if (rTimer.ok) ok(`Stopped ${LINUX_UNITS.timer}`);
+    }
+    if (LINUX_UNITS.auth) {
+      const rAuth = stopLinuxUnit(LINUX_UNITS.auth);
+      if (rAuth.ok) ok(`Stopped ${LINUX_UNITS.auth}`);
+    }
   } else {
     die('`mobygate stop` not supported on this platform.');
   }
 }
 
 function cmdRestart() {
-  cmdStop();
+  // Tolerate cmdStop failure (target may already be stopped). Only die
+  // on cmdStart errors, which are the actually-blocking ones.
+  try { cmdStop(); } catch {}
   cmdStart();
 }
 
@@ -581,23 +655,23 @@ async function cmdUpdate() {
   }
   print('');
 
-  // ---- Stop the service FIRST on Windows, otherwise running Node holds
-  // open file handles inside the install dir and `npm install -g` fails
-  // with EBUSY when it tries to rename the directory. On macOS/Linux we
-  // can replace open files freely, but stopping early there too is harmless
-  // and gives a cleaner restart sequence — so we do it everywhere.
-  let stoppedForUpdate = false;
+  // ---- Stop BOTH services first (server + auth-refresh). The auth task
+  // imports mobygate code from the same node_modules dir, so if it fires
+  // mid-install on Windows it grabs file handles and triggers EBUSY.
+  // POSIX systems can replace open files freely, but stopping early there
+  // too is harmless and gives a cleaner restart sequence — so we do it
+  // everywhere. Tolerate "already stopped" failures silently.
+  info('Stopping services so npm install can replace files...');
   if (IS_WIN) {
-    info('Stopping service so npm install can replace files...');
     stopWindowsTask(WIN_LABELS.server);
-    stoppedForUpdate = true;
+    stopWindowsTask(WIN_LABELS.auth);
   } else if (IS_MAC) {
-    const p = plistPathForLabel(SERVER_LABEL);
-    launchctlUnload(p);
-    stoppedForUpdate = true;
+    launchctlUnload(plistPathForLabel(SERVER_LABEL));
+    launchctlUnload(plistPathForLabel(AUTH_LABEL));
   } else if (IS_LINUX) {
     stopLinuxUnit(LINUX_UNITS.server);
-    stoppedForUpdate = true;
+    if (LINUX_UNITS.timer) stopLinuxUnit(LINUX_UNITS.timer);
+    if (LINUX_UNITS.auth)  stopLinuxUnit(LINUX_UNITS.auth);
   }
 
   // ---- Perform the upgrade
@@ -618,40 +692,193 @@ async function cmdUpdate() {
     return die(`Install mode is "${mode}" — can't auto-update. Reinstall via npm or git.`);
   }
 
-  // ---- Bring the service back up on the new code
+  // ---- Bring services back up on the new code (server first, then
+  // auth-refresh — server is the load-bearing one; auth restart is
+  // best-effort since it'll naturally fire on its next interval anyway).
   section('Restart');
-  info('Starting service on the new build...');
+  info('Starting services on the new build...');
   if (IS_MAC) {
-    const p = plistPathForLabel(SERVER_LABEL);
-    launchctlLoad(p);
+    launchctlLoad(plistPathForLabel(SERVER_LABEL));
     ok(`Loaded ${SERVER_LABEL}`);
+    try { launchctlLoad(plistPathForLabel(AUTH_LABEL)); ok(`Loaded ${AUTH_LABEL}`); } catch {}
   } else if (IS_WIN) {
     startWindowsTask(WIN_LABELS.server);
     ok(`Started ${WIN_LABELS.server}`);
+    try { startWindowsTask(WIN_LABELS.auth); ok(`Started ${WIN_LABELS.auth}`); } catch {}
   } else if (IS_LINUX) {
     startLinuxUnit(LINUX_UNITS.server);
     ok(`Started ${LINUX_UNITS.server}`);
+    if (LINUX_UNITS.timer) { try { startLinuxUnit(LINUX_UNITS.timer); ok(`Started ${LINUX_UNITS.timer}`); } catch {} }
   }
   print('');
   info(`Tip: if the install-layout changed (new service file, new paths), run \`mobygate init\` to re-install the service definitions.`);
 }
 
+// ---------------------------------------------------------------------------
+// `mobygate connect` — auto-wire third-party clients to use mobygate.
+//
+// Detects supported clients (Hermes, OpenClaw) on the system, plans the
+// minimal config edit to register `moby` (OpenAI-compat) and/or
+// `moby-native` (Anthropic-messages) as a provider, and applies it
+// atomically with a backup. Idempotent — running twice doesn't duplicate
+// entries; running with --dry-run shows the planned diff without writing.
+//
+// Per-client adapters live in lib/connectors/<id>.js and follow a
+// uniform contract (detect/inspect/plan/apply/disconnect). Add a new
+// connector by writing the adapter and registering it in
+// lib/connectors/index.js#CONNECTORS.
+// ---------------------------------------------------------------------------
+
+function parseConnectArgs() {
+  // process.argv is [node, mobygate, connect, ...rest]
+  const rest = process.argv.slice(3);
+  const flags = new Set(rest.filter((a) => a.startsWith('-')));
+  const positional = rest.filter((a) => !a.startsWith('-'));
+  return {
+    targetId: positional[0] || null,
+    dryRun: flags.has('--dry-run'),
+    yes: flags.has('--yes') || flags.has('-y'),
+    all: flags.has('--all'),
+    noDefault: flags.has('--no-default'),
+  };
+}
+
+async function cmdConnect() {
+  const { targetId, dryRun, yes, all, noDefault } = parseConnectArgs();
+  section('mobygate connect');
+  if (dryRun) info('Dry-run mode — no files will be written.');
+
+  const detected = await detectAllConnectors();
+  const present = detected.filter((d) => d.detection !== null);
+
+  if (present.length === 0) {
+    print(c.dim('No supported clients detected. Currently we recognize:'));
+    for (const conn of CONNECTORS) {
+      print(c.dim(`  - ${conn.displayName}`));
+    }
+    print(c.dim('Install one and re-run `mobygate connect`.'));
+    return;
+  }
+
+  // Decide which clients to act on.
+  let targets;
+  if (targetId) {
+    const match = present.find((p) => p.connector.id === targetId.toLowerCase());
+    if (!match) return die(`Client "${targetId}" not detected. Detected: ${present.map((p) => p.connector.id).join(', ')}`);
+    targets = [match];
+  } else if (all || yes) {
+    targets = present;
+  } else {
+    print('');
+    print('Detected clients:');
+    for (const { connector, detection } of present) {
+      print(`  ${c.green('✓')} ${c.bold(connector.displayName)} ${c.dim('at ' + detection.configPath)}`);
+    }
+    print('');
+    const which = await prompt('Wire all? (Y / n / comma-separated ids)', 'Y');
+    const trimmed = which.trim().toLowerCase();
+    if (trimmed === 'n' || trimmed === 'no') return ok('Aborted — nothing changed.');
+    if (!trimmed || trimmed === 'y' || trimmed === 'yes') {
+      targets = present;
+    } else {
+      const ids = trimmed.split(',').map((s) => s.trim()).filter(Boolean);
+      targets = present.filter((p) => ids.includes(p.connector.id));
+      if (targets.length === 0) return die(`No detected clients matched "${which}".`);
+    }
+  }
+
+  // Plan + (maybe) apply per target.
+  for (const { connector } of targets) {
+    print('');
+    section(connector.displayName);
+    let plan;
+    try {
+      plan = await connector.plan({
+        baseUrl: MOBY_BASE_URL,
+        apiKey: MOBY_API_KEY,
+        setDefault: !noDefault,
+      });
+    } catch (e) {
+      warn(`plan failed: ${e.message}`);
+      continue;
+    }
+    if (plan.skip) { warn(plan.reason); continue; }
+
+    print(c.dim(`config: ${plan.configPath}`));
+    print('Changes:');
+    for (const line of plan.summary) {
+      const colored = line.startsWith('+') ? c.green(line) : line.startsWith('-') ? c.red(line) : c.cyan(line);
+      print('  ' + colored);
+    }
+    for (const w of plan.warnings || []) warn(w);
+
+    if (dryRun) { info('Dry-run — skipping write.'); continue; }
+
+    if (!yes) {
+      const ok2 = await confirm('Apply this change?', true);
+      if (!ok2) { warn('Skipped.'); continue; }
+    }
+
+    try {
+      const result = await connector.apply(plan);
+      if (result.applied) {
+        ok(`Wrote ${result.bytesWritten} bytes → ${result.configPath}`);
+        if (result.backupPath) print(c.dim(`  backup: ${result.backupPath}`));
+        info(`Restart ${connector.displayName} so it picks up the new provider.`);
+      } else {
+        warn(`Skipped: ${result.reason}`);
+      }
+    } catch (e) {
+      die(`apply failed: ${e.message}`);
+    }
+  }
+}
+
+async function cmdDisconnect() {
+  const targetId = process.argv[3];
+  if (!targetId) return die('Usage: mobygate disconnect <client-id>\nKnown ids: ' + CONNECTORS.map((c) => c.id).join(', '));
+  const conn = getConnector(targetId.toLowerCase());
+  if (!conn) return die(`No connector for "${targetId}". Known: ${CONNECTORS.map((c) => c.id).join(', ')}`);
+  section(`mobygate disconnect ${conn.displayName}`);
+  let result;
+  try {
+    result = await conn.disconnect();
+  } catch (e) {
+    return die(`disconnect failed: ${e.message}`);
+  }
+  if (result.applied) {
+    ok(`Removed moby entries from ${conn.displayName}`);
+    if (result.backupPath) print(c.dim(`  backup: ${result.backupPath}`));
+    if (result.note) info(result.note);
+    info(`Restart ${conn.displayName} so the change takes effect.`);
+  } else {
+    warn(result.reason);
+  }
+}
+
 function usage() {
   print(`mobygate — OpenAI → Claude Max local gateway
 
 Usage:
-  mobygate init       Interactive setup (add --yes to skip prompts,
-                      --no-browser to not auto-open the dashboard)
-  mobygate update     Upgrade to the latest version + restart service
-  mobygate doctor     Diagnose version mismatches, zombie services, port conflicts
-  mobygate start      Start the proxy service
-  mobygate stop       Stop the proxy service
-  mobygate restart    Stop + start
-  mobygate status     Show service + auth + /health state
-  mobygate logs       Tail the server log
-  mobygate auth       Show auth status + run a refresh probe
-  mobygate uninstall  Remove installed services
-  mobygate version    Print version + install mode + path
+  mobygate init        Interactive setup (add --yes to skip prompts,
+                       --no-browser to not auto-open the dashboard)
+  mobygate update      Upgrade to the latest version + restart service
+  mobygate doctor      Diagnose version mismatches, zombie services, port conflicts
+  mobygate start       Start the proxy service
+  mobygate stop        Stop the proxy service
+  mobygate restart     Stop + start
+  mobygate status      Show service + auth + /health state
+  mobygate logs        Tail the server log
+  mobygate auth        Show auth status + run a refresh probe
+  mobygate connect     Auto-wire detected clients (Hermes, OpenClaw) to
+                       use mobygate. Add: <id> for one client, --all for
+                       every detected, --dry-run to preview, --yes to
+                       skip prompts, --no-default to register without
+                       changing the active model.
+  mobygate disconnect  Remove moby entries from a client config.
+                       Usage: mobygate disconnect <client-id>
+  mobygate uninstall   Remove installed services
+  mobygate version     Print version + install mode + path
 
 Config: ~/.mobygate/config.yaml  (env vars override)
 Repo:   ${REPO_ROOT}
@@ -663,6 +890,8 @@ Repo:   ${REPO_ROOT}
 const cmd = process.argv[2];
 const COMMANDS = {
   init: cmdInit,
+  connect: cmdConnect,
+  disconnect: cmdDisconnect,
   update: cmdUpdate,
   upgrade: cmdUpdate,
   doctor: cmdDoctor,

package/lib/anthropic.js

@@ -112,15 +112,26 @@ export function anthropicMessagesToPrompt(body, { resuming = false } = {}) {
     // SDK has full history. Send only the new tail: tool_results from
     // the last user message (if any) plus any fresh user text.
     const last = messages[messages.length - 1];
-    if (!last || last.role !== 'user') return '';
+    if (!last || last.role !== 'user') {
+      return {
+        promptText: '',
+        error: 'Resume mode requires the last message to be from the user. Last message has role "' + (last?.role || 'none') + '".',
+      };
+    }
     const trBlocks = anthropicToolResultsOf(last.content);
     const text = anthropicTextOf(last.content);
+    if (!trBlocks.length && !text) {
+      return {
+        promptText: '',
+        error: 'Resume mode requires the last user message to contain text or tool_result blocks.',
+      };
+    }
     const parts = [];
     if (trBlocks.length) {
       parts.push(`<tool_results>\n${trBlocks.map(formatToolResultBlock).join('\n')}\n</tool_results>`);
     }
     if (text) parts.push(text);
-    return parts.join('\n\n');
+    return { promptText: parts.join('\n\n') };
   }
 
   // Fresh request: serialize visible history. System prompt at top, then
@@ -154,7 +165,7 @@ export function anthropicMessagesToPrompt(body, { resuming = false } = {}) {
     }
   }
   flushTools();
-  return parts.join('\n').trim();
+  return { promptText: parts.join('\n').trim() };
 }
 
 /**