fix: address code review findings

- Critical: teardown now runs on non-zero agent exit (os.Exit moved
  after cleanup, signal goroutine properly closed)
- Discovery endpoint cached after first call, uses context
- Token expiry floor prevents hot-loop on short-lived tokens
- Remove dead code: initTemplate, startTime, traceID, unused httpClient
- Fix os.Getenv("GOOS") → runtime.GOOS
- README: fix stale REST endpoint reference
- Use http.DefaultTransport explicitly

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: tumberger

README.md

@@ -111,7 +111,7 @@ Session lifecycle and tool call events flow to the Kontext backend. This powers
 | `hook.post_tool_call` | PostToolUse hook | After every tool execution |
 | `hook.user_prompt` | UserPromptSubmit hook | User submits a prompt |
 
-Events are ingested to the `mcp_events` table via `POST /api/v1/mcp-events`. Each session gets a `traceId` for grouping events in the traces view.
+Events are streamed to the backend via the ConnectRPC `ProcessHookEvent` bidirectional stream and stored in the `mcp_events` table.
 
 **What governance telemetry captures:**
 - What the agent tried to do (tool name + input)

internal/backend/backend.go

@@ -73,23 +73,21 @@ func envOr(key, fallback string) string {
 
 // Client wraps the ConnectRPC AgentService client with token management.
 type Client struct {
-	rpc    agentv1connect.AgentServiceClient
-	config *Config
-	token  string
-	tokenExp time.Time
-	mu     sync.Mutex
+	rpc           agentv1connect.AgentServiceClient
+	config        *Config
+	token         string
+	tokenExp      time.Time
+	tokenEndpoint string
+	mu            sync.Mutex
 }
 
 // NewClient creates a ConnectRPC client for the Kontext AgentService.
 func NewClient(config *Config) *Client {
-	httpClient := &http.Client{Timeout: 30 * time.Second}
-
 	c := &Client{config: config}
 
-	// Wrap the HTTP client with an auth interceptor
 	authClient := &http.Client{
 		Timeout:   30 * time.Second,
-		Transport: &authTransport{client: c, base: httpClient.Transport},
+		Transport: &authTransport{client: c, base: http.DefaultTransport},
 	}
 
 	c.rpc = agentv1connect.NewAgentServiceClient(
@@ -153,22 +151,14 @@ func (c *Client) getToken(ctx context.Context) (string, error) {
 		return c.token, nil
 	}
 
-	// Discover token endpoint
-	resp, err := http.Get(c.config.BaseURL + "/.well-known/oauth-authorization-server")
+	// Discover token endpoint (cached after first call)
+	tokenEndpoint, err := c.discoverTokenEndpoint(ctx)
 	if err != nil {
-		return "", fmt.Errorf("discovery: %w", err)
-	}
-	defer resp.Body.Close()
-
-	var meta struct {
-		TokenEndpoint string `json:"token_endpoint"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&meta); err != nil {
-		return "", fmt.Errorf("decode discovery: %w", err)
+		return "", err
 	}
 
 	// Client credentials flow
-	req, err := http.NewRequestWithContext(ctx, "POST", meta.TokenEndpoint,
+	req, err := http.NewRequestWithContext(ctx, "POST", tokenEndpoint,
 		strings.NewReader("grant_type=client_credentials&scope=management:all+mcp:invoke"))
 	if err != nil {
 		return "", err
@@ -195,15 +185,43 @@ func (c *Client) getToken(ctx context.Context) (string, error) {
 	}
 
 	c.token = tokenData.AccessToken
-	if tokenData.ExpiresIn > 0 {
-		c.tokenExp = time.Now().Add(time.Duration(tokenData.ExpiresIn-60) * time.Second)
-	} else {
-		c.tokenExp = time.Now().Add(50 * time.Minute)
+	bufferSec := tokenData.ExpiresIn - 60
+	if bufferSec < 10 {
+		bufferSec = 10
 	}
+	c.tokenExp = time.Now().Add(time.Duration(bufferSec) * time.Second)
 
 	return c.token, nil
 }
 
+func (c *Client) discoverTokenEndpoint(ctx context.Context) (string, error) {
+	if c.tokenEndpoint != "" {
+		return c.tokenEndpoint, nil
+	}
+
+	req, err := http.NewRequestWithContext(ctx, "GET",
+		c.config.BaseURL+"/.well-known/oauth-authorization-server", nil)
+	if err != nil {
+		return "", err
+	}
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return "", fmt.Errorf("discovery: %w", err)
+	}
+	defer resp.Body.Close()
+
+	var meta struct {
+		TokenEndpoint string `json:"token_endpoint"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&meta); err != nil {
+		return "", fmt.Errorf("decode discovery: %w", err)
+	}
+
+	c.tokenEndpoint = meta.TokenEndpoint
+	return c.tokenEndpoint, nil
+}
+
 // authTransport injects the bearer token into every request.
 type authTransport struct {
 	client *Client

internal/run/run.go

@@ -9,12 +9,12 @@ import (
 	"os/exec"
 	"os/signal"
 	"path/filepath"
+	"runtime"
 	"strings"
 	"syscall"
 	"time"
 
 	"github.com/cli/browser"
-	"github.com/google/uuid"
 
 	agentv1 "github.com/kontext-dev/kontext-cli/gen/kontext/agent/v1"
 	"github.com/kontext-dev/kontext-cli/internal/auth"
@@ -67,7 +67,7 @@ func Start(ctx context.Context, opts Options) error {
 		Cwd:      cwd,
 		ClientInfo: map[string]string{
 			"name": "kontext-cli",
-			"os":   fmt.Sprintf("%s", os.Getenv("GOOS")),
+			"os":   runtime.GOOS,
 		},
 	})
 	if err != nil {
@@ -79,13 +79,11 @@ func Start(ctx context.Context, opts Options) error {
 	sessionID := createResp.SessionId
 	fmt.Fprintf(os.Stderr, "✓ Session: %s (%s)\n", createResp.SessionName, sessionID[:8])
 
-	traceID := uuid.New().String()
-
 	// 4. Start sidecar
 	sessionDir := filepath.Join(os.TempDir(), "kontext", sessionID)
 	os.MkdirAll(sessionDir, 0700)
 
-	sc, err := sidecar.New(sessionDir, client, sessionID, traceID, opts.Agent)
+	sc, err := sidecar.New(sessionDir, client, sessionID, opts.Agent)
 	if err != nil {
 		return fmt.Errorf("sidecar: %w", err)
 	}
@@ -123,18 +121,23 @@ func Start(ctx context.Context, opts Options) error {
 
 	// 8. Launch agent with hooks
 	fmt.Fprintf(os.Stderr, "\nLaunching %s...\n\n", opts.Agent)
-	startTime := time.Now()
 	agentErr := launchAgentWithSettings(ctx, opts.Agent, env, opts.Args, settingsPath)
 
-	// 9. Teardown
-	_ = time.Since(startTime)
+	// 9. Teardown (always runs, even on non-zero agent exit)
 	endCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
 	_ = client.EndSession(endCtx, sessionID)
 	fmt.Fprintf(os.Stderr, "\n✓ Session ended (%s)\n", sessionID[:8])
 
 	os.RemoveAll(sessionDir)
+
+	// Propagate agent exit code
+	if agentErr != nil {
+		if exitErr, ok := agentErr.(*exec.ExitError); ok {
+			os.Exit(exitErr.ExitCode())
+		}
+	}
 	return agentErr
 }
 
@@ -158,44 +161,6 @@ func ensureSession(ctx context.Context, issuerURL, clientID string) (*auth.Sessi
 	return result.Session, nil
 }
 
-// initTemplate interactively creates a .env.kontext on first run.
-func initTemplate(path string) error {
-	providers := []struct {
-		Name   string
-		EnvVar string
-		Handle string
-	}{
-		{"GitHub", "GITHUB_TOKEN", "github"},
-		{"Google Workspace", "GOOGLE_TOKEN", "google-workspace"},
-		{"Stripe", "STRIPE_KEY", "stripe"},
-		{"Linear", "LINEAR_API_KEY", "linear"},
-		{"Slack", "SLACK_TOKEN", "slack"},
-		{"PostgreSQL", "DATABASE_URL", "postgres"},
-	}
-
-	fmt.Fprintln(os.Stderr, "\nNo .env.kontext found. Which providers does this project need?")
-	reader := bufio.NewReader(os.Stdin)
-
-	var lines []string
-	for _, p := range providers {
-		fmt.Fprintf(os.Stderr, "  %s? [y/N] ", p.Name)
-		input, _ := reader.ReadString('\n')
-		if strings.TrimSpace(strings.ToLower(input)) == "y" {
-			lines = append(lines, fmt.Sprintf("%s={{kontext:%s}}", p.EnvVar, p.Handle))
-		}
-	}
-
-	if len(lines) == 0 {
-		lines = append(lines, "# Add providers: VAR_NAME={{kontext:provider-handle}}")
-	}
-
-	if err := os.WriteFile(path, []byte(strings.Join(lines, "\n")+"\n"), 0644); err != nil {
-		return fmt.Errorf("write %s: %w", path, err)
-	}
-	fmt.Fprintf(os.Stderr, "✓ Wrote %s\n\n", path)
-	return nil
-}
-
 // resolveCredentials exchanges each template entry for a live credential.
 func resolveCredentials(ctx context.Context, session *auth.Session, entries []credential.Entry) ([]credential.Resolved, error) {
 	fmt.Fprintln(os.Stderr, "\nResolving credentials...")
@@ -279,14 +244,9 @@ func launchAgentWithSettings(_ context.Context, agentName string, env, extraArgs
 
 	err = cmd.Wait()
 	signal.Stop(sigCh)
+	close(sigCh)
 
-	if err != nil {
-		if exitErr, ok := err.(*exec.ExitError); ok {
-			os.Exit(exitErr.ExitCode())
-		}
-		return err
-	}
-	return nil
+	return err
 }
 
 func filterArgs(args []string) []string {

internal/sidecar/sidecar.go

@@ -20,18 +20,16 @@ type Server struct {
 	socketPath string
 	listener   net.Listener
 	sessionID  string
-	traceID    string
 	agentName  string
 	client     *backend.Client
 	cancel     context.CancelFunc
 }
 
 // New creates a new sidecar server.
-func New(sessionDir string, client *backend.Client, sessionID, traceID, agentName string) (*Server, error) {
+func New(sessionDir string, client *backend.Client, sessionID, agentName string) (*Server, error) {
 	return &Server{
 		socketPath: filepath.Join(sessionDir, "kontext.sock"),
 		sessionID:  sessionID,
-		traceID:    traceID,
 		agentName:  agentName,
 		client:     client,
 	}, nil