npm - @algosuite/vo-mcp - Versions diffs - 0.2.0-beta.2 → 0.2.0-beta.21 - Mend

@algosuite/vo-mcp 0.2.0-beta.2 → 0.2.0-beta.21

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (26) hide show

package/README.md +178 -153
package/bin/vo-mcp +44 -38
package/dist/autostart-cli.js +104 -14
package/dist/autostart-cli.js.map +2 -2
package/dist/ci/check-local-pr-overlap.js +102449 -0
package/dist/cli.js +1880 -786
package/dist/cli.js.map +4 -4
package/dist/index.js +869 -129
package/dist/index.js.map +4 -4
package/dist/install-cli.js +365 -327
package/dist/install-cli.js.map +4 -4
package/dist/login-cli.js +4 -4
package/dist/login-cli.js.map +2 -2
package/dist/pair-cli.js +1 -1
package/dist/pair-cli.js.map +2 -2
package/dist/runner-cli.js +9605 -1946
package/dist/runner-cli.js.map +4 -4
package/dist/runner-supervisor.js +2333 -0
package/dist/runner-supervisor.js.map +7 -0
package/dist/set-key-cli.js +44 -4
package/dist/set-key-cli.js.map +2 -2
package/dist/supervisor-credential-helper.js +233 -0
package/dist/supervisor-credential-helper.js.map +7 -0
package/dist/update-cli.js +125 -0
package/dist/update-cli.js.map +7 -0
package/package.json +4 -2

package/dist/install-cli.js CHANGED Viewed

@@ -2,15 +2,13 @@
 import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
 // src/install.ts
-import { homedir as homedir3, platform as platform2 } from "node:os";
-import { join as join3, dirname as dirname2 } from "node:path";
-import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3, copyFileSync as copyFileSync2 } from "node:fs";
-import { resolve } from "node:path";
+import { homedir as homedir3, platform as platform3 } from "node:os";
+import { join as join4, dirname as dirname3 } from "node:path";
+import { existsSync as existsSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4, mkdirSync as mkdirSync4, copyFileSync as copyFileSync3 } from "node:fs";
+import { fileURLToPath } from "node:url";
-// src/cloud/login.ts
-import { createServer } from "node:http";
-import { randomBytes } from "node:crypto";
-import { spawn } from "node:child_process";
+// src/cloud/pairing.ts
+import { hostname, platform } from "node:os";
 // src/cloud/credential-store.ts
 import { homedir } from "node:os";
@@ -125,287 +123,264 @@ function writeStoredCredential(cred, storedAt, env = process.env, keychain = rea
   return p;
 }
-// src/cloud/login.ts
+// src/cloud/pairing.ts
+var DEFAULT_CONTROL_PLANE_URL = "https://vo-control-plane-bzjphrajaq-uc.a.run.app";
 var DEFAULT_DASHBOARD_URL = "https://algosuite.ai";
-var DEFAULT_TIMEOUT_MS = 12e4;
-var MAX_BODY_BYTES = 16384;
-function processCapture(rawBody, expectedState, store) {
-  let data;
-  try {
-    data = JSON.parse(rawBody);
-  } catch {
-    return { ok: false, httpStatus: 400, error: "invalid JSON body" };
-  }
-  if (!data || typeof data !== "object") return { ok: false, httpStatus: 400, error: "invalid body" };
-  if (typeof data.state !== "string" || data.state !== expectedState) {
-    return { ok: false, httpStatus: 403, error: "state mismatch (possible CSRF) \u2014 login aborted" };
-  }
-  const refresh = typeof data.refresh_token === "string" ? data.refresh_token.trim() : "";
-  const apiKey = typeof data.api_key === "string" ? data.api_key.trim() : "";
-  if (!refresh || !apiKey) {
-    return { ok: false, httpStatus: 400, error: "login response missing refresh_token / api_key" };
-  }
-  const email = typeof data.email === "string" && data.email.trim() ? data.email.trim() : void 0;
-  const path = store({ refresh_token: refresh, api_key: apiKey, ...email ? { email } : {} });
-  return {
-    ok: true,
-    httpStatus: 200,
-    result: { ...email ? { email } : {}, credentialPath: path },
-    captured: { refresh_token: refresh, api_key: apiKey, ...email ? { email } : {} }
-  };
+function formatPairingCode(code) {
+  return code.length === 8 ? `${code.slice(0, 4)}-${code.slice(4)}` : code;
 }
-function captureHtml() {
-  return `<!doctype html><html><head><meta charset="utf-8"><title>VO login</title></head>
-<body style="font-family:system-ui;max-width:32rem;margin:4rem auto;text-align:center">
-<h2 id="m">Completing sign-in\u2026</h2>
-<script>
-(function(){
-  var h=location.hash.replace(/^#/,''), p=new URLSearchParams(h), b={};
-  ['state','refresh_token','api_key','email'].forEach(function(k){ if(p.get(k)) b[k]=p.get(k); });
-  fetch('/capture',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify(b)})
-    .then(function(r){ document.getElementById('m').textContent = r.ok ? 'Sign-in complete \u2014 you can close this tab.' : 'Sign-in failed \u2014 check the terminal.'; })
-    .catch(function(){ document.getElementById('m').textContent = 'Sign-in failed \u2014 check the terminal.'; });
-})();
-</script></body></html>`;
-}
-function defaultOpenBrowser(url) {
-  const platform3 = process.platform;
-  if (platform3 === "win32") {
-    spawn("cmd", ["/c", "start", "", url], { detached: true, stdio: "ignore" }).unref();
-  } else if (platform3 === "darwin") {
-    spawn("open", [url], { detached: true, stdio: "ignore" }).unref();
-  } else {
-    spawn("xdg-open", [url], { detached: true, stdio: "ignore" }).unref();
-  }
+async function readJson(res) {
+  const body = await res.json().catch(() => ({}));
+  return body && typeof body === "object" ? body : {};
 }
-async function runLogin(opts = {}) {
-  const env = opts.env ?? process.env;
-  const dashboardUrl = (opts.dashboardUrl ?? env["VO_DASHBOARD_URL"]?.trim() ?? DEFAULT_DASHBOARD_URL).replace(/\/+$/, "") || DEFAULT_DASHBOARD_URL;
-  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  const log = opts.log ?? ((m) => console.error(m));
-  const nowIso = opts.nowIso ?? (() => (/* @__PURE__ */ new Date()).toISOString());
-  const openBrowser = opts.openBrowser ?? defaultOpenBrowser;
-  const state = randomBytes(32).toString("base64url");
-  return new Promise((resolve2, reject) => {
-    let settled = false;
-    const finish = (err, result) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      server.close();
-      if (err) reject(err);
-      else resolve2(result);
-    };
-    const server = createServer((req, res) => {
-      const url = new URL(req.url ?? "/", "http://127.0.0.1");
-      if (req.method === "GET" && url.pathname === "/callback") {
-        res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
-        res.end(captureHtml());
-        return;
-      }
-      if (req.method === "POST" && url.pathname === "/capture") {
-        let body = "";
-        req.on("data", (chunk) => {
-          body += chunk.toString("utf8");
-          if (body.length > MAX_BODY_BYTES) req.destroy();
-        });
-        req.on("end", () => {
-          void (async () => {
-            if (body.length > MAX_BODY_BYTES) {
-              res.writeHead(413, { "content-type": "text/plain" });
-              res.end("payload too large");
-              finish(new Error("login request body exceeded the size cap"));
-              return;
-            }
-            const writeNow = (cred) => writeStoredCredential(cred, nowIso(), env);
-            const outcome = processCapture(body, state, opts.exchange ? () => "pending" : writeNow);
-            let result = outcome.result;
-            if (outcome.ok && outcome.captured && opts.exchange) {
-              const capt = outcome.captured;
-              let cred = {
-                refresh_token: capt.refresh_token,
-                api_key: capt.api_key,
-                ...capt.email ? { email: capt.email } : {}
-              };
-              try {
-                const voc = await opts.exchange(capt.refresh_token, capt.api_key);
-                if (voc && voc.vo_credential) {
-                  cred = {
-                    vo_credential: voc.vo_credential,
-                    vo_credential_expires_at: voc.expires_at,
-                    ...capt.email ? { email: capt.email } : {}
-                  };
-                }
-              } catch {
-              }
-              const path = writeNow(cred);
-              result = { ...capt.email ? { email: capt.email } : {}, credentialPath: path };
-            }
-            res.writeHead(outcome.httpStatus, { "content-type": "text/html; charset=utf-8" });
-            res.end(outcome.ok ? "<h2>VO login complete \u2014 you can close this tab.</h2>" : `<h2>Login failed: ${outcome.error}</h2>`);
-            finish(outcome.ok ? null : new Error(outcome.error ?? "login failed"), result);
-          })();
-        });
-        return;
-      }
-      res.writeHead(404);
-      res.end("not found");
-    });
-    const timer = setTimeout(
-      () => finish(new Error(`login timed out after ${timeoutMs}ms \u2014 no sign-in captured`)),
-      timeoutMs
-    );
-    server.on("error", (e) => finish(e));
-    server.listen(0, "127.0.0.1", () => {
-      const addr = server.address();
-      const port = addr && typeof addr === "object" ? addr.port : 0;
-      if (!port) {
-        finish(new Error("failed to bind a loopback port"));
-        return;
-      }
-      const loginUrl = `${dashboardUrl}/cli-login?port=${port}&state=${encodeURIComponent(state)}`;
-      log(`[vo-mcp] Opening your browser to sign in:
-  ${loginUrl}`);
-      log("[vo-mcp] If it did not open, paste that URL into your browser. Waiting for sign-in\u2026");
-      try {
-        openBrowser(loginUrl);
-      } catch {
-      }
-    });
+async function runPairing(deps = {}) {
+  const env = deps.env ?? process.env;
+  const log = deps.log ?? ((m) => console.error(m));
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  const store = deps.store ?? ((cred, iso) => writeStoredCredential(cred, iso, env));
+  const controlPlaneUrl = env["VO_CONTROL_PLANE_URL"]?.trim() || DEFAULT_CONTROL_PLANE_URL;
+  const dashboardUrl = env["VO_DASHBOARD_URL"]?.trim() || DEFAULT_DASHBOARD_URL;
+  const deviceLabel = `${platform()} on ${hostname()}`.slice(0, 120);
+  const initRes = await fetchImpl(`${controlPlaneUrl}/api/v1/pair/initiate`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ device_label: deviceLabel })
   });
-}
-// src/cloud/auth-token-source.ts
-var FIREBASE_SECURETOKEN_URL = "https://securetoken.googleapis.com/v1/token";
-var FIREBASE_TOKEN_REFERER = "https://algosuite.ai/";
-var REFRESH_SKEW_MS = 6e4;
-function createFirebaseRefreshTokenSource(opts) {
-  const refreshToken = opts.refreshToken.trim();
-  const apiKey = opts.apiKey.trim();
-  const now = opts.now ?? (() => Date.now());
-  const fetchFn = opts.fetchFn ?? globalThis.fetch;
-  let cachedToken = null;
-  let expiresAtMs = 0;
-  let inFlight = null;
-  async function refresh() {
-    try {
-      const res = await fetchFn(`${FIREBASE_SECURETOKEN_URL}?key=${encodeURIComponent(apiKey)}`, {
-        method: "POST",
-        headers: {
-          "content-type": "application/x-www-form-urlencoded",
-          referer: FIREBASE_TOKEN_REFERER
+  if (!initRes.ok) throw new Error(`Could not start pairing (server ${initRes.status}).`);
+  const init = await readJson(initRes);
+  const code = String(init["code"] ?? "");
+  const pollToken = String(init["poll_token"] ?? "");
+  if (!code || !pollToken) throw new Error("Pairing service returned an incomplete response.");
+  const intervalMs = (Number(init["poll_interval_seconds"]) || 5) * 1e3;
+  const expiresAtMs = new Date(String(init["expires_at"] ?? "")).getTime();
+  log("");
+  log("  To connect this runner, open this page in your browser:");
+  log(`    ${dashboardUrl}/pair`);
+  log("  and enter this code:");
+  log("");
+  log(`      ${formatPairingCode(code)}`);
+  log("");
+  log("  Your Anthropic key never leaves this computer. Waiting for you to authorize\u2026");
+  for (; ; ) {
+    if (Number.isFinite(expiresAtMs) && now().getTime() >= expiresAtMs) {
+      throw new Error("The pairing code expired before it was authorized. Run `vo-mcp pair` again.");
+    }
+    await sleep(intervalMs);
+    const pollRes = await fetchImpl(`${controlPlaneUrl}/api/v1/pair/poll`, {
+      method: "GET",
+      headers: { "x-vo-poll-token": pollToken }
+    });
+    if (pollRes.status === 404) {
+      throw new Error("The pairing expired. Run `vo-mcp pair` again.");
+    }
+    if (pollRes.status === 410) {
+      throw new Error("This code was already used. Run `vo-mcp pair` again.");
+    }
+    if (!pollRes.ok) {
+      continue;
+    }
+    const body = await readJson(pollRes);
+    if (body["status"] === "pending") continue;
+    if (body["status"] === "authorized" && typeof body["vo_credential"] === "string") {
+      const credentialPath2 = store(
+        {
+          vo_credential: body["vo_credential"],
+          ...typeof body["expires_at"] === "string" ? { vo_credential_expires_at: body["expires_at"] } : {}
         },
-        body: `grant_type=refresh_token&refresh_token=${encodeURIComponent(refreshToken)}`
-      });
-      const text = await res.text();
-      if (res.status < 200 || res.status >= 300) {
-        cachedToken = null;
-        return null;
-      }
-      const parsed = JSON.parse(text);
-      const idToken = typeof parsed.id_token === "string" ? parsed.id_token : "";
-      if (!idToken) {
-        cachedToken = null;
-        return null;
-      }
-      const expiresInSec = Number(parsed.expires_in);
-      const ttlMs = Number.isFinite(expiresInSec) && expiresInSec > 0 ? expiresInSec * 1e3 : 36e5;
-      cachedToken = idToken;
-      expiresAtMs = now() + ttlMs;
-      return idToken;
-    } catch {
-      cachedToken = null;
-      return null;
+        now().toISOString()
+      );
+      return { credentialPath: credentialPath2, expires_at: String(body["expires_at"] ?? "") };
     }
+    throw new Error("Unexpected response from the pairing service.");
   }
-  return {
-    kind: "firebase-refresh",
-    async getToken() {
-      if (cachedToken && now() < expiresAtMs - REFRESH_SKEW_MS) return cachedToken;
-      if (!inFlight) {
-        inFlight = refresh().finally(() => {
-          inFlight = null;
-        });
-      }
-      return inFlight;
-    }
-  };
 }
-// src/cloud/vo-credential-exchange.ts
-async function exchangeForVoCredential(opts) {
-  const base = opts.controlPlaneUrl.replace(/\/+$/, "");
-  if (!base) return null;
-  const fetchFn = opts.fetchFn ?? globalThis.fetch;
+// src/codex-mcp-config.ts
+import { copyFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname2, join as join2 } from "node:path";
+var MANAGED_BEGIN = "# BEGIN AlgoHQ MCP (managed by vo-mcp install)";
+var MANAGED_END = "# END AlgoHQ MCP (managed by vo-mcp install)";
+var MANAGED_SERVER_NAMES = /* @__PURE__ */ new Set(["algohq", "vo", "vo-mcp", "vo_mcp"]);
+function resolveCodexConfigPath(home) {
+  return join2(home, ".codex", "config.toml");
+}
+function normalizeKey(value) {
+  const trimmed = value.trim();
+  if (trimmed.startsWith('"') && trimmed.endsWith('"') || trimmed.startsWith("'") && trimmed.endsWith("'")) {
+    return trimmed.slice(1, -1);
+  }
+  return trimmed;
+}
+function tablePath(line) {
+  const match = /^\s*\[([^\r\n]+)\]\s*(?:#.*)?$/.exec(line);
+  const rawPath = match?.[1];
+  if (!rawPath || rawPath.includes("[") || rawPath.includes("]")) return null;
+  return rawPath.split(".").map(normalizeKey);
+}
+function tableSections(lines) {
+  const starts = [];
+  for (let index = 0; index < lines.length; index += 1) {
+    const path = tablePath(lines[index] ?? "");
+    if (path) starts.push({ path, start: index });
+  }
+  return starts.map((section, index) => ({
+    ...section,
+    end: starts[index + 1]?.start ?? lines.length
+  }));
+}
+function isManagedSection(section) {
+  return section.path[0] === "mcp_servers" && MANAGED_SERVER_NAMES.has(section.path[1] ?? "");
+}
+function assignmentKey(line) {
+  const match = /^\s*((?:[A-Za-z0-9_-]+)|(?:"[^"]+")|(?:'[^']+'))\s*=/.exec(line);
+  return match?.[1] ? normalizeKey(match[1]) : null;
+}
+function isStructurallySafeToml(raw) {
+  const lines = raw.split(/\r?\n/);
+  const beginIndexes = lines.flatMap((line, index) => line.trim() === MANAGED_BEGIN ? [index] : []);
+  const endIndexes = lines.flatMap((line, index) => line.trim() === MANAGED_END ? [index] : []);
+  if (beginIndexes.length !== endIndexes.length || beginIndexes.length > 1) return false;
+  if (beginIndexes[0] !== void 0 && (endIndexes[0] ?? -1) <= beginIndexes[0]) return false;
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (/^\[\[?mcp_servers(?:\.|\s|$)/.test(trimmed) && tablePath(line) === null) return false;
+  }
+  return true;
+}
+function tomlString(value) {
+  return JSON.stringify(value);
+}
+function preservedSectionLines(lines, section, managedKeys) {
+  if (!section) return [];
+  return lines.slice(section.start + 1, section.end).filter((line) => {
+    if (line.trim() === MANAGED_BEGIN || line.trim() === MANAGED_END) return false;
+    const key = assignmentKey(line);
+    return key === null || !managedKeys.has(key);
+  }).filter((line, index, all) => line.trim() !== "" || index > 0 && index < all.length - 1);
+}
+function renderCodexMcpConfig(raw, cliPath, controlPlaneUrl) {
+  if (!isStructurallySafeToml(raw)) {
+    throw new Error("Codex config is malformed; refusing to overwrite it");
+  }
+  const eol = raw.includes("\r\n") ? "\r\n" : "\n";
+  const lines = raw.split(/\r?\n/);
+  const sections = tableSections(lines);
+  const rootSections = sections.filter((section) => isManagedSection(section) && section.path.length === 2);
+  const preferredRoot = rootSections.find((section) => section.path[1] === "algohq") ?? rootSections[0];
+  const preferredName = preferredRoot?.path[1];
+  const envSection = sections.find((section) => isManagedSection(section) && section.path[1] === preferredName && section.path[2] === "env");
+  const rootExtras = preservedSectionLines(lines, preferredRoot, /* @__PURE__ */ new Set(["command", "args", "required"]));
+  const envExtras = preservedSectionLines(lines, envSection, /* @__PURE__ */ new Set(["VO_CONTROL_PLANE_URL"]));
+  const removed = /* @__PURE__ */ new Set();
+  const managedBegin = lines.findIndex((line) => line.trim() === MANAGED_BEGIN);
+  const managedEnd = lines.findIndex((line) => line.trim() === MANAGED_END);
+  if (managedBegin >= 0 && managedEnd >= managedBegin) {
+    for (let index = managedBegin; index <= managedEnd; index += 1) removed.add(index);
+  }
+  for (const section of sections.filter(isManagedSection)) {
+    for (let index = section.start; index < section.end; index += 1) removed.add(index);
+  }
+  const base = lines.filter((_line, index) => !removed.has(index)).join(eol).trimEnd();
+  const block = [
+    MANAGED_BEGIN,
+    "[mcp_servers.algohq]",
+    'command = "node"',
+    `args = [${tomlString(cliPath)}]`,
+    "required = true",
+    ...rootExtras,
+    "",
+    "[mcp_servers.algohq.env]",
+    `VO_CONTROL_PLANE_URL = ${tomlString(controlPlaneUrl)}`,
+    ...envExtras,
+    MANAGED_END
+  ].join(eol);
+  return `${base}${base ? `${eol}${eol}` : ""}${block}${eol}`;
+}
+function installCodexMcpConfigAt(configPath, cliPath, controlPlaneUrl, log) {
+  const exists = existsSync2(configPath);
+  const raw = exists ? readFileSync2(configPath, "utf8") : "";
+  let rendered;
   try {
-    const idToken = await createFirebaseRefreshTokenSource({
-      refreshToken: opts.refreshToken,
-      apiKey: opts.apiKey,
-      ...opts.fetchFn ? { fetchFn: opts.fetchFn } : {}
-    }).getToken();
-    if (!idToken) return null;
-    const res = await fetchFn(`${base}/api/v1/auth/vo-credential`, {
-      method: "POST",
-      headers: { "content-type": "application/json", authorization: `Bearer ${idToken}` },
-      body: JSON.stringify(opts.label ? { label: opts.label } : {})
-    });
-    if (res.status !== 200) return null;
-    const parsed = JSON.parse(await res.text());
-    const token = typeof parsed.token === "string" ? parsed.token : "";
-    const expiresAt = typeof parsed.expires_at === "string" ? parsed.expires_at : "";
-    if (!token.startsWith("vocred_") || !expiresAt) return null;
-    return { vo_credential: token, expires_at: expiresAt };
-  } catch {
-    return null;
+    rendered = renderCodexMcpConfig(raw, cliPath, controlPlaneUrl);
+  } catch (error) {
+    if (exists) {
+      const backupPath = `${configPath}.backup-${Date.now()}`;
+      copyFileSync(configPath, backupPath);
+      log(`  Backed up malformed Codex config \u2192 ${backupPath}`);
+    }
+    throw error;
   }
+  if (rendered === raw) {
+    log(`  Codex already current: ${configPath}`);
+    return;
+  }
+  if (exists) {
+    const backupPath = `${configPath}.backup-${Date.now()}`;
+    copyFileSync(configPath, backupPath);
+    log(`  Backed up Codex config \u2192 ${backupPath}`);
+  }
+  mkdirSync2(dirname2(configPath), { recursive: true });
+  writeFileSync2(configPath, rendered, "utf8");
+  log(`\u2713 Wrote AlgoHQ MCP to Codex: ${configPath}`);
 }
 // src/autostart.ts
-import { homedir as homedir2, platform } from "node:os";
-import { join as join2 } from "node:path";
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2, readFileSync as readFileSync2, unlinkSync, copyFileSync } from "node:fs";
+import { homedir as homedir2, platform as platform2 } from "node:os";
+import { join as join3 } from "node:path";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, writeFileSync as writeFileSync3, readFileSync as readFileSync3, unlinkSync, copyFileSync as copyFileSync2 } from "node:fs";
 function resolveRunnerCommand(override) {
   return override ?? "vo-mcp runner";
 }
 function installWindowsAutostart(runnerCommand, log, env) {
-  const appData = env["APPDATA"] ?? join2(homedir2(), "AppData", "Roaming");
-  const startupDir = join2(appData, "Microsoft", "Windows", "Start Menu", "Programs", "Startup");
-  mkdirSync2(startupDir, { recursive: true });
-  const launcherPath = join2(startupDir, "vo-runner.cmd");
-  if (existsSync2(launcherPath)) {
-    const existing = readFileSync2(launcherPath, "utf8");
+  const appData = env["APPDATA"] ?? join3(homedir2(), "AppData", "Roaming");
+  const startupDir = join3(appData, "Microsoft", "Windows", "Start Menu", "Programs", "Startup");
+  mkdirSync3(startupDir, { recursive: true });
+  const launcherPath = join3(startupDir, "vo-runner.vbs");
+  const legacyCmdPath = join3(startupDir, "vo-runner.cmd");
+  if (existsSync3(legacyCmdPath)) {
+    try {
+      unlinkSync(legacyCmdPath);
+      log(`  Removed legacy minimized .cmd launcher: ${legacyCmdPath}`);
+    } catch (error) {
+      log(`\u26A0 Could not remove legacy launcher ${legacyCmdPath} (${error instanceof Error ? error.message : String(error)}); remove it manually to avoid a double start`);
+    }
+  }
+  if (existsSync3(launcherPath)) {
+    const existing = readFileSync3(launcherPath, "utf8");
     if (existing.includes("vo-mcp runner")) {
       log(`\u2713 Auto-start is already configured (Windows Startup folder)`);
       log(`  Path: ${launcherPath}`);
       return;
     }
     const backupPath = `${launcherPath}.backup-${Date.now()}`;
-    copyFileSync(launcherPath, backupPath);
+    copyFileSync2(launcherPath, backupPath);
     log(`  Backed up existing launcher to: ${backupPath}`);
   }
-  const launcherContent = `@echo off
-REM Auto-start launcher for vo-mcp runner
-REM Created by vo-mcp autostart installer
-start /min cmd /c "${runnerCommand}"
+  const hiddenCommand = `cmd /c ${runnerCommand} >> "%USERPROFILE%\\.claude\\vo-runner.log" 2>&1`.replace(/"/g, '""');
+  const launcherContent = `' Auto-start launcher for vo-mcp runner
+' Created by vo-mcp autostart installer
+CreateObject("WScript.Shell").Run "${hiddenCommand}", 0, False
 `;
-  writeFileSync2(launcherPath, launcherContent, "utf8");
+  writeFileSync3(launcherPath, launcherContent, "utf8");
   log(`\u2713 Installed Windows auto-start launcher`);
   log(`  Path: ${launcherPath}`);
-  log(`  The runner will start minimized at next login.`);
+  log(`  The runner will start hidden at next login.`);
 }
 async function installMacAutostart(runnerCommand, log) {
-  const launchAgentsDir = join2(homedir2(), "Library", "LaunchAgents");
-  mkdirSync2(launchAgentsDir, { recursive: true });
-  const plistPath = join2(launchAgentsDir, "ai.algosuite.vo-runner.plist");
-  if (existsSync2(plistPath)) {
-    const existing = readFileSync2(plistPath, "utf8");
+  const launchAgentsDir = join3(homedir2(), "Library", "LaunchAgents");
+  mkdirSync3(launchAgentsDir, { recursive: true });
+  const plistPath = join3(launchAgentsDir, "ai.algosuite.vo-runner.plist");
+  if (existsSync3(plistPath)) {
+    const existing = readFileSync3(plistPath, "utf8");
     if (existing.includes("vo-mcp runner")) {
       log(`\u2713 Auto-start is already configured (launchd)`);
       log(`  Path: ${plistPath}`);
       return;
     }
     const backupPath = `${plistPath}.backup-${Date.now()}`;
-    copyFileSync(plistPath, backupPath);
+    copyFileSync2(plistPath, backupPath);
     log(`  Backed up existing plist to: ${backupPath}`);
   }
   const parts = runnerCommand.split(/\s+/);
@@ -427,150 +402,207 @@ ${args.map((a) => `    <string>${a}</string>`).join("\n")}
   <key>KeepAlive</key>
   <true/>
   <key>StandardOutPath</key>
-  <string>${join2(homedir2(), ".claude", "vo-runner.log")}</string>
+  <string>${join3(homedir2(), ".claude", "vo-runner.log")}</string>
   <key>StandardErrorPath</key>
-  <string>${join2(homedir2(), ".claude", "vo-runner-error.log")}</string>
+  <string>${join3(homedir2(), ".claude", "vo-runner-error.log")}</string>
 </dict>
 </plist>
 `;
-  writeFileSync2(plistPath, plistContent, "utf8");
+  writeFileSync3(plistPath, plistContent, "utf8");
   log(`\u2713 Installed launchd plist`);
   log(`  Path: ${plistPath}`);
   try {
     const { execSync } = await import("node:child_process");
     execSync(`launchctl load "${plistPath}"`, { stdio: "ignore" });
     log(`\u2713 Loaded plist with launchctl (runner will start at next login)`);
-    log(`  Logs: ${join2(homedir2(), ".claude", "vo-runner.log")}`);
+    log(`  Logs: ${join3(homedir2(), ".claude", "vo-runner.log")}`);
   } catch {
     log(`\u26A0 Failed to load plist with launchctl (you may need to load it manually)`);
     log(`  Run: launchctl load "${plistPath}"`);
   }
 }
+async function installLinuxAutostart(runnerCommand, log, env) {
+  const home = env["HOME"]?.trim() || homedir2();
+  const unitDir = join3(home, ".config", "systemd", "user");
+  mkdirSync3(unitDir, { recursive: true });
+  const unitPath = join3(unitDir, "vo-runner.service");
+  if (existsSync3(unitPath)) {
+    const existing = readFileSync3(unitPath, "utf8");
+    if (existing.includes(runnerCommand) || existing.includes("vo-mcp runner")) {
+      log(`\u2713 Auto-start is already configured (systemd user unit)`);
+      log(`  Path: ${unitPath}`);
+      return;
+    }
+    const backupPath = `${unitPath}.backup-${Date.now()}`;
+    copyFileSync2(unitPath, backupPath);
+    log(`  Backed up existing unit to: ${backupPath}`);
+  }
+  const logFile = join3(home, ".claude", "vo-runner.log");
+  const errFile = join3(home, ".claude", "vo-runner-error.log");
+  mkdirSync3(join3(home, ".claude"), { recursive: true });
+  const unit = `[Unit]
+Description=AlgoHQ Code Runner (vo-mcp)
+After=network-online.target
+Wants=network-online.target
+[Service]
+Type=simple
+ExecStart=/bin/sh -lc '${runnerCommand}'
+Restart=on-failure
+RestartSec=10
+StandardOutput=append:${logFile}
+StandardError=append:${errFile}
+[Install]
+WantedBy=default.target
+`;
+  writeFileSync3(unitPath, unit, "utf8");
+  log(`\u2713 Installed systemd user unit`);
+  log(`  Path: ${unitPath}`);
+  if (process.env["VITEST"]) {
+    log(`  (test mode: skipping systemctl enable)`);
+    return;
+  }
+  try {
+    const { execSync } = await import("node:child_process");
+    execSync("systemctl --user daemon-reload", { stdio: "ignore" });
+    execSync("systemctl --user enable --now vo-runner.service", { stdio: "ignore" });
+    log(`\u2713 Enabled + started vo-runner.service (starts at login)`);
+    log(`  Logs: ${logFile}`);
+  } catch {
+    log(`\u26A0 Could not enable via systemctl (enable it manually):`);
+    log(`  systemctl --user daemon-reload && systemctl --user enable --now vo-runner.service`);
+  }
+}
 async function installAutostart(opts = {}) {
   const log = opts.log ?? ((m) => console.error(m));
   const env = opts.env ?? process.env;
   const runnerCommand = resolveRunnerCommand(opts.runnerCommand);
-  const plat = platform();
+  const plat = platform2();
   if (plat === "win32") {
     installWindowsAutostart(runnerCommand, log, env);
   } else if (plat === "darwin") {
     await installMacAutostart(runnerCommand, log);
+  } else if (plat === "linux") {
+    await installLinuxAutostart(runnerCommand, log, env);
   } else {
     log(`\u2717 Auto-start is not supported on platform: ${plat}`);
-    log(`  Supported platforms: win32 (Windows), darwin (macOS)`);
+    log(`  Supported platforms: win32 (Windows), darwin (macOS), linux (Linux)`);
   }
 }
 // src/install.ts
-var DEFAULT_CONTROL_PLANE_URL = "https://vo-control-plane-bzjphrajaq-uc.a.run.app";
-function resolveClaudeConfigPath() {
-  const plat = platform2();
-  const codeConfig = join3(homedir3(), ".claude.json");
-  if (existsSync3(codeConfig)) return codeConfig;
+var DEFAULT_CONTROL_PLANE_URL2 = "https://vo-control-plane-bzjphrajaq-uc.a.run.app";
+function resolveCodeConfigPath(home) {
+  return join4(home, ".claude.json");
+}
+function resolveDesktopConfigPath(home, plat, appData) {
   if (plat === "win32") {
-    const appData = process.env["APPDATA"] ?? join3(homedir3(), "AppData", "Roaming");
-    return join3(appData, "Claude", "claude_desktop_config.json");
+    return join4(appData ?? join4(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
   }
   if (plat === "darwin") {
-    return join3(homedir3(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
+    return join4(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
   }
-  return join3(homedir3(), ".config", "claude", "claude_desktop_config.json");
+  return join4(home, ".config", "Claude", "claude_desktop_config.json");
 }
 function readClaudeConfig(path) {
   try {
-    if (!existsSync3(path)) return { mcpServers: {} };
-    const raw = readFileSync3(path, "utf8");
+    if (!existsSync4(path)) return {};
+    const raw = readFileSync4(path, "utf8");
     const parsed = JSON.parse(raw);
-    return { mcpServers: parsed.mcpServers ?? {} };
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
   } catch {
-    return { mcpServers: {} };
+    return {};
   }
 }
 function writeClaudeConfig(path, config) {
-  mkdirSync3(dirname2(path), { recursive: true });
-  writeFileSync3(path, `${JSON.stringify(config, null, 2)}
+  mkdirSync4(dirname3(path), { recursive: true });
+  writeFileSync4(path, `${JSON.stringify(config, null, 2)}
 `, "utf8");
 }
 function resolveVoMcpCliPath() {
-  const scriptPath = process.argv[1] ?? "";
-  if (scriptPath.includes("install-cli.js") || scriptPath.includes("install-cli")) {
-    return scriptPath.replace(/install-cli\.js$/, "cli.js").replace(/install-cli$/, "cli.js");
-  }
-  return resolve(dirname2(scriptPath), "cli.js");
+  return join4(dirname3(fileURLToPath(import.meta.url)), "cli.js");
 }
-function installMcpConfig(log, env) {
-  const configPath = resolveClaudeConfigPath();
+function installMcpConfigAt(configPath, cliPath, controlPlaneUrl, log, label) {
   const existing = readClaudeConfig(configPath);
-  const cliPath = resolveVoMcpCliPath();
-  const voEntry = existing.mcpServers?.["vo"] ?? existing.mcpServers?.["vo-mcp"];
-  if (voEntry && voEntry.args && voEntry.args.some((a) => a.includes("vo-mcp"))) {
-    log(`\u2713 vo-mcp MCP server is already configured at: ${configPath}`);
+  const mcpServers = existing["mcpServers"] && typeof existing["mcpServers"] === "object" ? existing["mcpServers"] : {};
+  const voEntry = mcpServers["vo"] ?? mcpServers["vo-mcp"];
+  if (voEntry?.args?.some((a) => a.includes(cliPath))) {
+    log(`  ${label} already current: ${configPath}`);
     return;
   }
-  if (existsSync3(configPath)) {
+  if (existsSync4(configPath)) {
     const backupPath = `${configPath}.backup-${Date.now()}`;
-    copyFileSync2(configPath, backupPath);
-    log(`  Backed up existing config to: ${backupPath}`);
+    copyFileSync3(configPath, backupPath);
+    log(`  Backed up ${label} config \u2192 ${backupPath}`);
   }
-  const controlPlaneUrl = env["VO_CONTROL_PLANE_URL"]?.trim() || DEFAULT_CONTROL_PLANE_URL;
   const merged = {
+    ...existing,
     mcpServers: {
-      ...existing.mcpServers,
+      ...mcpServers,
       "vo-mcp": {
         command: "node",
         args: [cliPath],
-        env: {
-          VO_CONTROL_PLANE_URL: controlPlaneUrl
-        }
+        // Preserve any existing env the user added (e.g. model API keys) — only
+        // ensure VO_CONTROL_PLANE_URL is present. NEVER drop the user's env keys.
+        env: { VO_CONTROL_PLANE_URL: controlPlaneUrl, ...voEntry?.env ?? {} }
       }
     }
   };
   writeClaudeConfig(configPath, merged);
-  log(`\u2713 Wrote vo-mcp MCP server config to: ${configPath}`);
-}
-async function runLoginFlow(log, env) {
-  log("\n\u2501\u2501\u2501 Step 2: Link your Claude account \u2501\u2501\u2501");
-  log("We'll open your browser to sign in, then mint a scoped credential.");
-  log("Your raw token never persists locally (it's exchanged for a vocred_).\n");
-  const controlPlaneUrl = env["VO_CONTROL_PLANE_URL"]?.trim() || "https://vo-control-plane-bzjphrajaq-uc.a.run.app";
-  const exchange = async (refreshToken, apiKey) => {
-    return exchangeForVoCredential({
-      refreshToken,
-      apiKey,
-      controlPlaneUrl,
-      label: `vo-mcp install (${platform2()})`
-    });
-  };
+  log(`\u2713 Wrote vo-mcp to ${label}: ${configPath}`);
+}
+function installMcpConfig(log, env) {
+  const home = env["HOME"]?.trim() || env["USERPROFILE"]?.trim() || homedir3();
+  const appData = env["APPDATA"]?.trim();
+  const plat = platform3();
+  const cliPath = resolveVoMcpCliPath();
+  const controlPlaneUrl = env["VO_CONTROL_PLANE_URL"]?.trim() || DEFAULT_CONTROL_PLANE_URL2;
+  installMcpConfigAt(resolveCodeConfigPath(home), cliPath, controlPlaneUrl, log, "Claude Code CLI");
+  installMcpConfigAt(resolveDesktopConfigPath(home, plat, appData), cliPath, controlPlaneUrl, log, "Claude Desktop");
+  installCodexMcpConfigAt(resolveCodexConfigPath(home), cliPath, controlPlaneUrl, log);
+}
+async function runPairFlow(log, env) {
+  log("\n\u2501\u2501\u2501 Step 2: Link your AlgoHQ account (device code) \u2501\u2501\u2501");
+  log("A short code appears below \u2014 open the URL it prints and enter the code.");
+  log("Your raw token never persists; a scoped credential is stored in your OS keychain.\n");
   try {
-    const result = await runLogin({ env, log, exchange });
-    log(`\u2713 Signed in${result.email ? ` as ${result.email}` : ""}. Credential stored at: ${result.credentialPath}`);
+    const result = await runPairing({ env, log });
+    log(`
+\u2713 Paired \u2014 scoped credential stored at: ${result.credentialPath}`);
   } catch (err) {
-    log(`\u2717 Login failed: ${err instanceof Error ? err.message : String(err)}`);
-    log("  You can retry later by running: vo-mcp login");
-    throw err;
+    log(`
+\u26A0 Pairing didn't complete: ${err instanceof Error ? err.message : String(err)}`);
+    log("  No problem \u2014 the rest will finish; pair anytime with: vo-mcp pair");
   }
 }
-function printNextSteps(log, autostartInstalled) {
+function printNextSteps(log, autostartInstalled, configOnly) {
   log("\n\u2501\u2501\u2501 Installation complete! \u2501\u2501\u2501\n");
   log("What's configured:");
-  log("  \u2713 Claude Desktop / Claude Code will load vo-mcp on next restart");
-  log("  \u2713 Your scoped credential is stored (revocable via the dashboard)");
+  log("  \u2713 Claude Desktop, Claude Code, and Codex will load AlgoHQ MCP on next restart");
+  if (configOnly) {
+    log("  \u2713 Existing pairing and runner auto-start settings were left unchanged");
+  } else {
+    log("  \u2713 Your scoped credential is stored (revocable via the dashboard)");
+  }
   if (autostartInstalled) {
     log("  \u2713 Runner daemon will start automatically at login\n");
   } else {
     log("\n");
   }
   log("Next steps:");
-  log("  1. Restart Claude Desktop / Claude Code (if running).");
-  if (autostartInstalled) {
+  log("  1. Restart Claude Desktop / Claude Code / Codex (if running).");
+  if (configOnly) {
+    log("  2. Restart the existing AlgoHQ runner service or runner terminal.");
+  } else if (autostartInstalled) {
     log("  2. Log out and back in (or start the runner manually now: vo-mcp runner)");
   } else {
     log("  2. Start the agent runner in a terminal (keep it running):");
     log("       vo-mcp runner");
     log("     (To set up auto-start at login: vo-mcp runner --install-autostart)");
   }
-  log("  3. Visit the VO Command Center to dispatch your first agent:");
-  log("       https://algosuite.ai/virtualoffice\n");
+  log("  3. Visit AlgoHQ to dispatch your first agent:");
+  log("       https://algosuite.ai/algohq\n");
   log("The runner watches for tasks you dispatch and spins up agents in fresh worktrees.");
   log("Agents only run while the runner is connected. Ctrl+C to stop it anytime.\n");
 }
@@ -578,18 +610,20 @@ async function install(opts = {}) {
   const log = opts.log ?? ((m) => console.error(m));
   const env = opts.env ?? process.env;
   log("\u2501\u2501\u2501 vo-mcp installer \u2501\u2501\u2501");
-  log("This will set up your machine to dispatch VO agents from anywhere.\n");
-  log("\u2501\u2501\u2501 Step 1: Configure Claude Desktop / Claude Code \u2501\u2501\u2501");
+  log("This will set up your machine to dispatch AlgoHQ agents from anywhere.\n");
+  log("\u2501\u2501\u2501 Step 1: Configure Claude Desktop / Claude Code / Codex \u2501\u2501\u2501");
   installMcpConfig(log, env);
   if (!opts.skipLogin) {
-    await runLoginFlow(log, env);
+    await runPairFlow(log, env);
+  } else if (opts.configOnly) {
+    log("\n(Config-only refresh \u2014 existing pairing left unchanged.)");
   } else {
-    log("\n(Login skipped \u2014 run `vo-mcp login` manually when ready.)");
+    log("\n(Pairing skipped \u2014 run `vo-mcp pair` when ready.)");
   }
   let autostartInstalled = false;
   if (!opts.skipAutostart) {
-    const plat = platform2();
-    if (plat === "win32" || plat === "darwin") {
+    const plat = platform3();
+    if (plat === "win32" || plat === "darwin" || plat === "linux") {
       log("\n\u2501\u2501\u2501 Step 3: Set up auto-start \u2501\u2501\u2501");
       log("Would you like the runner daemon to start automatically at login?");
       log("(You can skip this and set it up later with: vo-mcp runner --install-autostart)\n");
@@ -597,11 +631,15 @@ async function install(opts = {}) {
       autostartInstalled = true;
     }
   }
-  printNextSteps(log, autostartInstalled);
+  printNextSteps(log, autostartInstalled, opts.configOnly === true);
+}
+function installOptionsFromArgs(args) {
+  const configOnly = args.includes("--config-only");
+  return configOnly ? { configOnly: true, skipLogin: true, skipAutostart: true } : {};
 }
 // src/install-cli.ts
-install().catch((err) => {
+install(installOptionsFromArgs(process.argv.slice(2))).catch((err) => {
   console.error("[vo-mcp install] fatal:", err);
   process.exit(1);
 });