npm - @algosuite/vo-mcp - Versions diffs - 0.2.0-beta.2 → 0.2.0-beta.7 - Mend

@algosuite/vo-mcp 0.2.0-beta.2 → 0.2.0-beta.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (21) hide show

package/dist/install-cli.js CHANGED Viewed

@@ -2,15 +2,13 @@
 import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
 // src/install.ts
-import { homedir as homedir3, platform as platform2 } from "node:os";
+import { homedir as homedir3, platform as platform3 } from "node:os";
 import { join as join3, dirname as dirname2 } from "node:path";
 import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3, copyFileSync as copyFileSync2 } from "node:fs";
-import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
-// src/cloud/login.ts
-import { createServer } from "node:http";
-import { randomBytes } from "node:crypto";
-import { spawn } from "node:child_process";
+// src/cloud/pairing.ts
+import { hostname, platform } from "node:os";
 // src/cloud/credential-store.ts
 import { homedir } from "node:os";
@@ -125,243 +123,82 @@ function writeStoredCredential(cred, storedAt, env = process.env, keychain = rea
   return p;
 }
-// src/cloud/login.ts
+// src/cloud/pairing.ts
+var DEFAULT_CONTROL_PLANE_URL = "https://vo-control-plane-bzjphrajaq-uc.a.run.app";
 var DEFAULT_DASHBOARD_URL = "https://algosuite.ai";
-var DEFAULT_TIMEOUT_MS = 12e4;
-var MAX_BODY_BYTES = 16384;
-function processCapture(rawBody, expectedState, store) {
-  let data;
-  try {
-    data = JSON.parse(rawBody);
-  } catch {
-    return { ok: false, httpStatus: 400, error: "invalid JSON body" };
-  }
-  if (!data || typeof data !== "object") return { ok: false, httpStatus: 400, error: "invalid body" };
-  if (typeof data.state !== "string" || data.state !== expectedState) {
-    return { ok: false, httpStatus: 403, error: "state mismatch (possible CSRF) \u2014 login aborted" };
-  }
-  const refresh = typeof data.refresh_token === "string" ? data.refresh_token.trim() : "";
-  const apiKey = typeof data.api_key === "string" ? data.api_key.trim() : "";
-  if (!refresh || !apiKey) {
-    return { ok: false, httpStatus: 400, error: "login response missing refresh_token / api_key" };
-  }
-  const email = typeof data.email === "string" && data.email.trim() ? data.email.trim() : void 0;
-  const path = store({ refresh_token: refresh, api_key: apiKey, ...email ? { email } : {} });
-  return {
-    ok: true,
-    httpStatus: 200,
-    result: { ...email ? { email } : {}, credentialPath: path },
-    captured: { refresh_token: refresh, api_key: apiKey, ...email ? { email } : {} }
-  };
-}
-function captureHtml() {
-  return `<!doctype html><html><head><meta charset="utf-8"><title>VO login</title></head>
-<body style="font-family:system-ui;max-width:32rem;margin:4rem auto;text-align:center">
-<h2 id="m">Completing sign-in\u2026</h2>
-<script>
-(function(){
-  var h=location.hash.replace(/^#/,''), p=new URLSearchParams(h), b={};
-  ['state','refresh_token','api_key','email'].forEach(function(k){ if(p.get(k)) b[k]=p.get(k); });
-  fetch('/capture',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify(b)})
-    .then(function(r){ document.getElementById('m').textContent = r.ok ? 'Sign-in complete \u2014 you can close this tab.' : 'Sign-in failed \u2014 check the terminal.'; })
-    .catch(function(){ document.getElementById('m').textContent = 'Sign-in failed \u2014 check the terminal.'; });
-})();
-</script></body></html>`;
+function formatPairingCode(code) {
+  return code.length === 8 ? `${code.slice(0, 4)}-${code.slice(4)}` : code;
 }
-function defaultOpenBrowser(url) {
-  const platform3 = process.platform;
-  if (platform3 === "win32") {
-    spawn("cmd", ["/c", "start", "", url], { detached: true, stdio: "ignore" }).unref();
-  } else if (platform3 === "darwin") {
-    spawn("open", [url], { detached: true, stdio: "ignore" }).unref();
-  } else {
-    spawn("xdg-open", [url], { detached: true, stdio: "ignore" }).unref();
-  }
+async function readJson(res) {
+  const body = await res.json().catch(() => ({}));
+  return body && typeof body === "object" ? body : {};
 }
-async function runLogin(opts = {}) {
-  const env = opts.env ?? process.env;
-  const dashboardUrl = (opts.dashboardUrl ?? env["VO_DASHBOARD_URL"]?.trim() ?? DEFAULT_DASHBOARD_URL).replace(/\/+$/, "") || DEFAULT_DASHBOARD_URL;
-  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  const log = opts.log ?? ((m) => console.error(m));
-  const nowIso = opts.nowIso ?? (() => (/* @__PURE__ */ new Date()).toISOString());
-  const openBrowser = opts.openBrowser ?? defaultOpenBrowser;
-  const state = randomBytes(32).toString("base64url");
-  return new Promise((resolve2, reject) => {
-    let settled = false;
-    const finish = (err, result) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      server.close();
-      if (err) reject(err);
-      else resolve2(result);
-    };
-    const server = createServer((req, res) => {
-      const url = new URL(req.url ?? "/", "http://127.0.0.1");
-      if (req.method === "GET" && url.pathname === "/callback") {
-        res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
-        res.end(captureHtml());
-        return;
-      }
-      if (req.method === "POST" && url.pathname === "/capture") {
-        let body = "";
-        req.on("data", (chunk) => {
-          body += chunk.toString("utf8");
-          if (body.length > MAX_BODY_BYTES) req.destroy();
-        });
-        req.on("end", () => {
-          void (async () => {
-            if (body.length > MAX_BODY_BYTES) {
-              res.writeHead(413, { "content-type": "text/plain" });
-              res.end("payload too large");
-              finish(new Error("login request body exceeded the size cap"));
-              return;
-            }
-            const writeNow = (cred) => writeStoredCredential(cred, nowIso(), env);
-            const outcome = processCapture(body, state, opts.exchange ? () => "pending" : writeNow);
-            let result = outcome.result;
-            if (outcome.ok && outcome.captured && opts.exchange) {
-              const capt = outcome.captured;
-              let cred = {
-                refresh_token: capt.refresh_token,
-                api_key: capt.api_key,
-                ...capt.email ? { email: capt.email } : {}
-              };
-              try {
-                const voc = await opts.exchange(capt.refresh_token, capt.api_key);
-                if (voc && voc.vo_credential) {
-                  cred = {
-                    vo_credential: voc.vo_credential,
-                    vo_credential_expires_at: voc.expires_at,
-                    ...capt.email ? { email: capt.email } : {}
-                  };
-                }
-              } catch {
-              }
-              const path = writeNow(cred);
-              result = { ...capt.email ? { email: capt.email } : {}, credentialPath: path };
-            }
-            res.writeHead(outcome.httpStatus, { "content-type": "text/html; charset=utf-8" });
-            res.end(outcome.ok ? "<h2>VO login complete \u2014 you can close this tab.</h2>" : `<h2>Login failed: ${outcome.error}</h2>`);
-            finish(outcome.ok ? null : new Error(outcome.error ?? "login failed"), result);
-          })();
-        });
-        return;
-      }
-      res.writeHead(404);
-      res.end("not found");
-    });
-    const timer = setTimeout(
-      () => finish(new Error(`login timed out after ${timeoutMs}ms \u2014 no sign-in captured`)),
-      timeoutMs
-    );
-    server.on("error", (e) => finish(e));
-    server.listen(0, "127.0.0.1", () => {
-      const addr = server.address();
-      const port = addr && typeof addr === "object" ? addr.port : 0;
-      if (!port) {
-        finish(new Error("failed to bind a loopback port"));
-        return;
-      }
-      const loginUrl = `${dashboardUrl}/cli-login?port=${port}&state=${encodeURIComponent(state)}`;
-      log(`[vo-mcp] Opening your browser to sign in:
-  ${loginUrl}`);
-      log("[vo-mcp] If it did not open, paste that URL into your browser. Waiting for sign-in\u2026");
-      try {
-        openBrowser(loginUrl);
-      } catch {
-      }
-    });
+async function runPairing(deps = {}) {
+  const env = deps.env ?? process.env;
+  const log = deps.log ?? ((m) => console.error(m));
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  const store = deps.store ?? ((cred, iso) => writeStoredCredential(cred, iso, env));
+  const controlPlaneUrl = env["VO_CONTROL_PLANE_URL"]?.trim() || DEFAULT_CONTROL_PLANE_URL;
+  const dashboardUrl = env["VO_DASHBOARD_URL"]?.trim() || DEFAULT_DASHBOARD_URL;
+  const deviceLabel = `${platform()} on ${hostname()}`.slice(0, 120);
+  const initRes = await fetchImpl(`${controlPlaneUrl}/api/v1/pair/initiate`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ device_label: deviceLabel })
   });
-}
-// src/cloud/auth-token-source.ts
-var FIREBASE_SECURETOKEN_URL = "https://securetoken.googleapis.com/v1/token";
-var FIREBASE_TOKEN_REFERER = "https://algosuite.ai/";
-var REFRESH_SKEW_MS = 6e4;
-function createFirebaseRefreshTokenSource(opts) {
-  const refreshToken = opts.refreshToken.trim();
-  const apiKey = opts.apiKey.trim();
-  const now = opts.now ?? (() => Date.now());
-  const fetchFn = opts.fetchFn ?? globalThis.fetch;
-  let cachedToken = null;
-  let expiresAtMs = 0;
-  let inFlight = null;
-  async function refresh() {
-    try {
-      const res = await fetchFn(`${FIREBASE_SECURETOKEN_URL}?key=${encodeURIComponent(apiKey)}`, {
-        method: "POST",
-        headers: {
-          "content-type": "application/x-www-form-urlencoded",
-          referer: FIREBASE_TOKEN_REFERER
-        },
-        body: `grant_type=refresh_token&refresh_token=${encodeURIComponent(refreshToken)}`
-      });
-      const text = await res.text();
-      if (res.status < 200 || res.status >= 300) {
-        cachedToken = null;
-        return null;
-      }
-      const parsed = JSON.parse(text);
-      const idToken = typeof parsed.id_token === "string" ? parsed.id_token : "";
-      if (!idToken) {
-        cachedToken = null;
-        return null;
-      }
-      const expiresInSec = Number(parsed.expires_in);
-      const ttlMs = Number.isFinite(expiresInSec) && expiresInSec > 0 ? expiresInSec * 1e3 : 36e5;
-      cachedToken = idToken;
-      expiresAtMs = now() + ttlMs;
-      return idToken;
-    } catch {
-      cachedToken = null;
-      return null;
+  if (!initRes.ok) throw new Error(`Could not start pairing (server ${initRes.status}).`);
+  const init = await readJson(initRes);
+  const code = String(init["code"] ?? "");
+  const pollToken = String(init["poll_token"] ?? "");
+  if (!code || !pollToken) throw new Error("Pairing service returned an incomplete response.");
+  const intervalMs = (Number(init["poll_interval_seconds"]) || 5) * 1e3;
+  const expiresAtMs = new Date(String(init["expires_at"] ?? "")).getTime();
+  log("");
+  log("  To connect this runner, open this page in your browser:");
+  log(`    ${dashboardUrl}/pair`);
+  log("  and enter this code:");
+  log("");
+  log(`      ${formatPairingCode(code)}`);
+  log("");
+  log("  Your Anthropic key never leaves this computer. Waiting for you to authorize\u2026");
+  for (; ; ) {
+    if (Number.isFinite(expiresAtMs) && now().getTime() >= expiresAtMs) {
+      throw new Error("The pairing code expired before it was authorized. Run `vo-mcp pair` again.");
     }
-  }
-  return {
-    kind: "firebase-refresh",
-    async getToken() {
-      if (cachedToken && now() < expiresAtMs - REFRESH_SKEW_MS) return cachedToken;
-      if (!inFlight) {
-        inFlight = refresh().finally(() => {
-          inFlight = null;
-        });
-      }
-      return inFlight;
-    }
-  };
-}
-// src/cloud/vo-credential-exchange.ts
-async function exchangeForVoCredential(opts) {
-  const base = opts.controlPlaneUrl.replace(/\/+$/, "");
-  if (!base) return null;
-  const fetchFn = opts.fetchFn ?? globalThis.fetch;
-  try {
-    const idToken = await createFirebaseRefreshTokenSource({
-      refreshToken: opts.refreshToken,
-      apiKey: opts.apiKey,
-      ...opts.fetchFn ? { fetchFn: opts.fetchFn } : {}
-    }).getToken();
-    if (!idToken) return null;
-    const res = await fetchFn(`${base}/api/v1/auth/vo-credential`, {
-      method: "POST",
-      headers: { "content-type": "application/json", authorization: `Bearer ${idToken}` },
-      body: JSON.stringify(opts.label ? { label: opts.label } : {})
+    await sleep(intervalMs);
+    const pollRes = await fetchImpl(`${controlPlaneUrl}/api/v1/pair/poll`, {
+      method: "GET",
+      headers: { "x-vo-poll-token": pollToken }
     });
-    if (res.status !== 200) return null;
-    const parsed = JSON.parse(await res.text());
-    const token = typeof parsed.token === "string" ? parsed.token : "";
-    const expiresAt = typeof parsed.expires_at === "string" ? parsed.expires_at : "";
-    if (!token.startsWith("vocred_") || !expiresAt) return null;
-    return { vo_credential: token, expires_at: expiresAt };
-  } catch {
-    return null;
+    if (pollRes.status === 404) {
+      throw new Error("The pairing expired. Run `vo-mcp pair` again.");
+    }
+    if (pollRes.status === 410) {
+      throw new Error("This code was already used. Run `vo-mcp pair` again.");
+    }
+    if (!pollRes.ok) {
+      continue;
+    }
+    const body = await readJson(pollRes);
+    if (body["status"] === "pending") continue;
+    if (body["status"] === "authorized" && typeof body["vo_credential"] === "string") {
+      const credentialPath2 = store(
+        {
+          vo_credential: body["vo_credential"],
+          ...typeof body["expires_at"] === "string" ? { vo_credential_expires_at: body["expires_at"] } : {}
+        },
+        now().toISOString()
+      );
+      return { credentialPath: credentialPath2, expires_at: String(body["expires_at"] ?? "") };
+    }
+    throw new Error("Unexpected response from the pairing service.");
   }
 }
 // src/autostart.ts
-import { homedir as homedir2, platform } from "node:os";
+import { homedir as homedir2, platform as platform2 } from "node:os";
 import { join as join2 } from "node:path";
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2, readFileSync as readFileSync2, unlinkSync, copyFileSync } from "node:fs";
 function resolveRunnerCommand(override) {
@@ -446,44 +283,98 @@ ${args.map((a) => `    <string>${a}</string>`).join("\n")}
     log(`  Run: launchctl load "${plistPath}"`);
   }
 }
+async function installLinuxAutostart(runnerCommand, log, env) {
+  const home = env["HOME"]?.trim() || homedir2();
+  const unitDir = join2(home, ".config", "systemd", "user");
+  mkdirSync2(unitDir, { recursive: true });
+  const unitPath = join2(unitDir, "vo-runner.service");
+  if (existsSync2(unitPath)) {
+    const existing = readFileSync2(unitPath, "utf8");
+    if (existing.includes(runnerCommand) || existing.includes("vo-mcp runner")) {
+      log(`\u2713 Auto-start is already configured (systemd user unit)`);
+      log(`  Path: ${unitPath}`);
+      return;
+    }
+    const backupPath = `${unitPath}.backup-${Date.now()}`;
+    copyFileSync(unitPath, backupPath);
+    log(`  Backed up existing unit to: ${backupPath}`);
+  }
+  const logFile = join2(home, ".claude", "vo-runner.log");
+  const errFile = join2(home, ".claude", "vo-runner-error.log");
+  mkdirSync2(join2(home, ".claude"), { recursive: true });
+  const unit = `[Unit]
+Description=VO Code Runner (vo-mcp)
+After=network-online.target
+Wants=network-online.target
+[Service]
+Type=simple
+ExecStart=/bin/sh -lc '${runnerCommand}'
+Restart=on-failure
+RestartSec=10
+StandardOutput=append:${logFile}
+StandardError=append:${errFile}
+[Install]
+WantedBy=default.target
+`;
+  writeFileSync2(unitPath, unit, "utf8");
+  log(`\u2713 Installed systemd user unit`);
+  log(`  Path: ${unitPath}`);
+  if (process.env["VITEST"]) {
+    log(`  (test mode: skipping systemctl enable)`);
+    return;
+  }
+  try {
+    const { execSync } = await import("node:child_process");
+    execSync("systemctl --user daemon-reload", { stdio: "ignore" });
+    execSync("systemctl --user enable --now vo-runner.service", { stdio: "ignore" });
+    log(`\u2713 Enabled + started vo-runner.service (starts at login)`);
+    log(`  Logs: ${logFile}`);
+  } catch {
+    log(`\u26A0 Could not enable via systemctl (enable it manually):`);
+    log(`  systemctl --user daemon-reload && systemctl --user enable --now vo-runner.service`);
+  }
+}
 async function installAutostart(opts = {}) {
   const log = opts.log ?? ((m) => console.error(m));
   const env = opts.env ?? process.env;
   const runnerCommand = resolveRunnerCommand(opts.runnerCommand);
-  const plat = platform();
+  const plat = platform2();
   if (plat === "win32") {
     installWindowsAutostart(runnerCommand, log, env);
   } else if (plat === "darwin") {
     await installMacAutostart(runnerCommand, log);
+  } else if (plat === "linux") {
+    await installLinuxAutostart(runnerCommand, log, env);
   } else {
     log(`\u2717 Auto-start is not supported on platform: ${plat}`);
-    log(`  Supported platforms: win32 (Windows), darwin (macOS)`);
+    log(`  Supported platforms: win32 (Windows), darwin (macOS), linux (Linux)`);
   }
 }
 // src/install.ts
-var DEFAULT_CONTROL_PLANE_URL = "https://vo-control-plane-bzjphrajaq-uc.a.run.app";
-function resolveClaudeConfigPath() {
-  const plat = platform2();
-  const codeConfig = join3(homedir3(), ".claude.json");
-  if (existsSync3(codeConfig)) return codeConfig;
+var DEFAULT_CONTROL_PLANE_URL2 = "https://vo-control-plane-bzjphrajaq-uc.a.run.app";
+function resolveCodeConfigPath(home) {
+  return join3(home, ".claude.json");
+}
+function resolveDesktopConfigPath(home, plat, appData) {
   if (plat === "win32") {
-    const appData = process.env["APPDATA"] ?? join3(homedir3(), "AppData", "Roaming");
-    return join3(appData, "Claude", "claude_desktop_config.json");
+    return join3(appData ?? join3(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
   }
   if (plat === "darwin") {
-    return join3(homedir3(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
+    return join3(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
   }
-  return join3(homedir3(), ".config", "claude", "claude_desktop_config.json");
+  return join3(home, ".config", "Claude", "claude_desktop_config.json");
 }
 function readClaudeConfig(path) {
   try {
-    if (!existsSync3(path)) return { mcpServers: {} };
+    if (!existsSync3(path)) return {};
     const raw = readFileSync3(path, "utf8");
     const parsed = JSON.parse(raw);
-    return { mcpServers: parsed.mcpServers ?? {} };
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
   } catch {
-    return { mcpServers: {} };
+    return {};
   }
 }
 function writeClaudeConfig(path, config) {
@@ -492,62 +383,58 @@ function writeClaudeConfig(path, config) {
 `, "utf8");
 }
 function resolveVoMcpCliPath() {
-  const scriptPath = process.argv[1] ?? "";
-  if (scriptPath.includes("install-cli.js") || scriptPath.includes("install-cli")) {
-    return scriptPath.replace(/install-cli\.js$/, "cli.js").replace(/install-cli$/, "cli.js");
-  }
-  return resolve(dirname2(scriptPath), "cli.js");
+  return join3(dirname2(fileURLToPath(import.meta.url)), "cli.js");
 }
-function installMcpConfig(log, env) {
-  const configPath = resolveClaudeConfigPath();
+function installMcpConfigAt(configPath, cliPath, controlPlaneUrl, log, label) {
   const existing = readClaudeConfig(configPath);
-  const cliPath = resolveVoMcpCliPath();
-  const voEntry = existing.mcpServers?.["vo"] ?? existing.mcpServers?.["vo-mcp"];
-  if (voEntry && voEntry.args && voEntry.args.some((a) => a.includes("vo-mcp"))) {
-    log(`\u2713 vo-mcp MCP server is already configured at: ${configPath}`);
+  const mcpServers = existing["mcpServers"] && typeof existing["mcpServers"] === "object" ? existing["mcpServers"] : {};
+  const voEntry = mcpServers["vo"] ?? mcpServers["vo-mcp"];
+  if (voEntry?.args?.some((a) => a.includes(cliPath))) {
+    log(`  ${label} already current: ${configPath}`);
     return;
   }
   if (existsSync3(configPath)) {
     const backupPath = `${configPath}.backup-${Date.now()}`;
     copyFileSync2(configPath, backupPath);
-    log(`  Backed up existing config to: ${backupPath}`);
+    log(`  Backed up ${label} config \u2192 ${backupPath}`);
   }
-  const controlPlaneUrl = env["VO_CONTROL_PLANE_URL"]?.trim() || DEFAULT_CONTROL_PLANE_URL;
   const merged = {
+    ...existing,
     mcpServers: {
-      ...existing.mcpServers,
+      ...mcpServers,
       "vo-mcp": {
         command: "node",
         args: [cliPath],
-        env: {
-          VO_CONTROL_PLANE_URL: controlPlaneUrl
-        }
+        // Preserve any existing env the user added (e.g. model API keys) — only
+        // ensure VO_CONTROL_PLANE_URL is present. NEVER drop the user's env keys.
+        env: { VO_CONTROL_PLANE_URL: controlPlaneUrl, ...voEntry?.env ?? {} }
       }
     }
   };
   writeClaudeConfig(configPath, merged);
-  log(`\u2713 Wrote vo-mcp MCP server config to: ${configPath}`);
+  log(`\u2713 Wrote vo-mcp to ${label}: ${configPath}`);
 }
-async function runLoginFlow(log, env) {
-  log("\n\u2501\u2501\u2501 Step 2: Link your Claude account \u2501\u2501\u2501");
-  log("We'll open your browser to sign in, then mint a scoped credential.");
-  log("Your raw token never persists locally (it's exchanged for a vocred_).\n");
-  const controlPlaneUrl = env["VO_CONTROL_PLANE_URL"]?.trim() || "https://vo-control-plane-bzjphrajaq-uc.a.run.app";
-  const exchange = async (refreshToken, apiKey) => {
-    return exchangeForVoCredential({
-      refreshToken,
-      apiKey,
-      controlPlaneUrl,
-      label: `vo-mcp install (${platform2()})`
-    });
-  };
+function installMcpConfig(log, env) {
+  const home = env["HOME"]?.trim() || env["USERPROFILE"]?.trim() || homedir3();
+  const appData = env["APPDATA"]?.trim();
+  const plat = platform3();
+  const cliPath = resolveVoMcpCliPath();
+  const controlPlaneUrl = env["VO_CONTROL_PLANE_URL"]?.trim() || DEFAULT_CONTROL_PLANE_URL2;
+  installMcpConfigAt(resolveCodeConfigPath(home), cliPath, controlPlaneUrl, log, "Claude Code CLI");
+  installMcpConfigAt(resolveDesktopConfigPath(home, plat, appData), cliPath, controlPlaneUrl, log, "Claude Desktop");
+}
+async function runPairFlow(log, env) {
+  log("\n\u2501\u2501\u2501 Step 2: Link your VO account (device code) \u2501\u2501\u2501");
+  log("A short code appears below \u2014 open the URL it prints and enter the code.");
+  log("Your raw token never persists; a scoped credential is stored in your OS keychain.\n");
   try {
-    const result = await runLogin({ env, log, exchange });
-    log(`\u2713 Signed in${result.email ? ` as ${result.email}` : ""}. Credential stored at: ${result.credentialPath}`);
+    const result = await runPairing({ env, log });
+    log(`
+\u2713 Paired \u2014 scoped credential stored at: ${result.credentialPath}`);
   } catch (err) {
-    log(`\u2717 Login failed: ${err instanceof Error ? err.message : String(err)}`);
-    log("  You can retry later by running: vo-mcp login");
-    throw err;
+    log(`
+\u26A0 Pairing didn't complete: ${err instanceof Error ? err.message : String(err)}`);
+    log("  No problem \u2014 the rest will finish; pair anytime with: vo-mcp pair");
   }
 }
 function printNextSteps(log, autostartInstalled) {
@@ -582,14 +469,14 @@ async function install(opts = {}) {
   log("\u2501\u2501\u2501 Step 1: Configure Claude Desktop / Claude Code \u2501\u2501\u2501");
   installMcpConfig(log, env);
   if (!opts.skipLogin) {
-    await runLoginFlow(log, env);
+    await runPairFlow(log, env);
   } else {
-    log("\n(Login skipped \u2014 run `vo-mcp login` manually when ready.)");
+    log("\n(Pairing skipped \u2014 run `vo-mcp pair` when ready.)");
   }
   let autostartInstalled = false;
   if (!opts.skipAutostart) {
-    const plat = platform2();
-    if (plat === "win32" || plat === "darwin") {
+    const plat = platform3();
+    if (plat === "win32" || plat === "darwin" || plat === "linux") {
       log("\n\u2501\u2501\u2501 Step 3: Set up auto-start \u2501\u2501\u2501");
       log("Would you like the runner daemon to start automatically at login?");
       log("(You can skip this and set it up later with: vo-mcp runner --install-autostart)\n");