@buildinternet/uploads 0.46.0 → 0.46.2

package/README.md

@@ -204,7 +204,7 @@ Config layers (first match wins): CLI flags → env vars → `--env-file` → `~
 
 Or with `UPLOADS_TOKEN`/`UPLOADS_WORKSPACE` in the environment or user config. Claude Code: `claude mcp add uploads -- uploads --env-file /path/to/.env mcp`.
 
-For HTTP clients there's also a hosted variant at `https://agents.uploads.sh/mcp` — the workspace is inferred from the bearer token, so only the URL and token are needed (`https://agents.uploads.sh/<workspace>/mcp` and the `mcp.uploads.sh` hostname also work). Tools: file operations (including `get_metadata` / `set_metadata` / `find_files`) plus `gallery_create`, `gallery_get`, `gallery_add`, `gallery_link`, and `gallery_find_by_reference`; all use the same bearer-token workspace scopes and gallery URLs come from the API — see `apps/mcp` in the repo. The hosted `put` also accepts a `metadata` param. `uploads install` registers the skills + hosted MCP + Grok/Cursor hooks (short progress; `--verbose` for underlying output). Claude and Codex use their plugins for the same pre-PR screenshot reminder (`uploads hook pre-pr-screenshot`). Its `put` takes no content type: the stored type is sniffed server-side from the bytes and checked against the workspace allowlist, and writes are rate limited per workspace.
+For HTTP clients there's also a hosted variant at `https://agents.uploads.sh/mcp` — the workspace is inferred from the bearer token, so only the URL and token are needed (`https://agents.uploads.sh/<workspace>/mcp` and the `mcp.uploads.sh` hostname also work). Tools: file operations (including `get_metadata` / `set_metadata` / `find_files`) plus `gallery_create`, `gallery_get`, `gallery_add`, `gallery_link`, and `gallery_find_by_reference`; all use the same bearer-token workspace scopes and gallery URLs come from the API — see `apps/mcp` in the repo. The hosted `put` also accepts a `metadata` param. `uploads install` registers the skills + hosted MCP with whichever of Claude Code, Codex, and Grok are on PATH (a missing CLI is skipped) + Grok/Cursor hooks (short progress; `--verbose` for underlying output). Claude and Codex use their plugins for the same pre-PR screenshot reminder (`uploads hook pre-pr-screenshot`). Its `put` takes no content type: the stored type is sniffed server-side from the bytes and checked against the workspace allowlist, and writes are rate limited per workspace.
 
 ## Programmatic use
 

package/dist/cli-catalog.js

@@ -212,7 +212,7 @@ export const ROOT_COMMANDS = [
         essential: true,
         subcommands: [
             { name: "skill", summary: "Install the agent skills only" },
-            { name: "mcp", summary: "Register the remote MCP server only" },
+            { name: "mcp", summary: "Register the remote MCP server (skips missing agent CLIs)" },
             { name: "hooks", summary: "Install PR screenshot hooks for Grok/Cursor" },
             { name: "all", summary: "Install skills, MCP, and hooks (default)" },
         ],

package/dist/cli-help.js

@@ -167,9 +167,10 @@ ${section(style, "Examples:")}
   ${style.command("uploads logout")}
   ${style.command("uploads --version")}
 
-${section(style, "Agent/MCP:")} ${style.body("`uploads install` sets up skills, hosted MCP, and hooks for")}
-${style.body("Grok/Cursor. Claude and Codex use their plugins for the same PR-screenshot")}
-${style.body("hook. Run `uploads mcp` for local stdio.")}
+${section(style, "Agent/MCP:")} ${style.body("`uploads install` sets up skills, hosted MCP (Claude/Codex/Grok;")}
+${style.body("skips any CLI that is not on PATH), and hooks for Grok/Cursor. Claude and")}
+${style.body("Codex use their plugins for the same PR-screenshot hook. Run `uploads mcp`")}
+${style.body("for local stdio.")}
 
 ${style.muted("Tip: uploads help          essentials only")}
 ${style.muted("     uploads help --all    this full listing")}

package/dist/client.js

@@ -4,14 +4,104 @@ import { UploadsError } from "./errors.js";
 import { buildScreenshotKey } from "./keys.js";
 import { packageVersion } from "./package-version.js";
 import { resolveEmbedUrl } from "./public-urls.js";
-async function jsonRequest(url, init) {
-    let res;
+// --- Request resilience (issue #809) ---------------------------------------
+//
+// Bare `fetch` has no timeout — undici's default header timeout is ~5
+// minutes, so a backend stall (see the 2026-08-23 D1 stall incident, #808)
+// hangs the CLI silently for that whole window instead of failing fast like
+// the workers now do (#805-#807). Every core API call routes through
+// `resilientFetch` for a bounded timeout and a single bounded retry.
+//
+// Timeouts: short for JSON control calls, longer for the one content-bytes
+// call (file `put`), matching the side-channel calls' pattern (telemetry.ts,
+// update-check.ts already carry AbortController timeouts — this closes the
+// gap on the core path).
+const JSON_TIMEOUT_MS = 15_000;
+const CONTENT_TIMEOUT_MS = 60_000;
+// At most one retry. Retried on network errors, 503, and 429 — and only for
+// GET/PUT, since a `put` is byte-idempotent (same key, same bytes) but a
+// POST/DELETE/PATCH might not be, and telling "no bytes sent" apart from "the
+// mutation already landed" isn't reliable enough to risk a double-apply.
+const MAX_ATTEMPTS = 2;
+const RETRYABLE_METHODS = new Set(["GET", "PUT"]);
+const RETRYABLE_STATUSES = new Set([429, 503]);
+const DEFAULT_RETRY_DELAY_MS = 2_000;
+// Cap an honored X-Retry-After so a large server-suggested backoff can't
+// stall a hook/CI step for minutes.
+const MAX_RETRY_AFTER_DELAY_MS = 10_000;
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/** Seconds-valued retry delay from the response, capped; falls back to the default backoff. */
+function retryDelayMs(res) {
+    const raw = res?.headers.get("x-retry-after") ?? res?.headers.get("retry-after");
+    const seconds = raw ? Number(raw) : NaN;
+    if (Number.isFinite(seconds) && seconds > 0) {
+        return Math.min(seconds * 1000, MAX_RETRY_AFTER_DELAY_MS);
+    }
+    return DEFAULT_RETRY_DELAY_MS;
+}
+/** One-line stderr notice so a hook/CI log explains the pause (issue #809). */
+function printRetryNotice(label, delayMs) {
+    const seconds = delayMs % 1000 === 0 ? `${delayMs / 1000}s` : `${Math.round(delayMs) / 1000}s`;
+    process.stderr.write(`warning: uploads.sh ${label}, retrying in ${seconds}…\n`);
+}
+/**
+ * fetch with a per-request AbortController timeout. A timeout (or any other
+ * fetch rejection) surfaces as `UploadsError` code `NETWORK`, naming the
+ * timeout so hook/CI logs are diagnosable.
+ */
+async function fetchWithTimeout(url, init, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
     try {
-        res = await fetch(url, init);
+        return await fetch(url, { ...init, signal: controller.signal });
     }
     catch (err) {
+        if (controller.signal.aborted) {
+            throw new UploadsError(`request timed out after ${timeoutMs}ms`, "NETWORK");
+        }
         throw new UploadsError(err instanceof Error ? err.message : "network request failed", "NETWORK");
     }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * The shared resilience core for both `jsonRequest` and
+ * `createUploadsClient`'s `request`: bounded timeout + bounded retry on
+ * network errors, 503, and 429, honoring `X-Retry-After` when present.
+ * Never retries a non-idempotent method (see `RETRYABLE_METHODS` above).
+ * Returns the raw `Response` on the final attempt — callers still handle
+ * `!res.ok` themselves via `parseErrorResponse`.
+ */
+async function resilientFetch(method, url, init, timeoutMs) {
+    const retryable = RETRYABLE_METHODS.has(method.toUpperCase());
+    for (let attempt = 1;; attempt++) {
+        let res;
+        let networkErr;
+        try {
+            res = await fetchWithTimeout(url, init, timeoutMs);
+        }
+        catch (err) {
+            networkErr = err;
+        }
+        const canRetry = retryable &&
+            attempt < MAX_ATTEMPTS &&
+            (networkErr !== undefined || (res !== undefined && RETRYABLE_STATUSES.has(res.status)));
+        if (!canRetry) {
+            if (networkErr)
+                throw networkErr;
+            return res;
+        }
+        const delayMs = retryDelayMs(res);
+        printRetryNotice(res ? `responded ${res.status}` : "request failed", delayMs);
+        await sleep(delayMs);
+    }
+}
+async function jsonRequest(url, init) {
+    const method = (init.method ?? "GET").toUpperCase();
+    const res = await resilientFetch(method, url, init, JSON_TIMEOUT_MS);
     if (!res.ok)
         throw await parseErrorResponse(res);
     return (await res.json());
@@ -280,18 +370,7 @@ export function createUploadsClient(config) {
         if (opts?.auth !== false) {
             headers.Authorization = `Bearer ${config.token}`;
         }
-        let res;
-        try {
-            res = await fetch(path, {
-                method,
-                headers,
-                body: opts?.body,
-            });
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : "network request failed";
-            throw new UploadsError(message, "NETWORK");
-        }
+        const res = await resilientFetch(method, path, { method, headers, body: opts?.body }, opts?.longTimeout ? CONTENT_TIMEOUT_MS : JSON_TIMEOUT_MS);
         if (!res.ok) {
             throw await parseErrorResponse(res);
         }
@@ -383,6 +462,7 @@ export function createUploadsClient(config) {
             const result = await request("PUT", `${canonicalFilesBase(config)}/${encodeKeyPath(key)}`, {
                 body,
                 headers,
+                longTimeout: true,
             });
             if (result.url == null) {
                 throw new UploadsError("upload succeeded but workspace has no publicBaseUrl", "NO_PUBLIC_URL", 201);

package/dist/commands/install.d.ts

@@ -1,10 +1,21 @@
 import { type GlobalFlags } from "../cli-args.js";
 import { type CommandRunner } from "../github-gh.js";
 export declare const DEFAULT_MCP_URL = "https://agents.uploads.sh/mcp";
+type McpClientId = "claude" | "codex" | "grok";
+interface McpClient {
+    id: McpClientId;
+    label: string;
+    command: (name: string, url: string, bearer: string) => string[];
+}
+/**
+ * Agent CLIs that can register the hosted MCP server. Each is attempted
+ * independently; a missing binary is skipped so the others can still install.
+ */
+export declare const MCP_CLIENTS: readonly McpClient[];
 export interface StepResult {
     command: string[];
     ok: boolean;
-    skipped?: "dry-run" | "sign-in" | "already-configured";
+    skipped?: "dry-run" | "sign-in" | "already-configured" | "missing-cli";
     error?: string;
     output?: string;
 }
@@ -27,3 +38,4 @@ export declare function runInstall(args: string[], opts: {
     /** Override home for hook installs (tests). */
     home?: string;
 }, help?: boolean): Promise<number>;
+export {};

package/dist/commands/install.js

@@ -6,20 +6,62 @@ import { HOOK_COMMAND, HOOK_INVOCATION, installHookManifests, } from "../hooks-i
 export const DEFAULT_MCP_URL = "https://agents.uploads.sh/mcp";
 const SKILL_SOURCE = "buildinternet/uploads";
 const SKILL_NAMES = ["uploads-cli", "github-screenshots", "annotate-screenshots"];
+/** `mcp add --transport http` with an Authorization header. */
+function httpMcpAdd(binary, name, url, bearer) {
+    return [
+        binary,
+        "mcp",
+        "add",
+        "--transport",
+        "http",
+        name,
+        url,
+        "--header",
+        `Authorization: Bearer ${bearer}`,
+    ];
+}
+/**
+ * Agent CLIs that can register the hosted MCP server. Each is attempted
+ * independently; a missing binary is skipped so the others can still install.
+ */
+export const MCP_CLIENTS = [
+    {
+        id: "claude",
+        label: "Claude Code",
+        command: (name, url, bearer) => httpMcpAdd("claude", name, url, bearer),
+    },
+    {
+        id: "codex",
+        label: "Codex",
+        // Codex HTTP MCP has no --header; auth is OAuth on first use (same as the
+        // plugin's .mcp.json). Passing --bearer-token-env-var UPLOADS_TOKEN would
+        // break machines that signed in via `uploads login` (token lives in the
+        // config file, not the environment).
+        command: (name, url) => ["codex", "mcp", "add", name, "--url", url],
+    },
+    {
+        id: "grok",
+        label: "Grok",
+        command: (name, url, bearer) => httpMcpAdd("grok", name, url, bearer),
+    },
+];
+const MCP_CLIENT_BINARIES = MCP_CLIENTS.map((c) => c.id).join(", ");
 const INSTALL_HELP = `uploads install — set up agent integrations (skills + remote MCP + hooks)
 
 Installs the github-screenshots, uploads-cli, and annotate-screenshots agent
-skills, registers the
-hosted MCP server with Claude Code, and installs the PR screenshot reminder
-hook for Grok / Cursor when those tools are present. The remote MCP endpoint
-infers your workspace from the bearer token, so only the token is needed.
+skills, registers the hosted MCP server with whichever of Claude Code, Codex,
+and Grok are on PATH, and installs the PR screenshot reminder hook for
+Grok / Cursor when those tools are present. A missing agent CLI is skipped —
+it does not fail the rest of the install. The remote MCP endpoint infers your
+workspace from the bearer token, so only the token is needed.
 
 Claude Code and Codex ship the same reminder via their plugins (same command:
 \`${HOOK_INVOCATION}\`) — install those plugins instead of relying on this step.
 
 Safe to re-run. An MCP server already registered under this name is reported
 as \`already configured\` and left as-is — including the token it was created
-with. To point it at a new token: \`claude mcp remove <name>\` first.
+with. To point it at a new token: \`<cli> mcp remove <name>\` first
+(e.g. \`claude mcp remove uploads\`).
 
 Usage:
   uploads install [skill|mcp|hooks|all]     (default: all)
@@ -28,7 +70,8 @@ What it does:
   skill   Agent skills (via npx skills) — github-screenshots: visuals into
           PRs/issues; uploads-cli: full CLI reference; annotate-screenshots:
           hand-drawn callouts and redaction on screenshots
-  mcp     Hosted MCP server in Claude Code — put, list, attach, galleries
+  mcp     Hosted MCP server in Claude Code, Codex, and Grok — each CLI that
+          is installed is registered; missing ones are skipped
   hooks   PR screenshot reminder for Grok / Cursor (user-global manifests)
 
 What runs under the hood:
@@ -37,7 +80,10 @@ What runs under the hood:
           with npx on PATH — missing tooling fails once with install guidance)
   mcp     claude mcp add --transport http uploads ${DEFAULT_MCP_URL} \\
             --header "Authorization: Bearer <token>"
-          (needs the Claude Code CLI on PATH)
+          codex mcp add uploads --url ${DEFAULT_MCP_URL}
+          grok mcp add --transport http uploads ${DEFAULT_MCP_URL} \\
+            --header "Authorization: Bearer <token>"
+          (each is skipped when that CLI is not on PATH)
   hooks   write/merge ~/.grok/hooks/… and ~/.cursor/hooks.json when present
 
 Options:
@@ -76,9 +122,15 @@ export function missingBinaryHint(binary) {
                 `Install Node 22+ from https://nodejs.org (or your package manager), open a new shell, ` +
                 `confirm \`${binary} --version\` works, then re-run \`uploads install skill\`.`);
         case "claude":
-            return (`claude not found on PATH — MCP install needs the Claude Code CLI. ` +
+            return (`claude not found on PATH — MCP install for Claude Code needs the Claude Code CLI. ` +
                 `Install it from https://docs.anthropic.com/en/docs/claude-code, ensure \`claude\` is on PATH, ` +
-                `then re-run \`uploads install mcp\`. Skills and hooks still work without Claude Code.`);
+                `then re-run \`uploads install mcp\`. Other agent CLIs (and skills/hooks) still work without it.`);
+        case "codex":
+            return (`codex not found on PATH — MCP install for Codex needs the Codex CLI. ` +
+                `Install it, ensure \`codex\` is on PATH, then re-run \`uploads install mcp\`.`);
+        case "grok":
+            return (`grok not found on PATH — MCP install for Grok needs the Grok CLI. ` +
+                `Install it, ensure \`grok\` is on PATH, then re-run \`uploads install mcp\`.`);
         default:
             return `${binary} not found on PATH — install it and ensure it is available in this shell.`;
     }
@@ -131,28 +183,59 @@ function skillCommand(skill) {
     // -g global, -y non-interactive, -a '*' every agent (skips the multi-select TUI)
     return ["npx", "-y", "skills", "add", SKILL_SOURCE, "--skill", skill, "-g", "-y", "-a", "*"];
 }
-/**
- * `claude mcp add` refuses to overwrite an existing entry and exits non-zero
- * ("MCP server uploads already exists in local config"). That is the steady
- * state for anyone re-running `uploads install`, not a failure — recognize it
- * so the run stays green and the footer tells them how to re-add if they want
- * a fresh token in the header.
- */
-function alreadyConfigured(result) {
-    return !result.ok && /already exists/i.test(result.error ?? "");
+/** `mcp add` exits non-zero when the name is already registered; treat that as success. */
+function isAlreadyConfigured(error) {
+    return /already exists|already (configured|registered|present)|duplicate/i.test(error);
 }
-function mcpCommand(name, url, bearer) {
-    return [
-        "claude",
-        "mcp",
-        "add",
-        "--transport",
-        "http",
-        name,
-        url,
-        "--header",
-        `Authorization: Bearer ${bearer}`,
-    ];
+function mcpStepKey(client) {
+    return `mcp:${client.id}`;
+}
+function mcpClientForStep(step) {
+    return MCP_CLIENTS.find((c) => mcpStepKey(c) === step);
+}
+function stepFamily(key) {
+    if (key.startsWith("skill:"))
+        return "skills";
+    if (key.startsWith("mcp:"))
+        return "mcp";
+    return key;
+}
+function partitionSteps(results) {
+    const skills = [];
+    const mcp = [];
+    const other = [];
+    for (const entry of Object.entries(results)) {
+        const key = entry[0];
+        if (key.startsWith("skill:"))
+            skills.push(entry);
+        else if (key.startsWith("mcp:"))
+            mcp.push(entry);
+        else
+            other.push(entry);
+    }
+    return { skills, mcp, other };
+}
+/** Run one client's `mcp add`; missing binaries skip, duplicates are already-configured. */
+function runMcpClientStep(run, command) {
+    try {
+        const output = run(command[0], command.slice(1)).trim();
+        return { command, ok: true, output: output || undefined };
+    }
+    catch (err) {
+        if (isEnoent(err)) {
+            return {
+                command,
+                ok: true,
+                skipped: "missing-cli",
+                error: `${command[0]} not found on PATH`,
+            };
+        }
+        const message = err instanceof Error ? err.message : String(err);
+        if (isAlreadyConfigured(message)) {
+            return { command, ok: true, skipped: "already-configured", output: message };
+        }
+        return { command, ok: false, error: message };
+    }
 }
 function peekToken(globals) {
     try {
@@ -171,27 +254,35 @@ function peekToken(globals) {
 }
 function printOneHumanStep(step, r, redact, verbose, mcpName) {
     const cmd = redact(r.command.join(" "));
-    if (r.skipped === "dry-run") {
-        process.stdout.write(`${step}: would run — ${cmd}\n`);
-    }
-    else if (r.skipped === "sign-in") {
-        process.stdout.write(`${step}: skipped — ${redact(r.error ?? "needs sign-in")}\n`);
-    }
-    else if (r.skipped === "already-configured") {
-        process.stdout.write(`${step}: already configured — "${mcpName}" is registered in Claude Code (nothing to do)\n` +
-            `  To re-register (e.g. with a new token): claude mcp remove ${mcpName} && uploads install mcp\n`);
+    switch (r.skipped) {
+        case "dry-run":
+            process.stdout.write(`${step}: would run — ${cmd}\n`);
+            return;
+        case "sign-in":
+            process.stdout.write(`${step}: skipped — ${redact(r.error ?? "needs sign-in")}\n`);
+            return;
+        case "missing-cli":
+            process.stdout.write(`${step}: skipped — ${r.error ?? `${r.command[0]} not found on PATH`}\n`);
+            return;
+        case "already-configured": {
+            const client = mcpClientForStep(step);
+            const label = client?.label ?? "the client";
+            const remove = `${client?.id ?? "<cli>"} mcp remove ${mcpName}`;
+            process.stdout.write(`${step}: already configured — "${mcpName}" is registered in ${label} (nothing to do)\n` +
+                `  To re-register (e.g. with a new token): ${remove} && uploads install mcp\n`);
+            return;
+        }
     }
-    else if (r.ok) {
+    if (r.ok) {
         process.stdout.write(`${step}: ok\n`);
         if (verbose && r.output) {
             process.stdout.write(`  ${redact(r.output).split("\n").join("\n  ")}\n`);
         }
+        return;
     }
-    else {
-        process.stderr.write(`${step}: failed — ${redact(r.error ?? "")}\n`);
-        if (verbose)
-            process.stderr.write(`  command: ${cmd}\n`);
-    }
+    process.stderr.write(`${step}: failed — ${redact(r.error ?? "")}\n`);
+    if (verbose)
+        process.stderr.write(`  command: ${cmd}\n`);
 }
 /** Shared error when every skill step failed identically; otherwise undefined. */
 function identicalSkillFailure(skillEntries) {
@@ -203,27 +294,41 @@ function identicalSkillFailure(skillEntries) {
     const allSame = skillEntries.every(([, r]) => !r.ok && !r.skipped && r.error === error);
     return allSame ? error : undefined;
 }
+function printMcpHumanSteps(mcp, redact, verbose, mcpName) {
+    const first = mcp[0];
+    if (!first)
+        return;
+    if (mcp.every(([, r]) => r.skipped === "sign-in")) {
+        printOneHumanStep("mcp", first[1], redact, verbose, mcpName);
+        return;
+    }
+    if (mcp.every(([, r]) => r.skipped === "missing-cli")) {
+        process.stdout.write(`mcp: skipped — no agent CLI on PATH (${MCP_CLIENT_BINARIES}). Skills and hooks still work.\n`);
+        return;
+    }
+    for (const [step, r] of mcp) {
+        printOneHumanStep(step, r, redact, verbose, mcpName);
+    }
+}
 /** Collapse identical skill failures to one `skills:` line (missing npx, old npm, …). */
 function printHumanSteps(results, redact, verbose, mcpName) {
-    const entries = Object.entries(results);
-    const skillEntries = entries.filter(([step]) => step.startsWith("skill:"));
-    const sharedError = identicalSkillFailure(skillEntries);
+    const { skills, mcp, other } = partitionSteps(results);
+    const sharedError = identicalSkillFailure(skills);
     if (sharedError !== undefined) {
         process.stderr.write(`skills: failed — ${redact(sharedError)}\n`);
         if (verbose) {
-            for (const [step, r] of skillEntries) {
+            for (const [step, r] of skills) {
                 process.stderr.write(`  ${step}: ${redact(r.command.join(" "))}\n`);
             }
         }
     }
     else {
-        for (const [step, r] of skillEntries) {
+        for (const [step, r] of skills) {
             printOneHumanStep(step, r, redact, verbose, mcpName);
         }
     }
-    for (const [step, r] of entries) {
-        if (step.startsWith("skill:"))
-            continue;
+    printMcpHumanSteps(mcp, redact, verbose, mcpName);
+    for (const [step, r] of other) {
         printOneHumanStep(step, r, redact, verbose, mcpName);
     }
 }
@@ -288,24 +393,27 @@ export async function runInstall(args, opts, help = false) {
         }
     }
     if (target === "mcp" || target === "all") {
-        if (!dryRun && !token) {
-            results.mcp = {
-                command: mcpCommand(name, url, "<token>"),
-                ok: false,
-                skipped: "sign-in",
-                error: "needs sign-in — run `uploads login`, then `uploads install mcp`",
-            };
-        }
-        else {
-            const command = mcpCommand(name, url, token || "<token>");
-            if (human)
-                process.stdout.write("Installing MCP server…\n");
-            const step = dryRun
-                ? { command, ok: true, skipped: "dry-run" }
-                : runStep(run, command);
-            results.mcp = alreadyConfigured(step)
-                ? { command, ok: true, skipped: "already-configured", output: step.error }
-                : step;
+        const bearer = token || "<token>";
+        const skipSignIn = !dryRun && !token;
+        if (human && !skipSignIn)
+            process.stdout.write("Installing MCP server…\n");
+        for (const client of MCP_CLIENTS) {
+            const command = client.command(name, url, bearer);
+            const key = mcpStepKey(client);
+            if (skipSignIn) {
+                results[key] = {
+                    command,
+                    ok: false,
+                    skipped: "sign-in",
+                    error: "needs sign-in — run `uploads login`, then `uploads install mcp`",
+                };
+            }
+            else if (dryRun) {
+                results[key] = { command, ok: true, skipped: "dry-run" };
+            }
+            else {
+                results[key] = runMcpClientStep(run, command);
+            }
         }
     }
     if (target === "hooks" || target === "all") {
@@ -345,28 +453,25 @@ export async function runInstall(args, opts, help = false) {
         (dryRun || (human && (verbose || hookWrites.some((w) => w.action !== "skipped"))))) {
         printHookResults(hookWrites);
     }
-    const skillResults = Object.entries(results)
-        .filter(([step]) => step.startsWith("skill:"))
-        .map(([, r]) => r);
+    const { skills: skillEntries, mcp: mcpEntries } = partitionSteps(results);
+    const skillResults = skillEntries.map(([, r]) => r);
     const skillsOk = skillResults.length > 0 && skillResults.every((r) => r.ok);
     const skillsFailed = skillResults.some((r) => !r.ok);
+    const mcpResults = mcpEntries.map(([, r]) => r);
+    const mcpFailed = mcpResults.some((r) => !r.ok);
     if (!failed && !dryRun) {
         const stepLabels = [
-            ...new Set(Object.keys(results).map((k) => (k.startsWith("skill:") ? "skills" : k))),
+            ...new Set(Object.entries(results)
+                .filter(([, r]) => r.ok && r.skipped !== "missing-cli" && r.skipped !== "sign-in")
+                .map(([k]) => stepFamily(k))),
         ];
-        printSuccessFooter(stepLabels, signedIn);
+        if (stepLabels.length > 0)
+            printSuccessFooter(stepLabels, signedIn);
     }
-    else if (failed && !dryRun && skillsOk && results.mcp && !results.mcp.ok) {
-        let next;
-        if (results.mcp.skipped === "sign-in") {
-            next = "Sign in with `uploads login`, then re-run `uploads install mcp`.";
-        }
-        else if (results.mcp.error?.includes("not found on PATH")) {
-            next = "Install the Claude Code CLI (or skip MCP), then re-run `uploads install mcp`.";
-        }
-        else {
-            next = "Fix the MCP step above, then re-run `uploads install mcp`.";
-        }
+    else if (failed && !dryRun && skillsOk && mcpFailed) {
+        const next = mcpResults.every((r) => r.skipped === "sign-in")
+            ? "Sign in with `uploads login`, then re-run `uploads install mcp`."
+            : "Fix the MCP step above, then re-run `uploads install mcp`.";
         process.stdout.write(`\nSkills are installed. ${next}\n`);
     }
     else if (failed && !dryRun && skillsFailed) {

package/dist/commands/login.js

@@ -459,7 +459,7 @@ export async function runLogin(args, opts, help = false, deviceIo = defaultDevic
         process.stdout.write(`saved credentials to ${path}\napi: ${savedApiUrl}\nworkspace: ${result.workspace}\ntoken: ${redactToken(result.token)}\n`);
         process[doctor.ok ? "stdout" : "stderr"].write(`doctor: ${checked ? (doctor.ok ? "ok" : `failed — ${doctor.error}`) : "skipped"}\n`);
         if (doctor.ok)
-            process.stdout.write("\nusing a coding agent? run `uploads install` to add the uploads skill + MCP server to Claude Code\n");
+            process.stdout.write("\nusing a coding agent? run `uploads install` to add the uploads skill + MCP server\n");
     }
     return doctor.ok ? 0 : 1;
 }

package/dist/commands/update.js

@@ -11,8 +11,9 @@ const UPDATE_HELP = `uploads update — update the CLI and refresh agent integra
 Upgrades the globally installed npm package, then re-runs \`uploads install\` so
 the agent skills match the new version. Skills drift on their own, so this
 refreshes them even when the CLI is already current. An MCP server already
-registered is left as-is (\`already configured\`) — \`claude mcp add\` never
-overwrites an existing entry.
+registered is left as-is (\`already configured\`) — \`claude mcp add\` (and the
+Codex/Grok equivalents) never overwrite an existing entry. A missing agent CLI
+is skipped so it does not fail the rest of the refresh.
 
 Usage:
   uploads update [options]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@buildinternet/uploads",
-  "version": "0.46.0",
+  "version": "0.46.2",
   "description": "CLI and client for uploads.sh — workspace-scoped image hosting for GitHub embeds",
   "type": "module",
   "sideEffects": false,
@@ -48,7 +48,7 @@
   "devDependencies": {
     "@types/node": "^26.1.0",
     "ai": "^6.0.0",
-    "files-sdk": "^2.2.4",
+    "files-sdk": "^2.2.5",
     "typescript": "^7.0.2",
     "vitest": "^4.1.10"
   },