@empirical-gauzza/cli 1.0.34 → 1.0.35

package/lib/auth.js

@@ -6,7 +6,7 @@ const os = require('os');
 const path = require('path');
 const { spawnSync } = require('child_process');
 const { log, warn, uiQuestion, uiDim, uiLink, ask } = require('./ui');
-const { readJsonIfExists, writeFile, ensureDir, quotePowerShellArg, runResolvedCommand } = require('./fsUtils');
+const { readJsonIfExists, writeFile, ensureDir, quotePowerShellArg, runResolvedCommand, runPowerShell } = require('./fsUtils');
 const { httpGet, httpJson, httpForm } = require('./http');
 const { getEnv, parseFlag, parseOption } = require('./env');
 const {
@@ -81,17 +81,26 @@ async function oauthPreflight(baseMcpUrl) {
   }
 }
 
+/** Best-effort browser launch. Returns true when the launcher ran, false when it could not. */
 function openBrowser(url) {
+  let result;
   if (process.platform === 'win32') {
-    const script = `Start-Process ${quotePowerShellArg(url)}`;
-    spawnSync('pwsh', ['-NoProfile', '-Command', script], { stdio: 'ignore' });
+    // runPowerShell falls back from pwsh to powershell.exe; the old hardcoded `pwsh` silently
+    // did nothing on a stock Windows install (2026-09-23, real user report).
+    result = runPowerShell(`Start-Process ${quotePowerShellArg(url)}`, { stdio: 'ignore' });
   } else if (process.platform === 'darwin') {
-    spawnSync('open', [url], { stdio: 'ignore' });
+    result = spawnSync('open', [url], { stdio: 'ignore' });
   } else {
-    spawnSync('xdg-open', [url], { stdio: 'ignore' });
+    result = spawnSync('xdg-open', [url], { stdio: 'ignore' });
   }
+  return Boolean(result) && !result.error && result.status === 0;
 }
 
+// How long the loopback listener waits for the browser to come back. Was 5 minutes; a user who
+// has to find the printed link by hand, log in, and pick a workspace can take longer than that,
+// and once the listener closes the browser lands on a dead 127.0.0.1 port with no explanation.
+const OAUTH_CALLBACK_TIMEOUT_MS = 10 * 60 * 1000;
+
 async function runMcpOAuthFlow(baseUrl) {
   return new Promise((resolve, reject) => {
     const { codeVerifier, codeChallenge } = generatePKCE();
@@ -103,9 +112,9 @@ async function runMcpOAuthFlow(baseUrl) {
       if (server) server.close();
       if (!resolved) {
         resolved = true;
-        reject(new Error('OAuth callback timeout (5 minutes)'));
+        reject(new Error(`OAuth callback timeout (${OAUTH_CALLBACK_TIMEOUT_MS / 60000} minutes). The login link has expired; run the command again to get a fresh one.`));
       }
-    }, 5 * 60 * 1000);
+    }, OAUTH_CALLBACK_TIMEOUT_MS);
 
     server = http.createServer((req, res) => {
       const url = new URL(`http://localhost${req.url}`);
@@ -162,8 +171,14 @@ async function runMcpOAuthFlow(baseUrl) {
       authUrl.searchParams.set('scope', 'memory:read memory:write memory:delete offline_access');
 
       log(uiQuestion('Opening browser for Empirical MCP authentication...'));
-      openBrowser(authUrl.toString());
-      log(uiDim(`If browser doesn't open, visit: ${uiLink(authUrl.toString())}`));
+      const opened = openBrowser(authUrl.toString());
+      if (opened) {
+        log(uiDim(`If browser doesn't open, visit: ${uiLink(authUrl.toString())}`));
+      } else {
+        warn('Could not open a browser automatically. Open this link yourself:');
+        log(uiLink(authUrl.toString()));
+      }
+      log(uiDim(`Waiting up to ${OAUTH_CALLBACK_TIMEOUT_MS / 60000} minutes for the browser to finish...`));
     });
 
     server.on('error', (error) => {

package/lib/fsUtils.js

@@ -4,11 +4,51 @@ const fs = require('fs');
 const path = require('path');
 const { spawnSync } = require('child_process');
 
+// 2026-09-23: every Windows shell-out used to hardcode `pwsh` (PowerShell 7). Windows ships only
+// Windows PowerShell 5.1 (`powershell.exe`); PowerShell 7 is a separate install most people do
+// not have. A real user on plain Windows hit `spawnSync pwsh ENOENT` on every plugin install AND
+// the browser never opened for OAuth (openBrowser also went through pwsh), so they found the
+// login link late, after the loopback listener had closed. Resolve once per process: prefer
+// pwsh when present, fall back to powershell.exe, and surface a clear error if neither works.
+let resolvedPowerShell;
+function resolvePowerShell() {
+  if (resolvedPowerShell !== undefined) return resolvedPowerShell;
+  const override = String(process.env.EMPIRICAL_POWERSHELL || '').trim();
+  const candidates = override ? [override] : ['pwsh', 'powershell'];
+  for (const candidate of candidates) {
+    const probe = spawnSync(candidate, ['-NoProfile', '-Command', 'exit 0'], { stdio: 'ignore', timeout: 15000 });
+    if (!probe.error && probe.status === 0) {
+      resolvedPowerShell = candidate;
+      return candidate;
+    }
+  }
+  resolvedPowerShell = null;
+  return null;
+}
+
+/**
+ * Runs a PowerShell script on Windows through whichever PowerShell exists. Returns a spawnSync-
+ * shaped result; when no PowerShell can be found the result carries an `error` (never throws),
+ * the same shape spawnSync itself returns for ENOENT, so callers' existing error paths apply.
+ */
+function runPowerShell(script, options = {}) {
+  const shell = resolvePowerShell();
+  if (!shell) {
+    return {
+      status: null,
+      stdout: '',
+      stderr: '',
+      error: new Error('No PowerShell found (tried pwsh and powershell). Install PowerShell 7 or set EMPIRICAL_POWERSHELL to your PowerShell executable.')
+    };
+  }
+  return spawnSync(shell, ['-NoProfile', '-Command', script], options);
+}
+
 function commandExists(cmd) {
   if (process.platform === 'win32') {
     const escaped = cmd.replace(/'/g, "''");
     const script = `if (Get-Command '${escaped}' -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }`;
-    const result = spawnSync('pwsh', ['-NoProfile', '-Command', script], { stdio: 'ignore' });
+    const result = runPowerShell(script, { stdio: 'ignore' });
     return result.status === 0;
   }
   const result = spawnSync('which', [cmd], { stdio: 'ignore' });
@@ -57,7 +97,7 @@ function runResolvedCommand(command, args, options = {}) {
   }
 
   const script = `& ${quotePowerShellArg(command)} ${args.map(quotePowerShellArg).join(' ')}`;
-  return spawnSync('pwsh', ['-NoProfile', '-Command', script], {
+  return runPowerShell(script, {
     encoding: 'utf8',
     ...(input !== undefined ? { input } : { stdio })
   });
@@ -79,6 +119,8 @@ function summarizeProcessOutput(result) {
 }
 
 module.exports = {
+  resolvePowerShell,
+  runPowerShell,
   commandExists,
   ensureDir,
   readUtf8IfExists,

package/lib/installers/nativePlugin.js

@@ -77,9 +77,9 @@ function detectLockHolders(agentId) {
   const names = LOCK_HOLDER_PROCESS_NAMES[agentId] || [];
   if (!names.length) return [];
   try {
-    const { spawnSync } = require('child_process');
+    const { runPowerShell } = require('../fsUtils');
     const script = `Get-Process -Name ${names.join(',')} -ErrorAction SilentlyContinue | Select-Object -ExpandProperty ProcessName -Unique`;
-    const probe = spawnSync('pwsh', ['-NoProfile', '-Command', script], { encoding: 'utf8', timeout: 5000 });
+    const probe = runPowerShell(script, { encoding: 'utf8', timeout: 5000 });
     return String(probe.stdout || '').split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
   } catch (_error) {
     return [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@empirical-gauzza/cli",
-  "version": "1.0.34",
+  "version": "1.0.35",
   "description": "Persistent cross-tool memory for AI agents. Give Claude Code, Codex, Copilot, Cursor, and ChatGPT one shared memory: save project context once, recall it everywhere via CLI or MCP.",
   "keywords": [
     "memory",