@gettrace/cli 2.0.2 → 2.0.4

package/dist/index.js

@@ -1396,6 +1396,19 @@ function fuzzyReplace(content, oldString, newString, replaceAll = false) {
   return { error: "Found multiple matches for oldString. Provide more surrounding context to make the match unique." };
 }
 program.name("trace").description("Trace IDE Bridge \u2014 connect your codebase and dev server to the Trace extension").version(VERSION);
+program.command("install-native").description("Register the Trace native messaging host so the Chrome extension can auto-launch trace dev").action(async () => {
+  const { execFileSync } = await import("child_process");
+  const { fileURLToPath: fileURLToPath2 } = await import("url");
+  const { dirname: dirname2, join: join5 } = await import("path");
+  const __dirname2 = dirname2(fileURLToPath2(import.meta.url));
+  const script = join5(__dirname2, "..", "scripts", "postinstall.js");
+  try {
+    execFileSync(process.execPath, [script], { stdio: "inherit" });
+  } catch (e) {
+    console.error(chalk2.red("\u2717 Native host registration failed:"), e.message);
+    process.exit(1);
+  }
+});
 program.command("dev").description("Start dev server + IDE bridge together (recommended)").argument("[command]", 'Override the dev command (e.g. "npm run start:staging")').option("-p, --port <port>", "WebSocket port for IDE bridge", "8765").option("--no-ui", "Disable the branded TUI and stream raw logs (useful for piping/CI)").action(async (commandOverride, options) => {
   const port = parseInt(options.port);
   const projectPath = process.cwd();
@@ -1463,19 +1476,22 @@ program.command("dev").description("Start dev server + IDE bridge together (reco
     const result = _checkPkg(projectPath, commandOverride);
     if (result.ok)
       return result;
-    try {
-      const entries = fs4.readdirSync(projectPath, { withFileTypes: true });
-      for (const entry of entries) {
-        if (!entry.isDirectory())
-          continue;
-        if (entry.name.startsWith(".") || entry.name === "node_modules")
-          continue;
-        const sub = path4.join(projectPath, entry.name);
-        const r = _checkPkg(sub, void 0);
-        if (r.ok)
-          return r;
+    const isGreenfield = projectPath.replace(/\/+$/, "").endsWith("/Trace/greenfield");
+    if (!isGreenfield) {
+      try {
+        const entries = fs4.readdirSync(projectPath, { withFileTypes: true });
+        for (const entry of entries) {
+          if (!entry.isDirectory())
+            continue;
+          if (entry.name.startsWith(".") || entry.name === "node_modules")
+            continue;
+          const sub = path4.join(projectPath, entry.name);
+          const r = _checkPkg(sub, void 0);
+          if (r.ok)
+            return r;
+        }
+      } catch {
       }
-    } catch {
     }
     return { ok: false };
   }
@@ -1709,12 +1725,16 @@ program.command("dev").description("Start dev server + IDE bridge together (reco
       "/browser/network": "BROWSER_GET_NETWORK",
       "/browser/dom": "BROWSER_GET_DOM",
       "/browser/screenshot": "BROWSER_SCREENSHOT",
-      "/browser/verify-build": "BROWSER_VERIFY_BUILD"
+      "/browser/verify-build": "BROWSER_VERIFY_BUILD",
+      "/browser/find": "BROWSER_FIND",
+      "/browser/click": "BROWSER_CLICK",
+      "/browser/type": "BROWSER_TYPE",
+      "/browser/wait-for": "BROWSER_WAIT_FOR"
     };
     const isBrowserRoute = url.pathname in browserQueryRoutes || url.pathname === "/browser/eval";
     if (!isBrowserRoute) {
       res.writeHead(404, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ error: "Not found. Available: /browser/{console,network,dom,eval,screenshot,verify-build}" }));
+      res.end(JSON.stringify({ error: "Not found. Available: /browser/{console,network,dom,eval,screenshot,verify-build,find,click,type,wait-for}" }));
       return;
     }
     const client = [...connectedClients].find(
@@ -1745,14 +1765,23 @@ program.command("dev").description("Start dev server + IDE bridge together (reco
       const reqId = ++globalBrowserRequestId;
       const msgType = browserQueryRoutes[url.pathname] || "BROWSER_EVAL";
       const wsMsg = { id: reqId, type: msgType };
-      if (url.pathname === "/browser/eval")
-        wsMsg.code = body.code || "";
+      const params = { ...body || {} };
+      for (const [k, v] of url.searchParams.entries()) {
+        if (!(k in params))
+          params[k] = v;
+      }
+      for (const k of Object.keys(params)) {
+        if (k === "id" || k === "type")
+          continue;
+        wsMsg[k] = params[k];
+      }
       client.send(JSON.stringify(wsMsg));
+      const browserQueryTimeoutMs = url.pathname === "/browser/screenshot" ? 15e3 : url.pathname === "/browser/wait-for" ? Math.min(Number(params.timeout) || 8e3, 3e4) + 4e3 : 5e3;
       const result = await new Promise((resolve3, reject) => {
         const timer = setTimeout(() => {
           globalBrowserPending.delete(reqId);
-          reject(new Error("Browser query timeout (5s). Extension may not be attached to a tab."));
-        }, 5e3);
+          reject(new Error("Browser query timeout (" + Math.round(browserQueryTimeoutMs / 1e3) + "s). Extension may not be attached to a tab."));
+        }, browserQueryTimeoutMs);
         globalBrowserPending.set(reqId, { resolve: resolve3, reject, timer });
       });
       res.writeHead(200, { "Content-Type": "application/json" });

package/native-host/.homedir

@@ -0,0 +1 @@
+/Users/dakshsaini

package/native-host/host-entry

@@ -0,0 +1,27 @@
+#!/opt/homebrew/Cellar/node/24.4.1/bin/node
+// Auto-generated by @gettrace/cli postinstall — do not edit manually
+// Generated: 2026-06-25T19:19:52.878Z
+// Node:  /opt/homebrew/Cellar/node/24.4.1/bin/node
+// Trace: /opt/homebrew/bin/trace
+'use strict';
+
+// Fix PATH before anything else — Chrome launches with a minimal environment
+process.env.PATH = '/opt/homebrew/bin:/opt/homebrew/Cellar/node/24.4.1/bin:' + (process.env.PATH || '/usr/bin:/bin');
+
+// Diagnostic logging — written synchronously so we catch crashes before async
+const fs = require('fs');
+function log(msg) {
+    const line = new Date().toISOString() + ' ' + msg + '\n';
+    try { fs.appendFileSync('/Users/dakshsaini/trace-native-host.log', line); } catch(_) {}
+    try { fs.appendFileSync('/Users/dakshsaini/Desktop/trace-microservices/trace-x/trace-cli/native-host/native-host-debug.log', line); } catch(_) {}
+}
+
+log('[host-entry] started, node=' + process.version + ' pid=' + process.pid);
+
+try {
+    require('/Users/dakshsaini/Desktop/trace-microservices/trace-x/trace-cli/native-host/host.cjs');
+    log('[host-entry] host.cjs loaded OK');
+} catch (err) {
+    log('[host-entry] FATAL: ' + (err.stack || err));
+    process.exit(1);
+}

package/native-host/host.cjs

@@ -0,0 +1,445 @@
+#!/usr/bin/env node
+/**
+ * Trace Native Messaging Host
+ *
+ * Receives messages from the Chrome extension via stdio (Chrome's native
+ * messaging protocol: 4-byte little-endian length prefix + UTF-8 JSON).
+ * Spawns `trace dev` in the given project directory and streams stdout/stderr
+ * back so the extension knows when the server is ready.
+ *
+ * Messages from extension → host:
+ *   { cmd: "spawn", cwd: "/abs/path/to/project" }
+ *   { cmd: "stop" }
+ *   { cmd: "status" }
+ *   { cmd: "check_paths", paths: ["/path/a", "/path/b"] }
+ *
+ * Messages from host → extension:
+ *   { type: "ready", port: 8766 }
+ *   { type: "output", text: "..." }
+ *   { type: "error", text: "..." }
+ *   { type: "exit", code: 0 }
+ *   { type: "status", running: true|false, pid: number|null }
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const { spawn } = require('child_process');
+
+let traceProc = null;
+
+// ── Process lifecycle cleanup ────────────────────────────────────────────────
+// trace dev spawns its own child processes (the agent server on :8766, the
+// dev server, the IDE bridge on :8765). If we only kill `traceProc` those
+// children orphan and keep holding the ports — the next spawn then dies with
+// EADDRINUSE. By launching trace dev `detached` (as a process-group leader)
+// we can kill the ENTIRE group with a single negative-pid signal, freeing all
+// ports synchronously.
+// Send a signal to trace dev's whole process group (detached leader),
+// falling back to the bare pid if the group is already gone.
+function signalTraceGroup(pid, signal) {
+    try {
+        process.kill(-pid, signal);
+    } catch {
+        try { process.kill(pid, signal); } catch { /* already dead */ }
+    }
+}
+
+// Immediate, unconditional group kill — used only as the last-resort on the
+// host's own 'exit'. Clears traceProc so we never double-signal a reused pid.
+function killTraceProc(signal = 'SIGKILL') {
+    if (!traceProc) return;
+    const pid = traceProc.pid;
+    traceProc = null;
+    if (pid) signalTraceGroup(pid, signal);
+}
+
+// Graceful stop: SIGTERM the group FIRST so the agent gets a catchable signal
+// and can run its own cleanup. This matters because the agent spawns dev
+// servers DETACHED (their own process group), so they are NOT in trace dev's
+// group — only the agent's SIGTERM handler kills them. We then escalate to
+// SIGKILL after a short grace period to guarantee the agent + ports go away
+// even if it hangs. (Sending SIGKILL up front — the old behavior — gave the
+// agent no chance to reap its detached dev servers, so they orphaned.)
+let _killEscalation = null;
+function gracefulKillTraceProc(onDone) {
+    if (!traceProc) { if (onDone) onDone(); return; }
+    const pid = traceProc.pid;
+    traceProc = null;
+    if (!pid) { if (onDone) onDone(); return; }
+    signalTraceGroup(pid, 'SIGTERM');
+    if (_killEscalation) clearTimeout(_killEscalation);
+    _killEscalation = setTimeout(() => {
+        signalTraceGroup(pid, 'SIGKILL');
+        if (onDone) onDone();
+    }, 1500);
+}
+
+// Chrome sends SIGTERM (and closes stdin) when the extension disconnects the
+// native port. Funnel every stop trigger through one guarded graceful kill so
+// trace dev + its detached dev servers all go down with us and the ports free.
+let _shuttingDown = false;
+function shutdown() {
+    if (_shuttingDown) return;
+    _shuttingDown = true;
+    gracefulKillTraceProc(() => { try { process.exit(0); } catch { /* ignore */ } });
+    // Safety net: never let the host hang if the escalation callback is lost.
+    setTimeout(() => { try { process.exit(0); } catch { /* ignore */ } }, 3000);
+}
+process.on('SIGTERM', shutdown);
+process.on('SIGINT', shutdown);
+process.on('exit', () => killTraceProc('SIGKILL'));
+// stdin closing == the extension disconnected the port
+process.stdin.on('end', shutdown);
+process.stdin.on('close', shutdown);
+
+// Read the greenfield default workspace path written by postinstall
+const INSTALL_DIR = path.join(os.homedir(), '.local', 'share', 'trace', 'native-host');
+function readGreenfieldPath() {
+    try {
+        const p = fs.readFileSync(path.join(INSTALL_DIR, '.greenfield'), 'utf8').trim();
+        return p || null;
+    } catch { return null; }
+}
+
+// ── Chrome native messaging I/O ──────────────────────────────────────────────
+
+
+
+function readMessage() {
+    return new Promise((resolve, reject) => {
+        const lenBuf = Buffer.alloc(4);
+        let bytesRead = 0;
+
+        function readLen() {
+            const chunk = process.stdin.read(4 - bytesRead);
+            if (!chunk) {
+                process.stdin.once('readable', readLen);
+                return;
+            }
+            chunk.copy(lenBuf, bytesRead);
+            bytesRead += chunk.length;
+            if (bytesRead < 4) { readLen(); return; }
+            const msgLen = lenBuf.readUInt32LE(0);
+            readBody(msgLen);
+        }
+
+        function readBody(len) {
+            let body = Buffer.alloc(0);
+            function tryRead() {
+                const chunk = process.stdin.read(len - body.length);
+                if (!chunk) { process.stdin.once('readable', tryRead); return; }
+                body = Buffer.concat([body, chunk]);
+                if (body.length < len) { tryRead(); return; }
+                try { resolve(JSON.parse(body.toString('utf8'))); }
+                catch (e) { reject(e); }
+            }
+            tryRead();
+        }
+
+        process.stdin.once('readable', readLen);
+    });
+}
+
+function sendMessage(obj) {
+    const json = Buffer.from(JSON.stringify(obj), 'utf8');
+    const lenBuf = Buffer.alloc(4);
+    lenBuf.writeUInt32LE(json.length, 0);
+    process.stdout.write(Buffer.concat([lenBuf, json]));
+}
+
+// ── Spawn trace dev ───────────────────────────────────────────────────────────
+
+// macOS quarantine PREVENTION (the bulletproof fix).
+//
+// Chrome's native-messaging host runs in Chrome's quarantine context, so every
+// file written by the spawned process tree (trace dev → agent → bash → npm/pip/
+// cargo) inherits `com.apple.quarantine`, and Gatekeeper then blocks dlopen()
+// of the resulting native binaries (*.node/.so/.dylib) with a "Not Opened"
+// popup. Stripping after the fact is racy and can't cover out-of-project libs.
+//
+// The fix: spawn `trace dev` THROUGH a tiny `disclaim` shim that clears this
+// process's quarantine flags via libquarantine (qtn_proc_*) and then exec()s
+// the real command. The cleared state is inherited by the whole child tree, so
+// NOTHING any descendant writes is ever quarantined. exec() keeps the same
+// PID / process-group / stdio, so the detached-group-kill and stdout-parsing
+// logic below is unchanged.
+//
+// Best-effort: if the C toolchain (Xcode CLT) is absent or compilation fails,
+// we fall back to spawning directly (the agent's runtime stripper still helps).
+const DISCLAIM_VERSION = 2;
+const DISCLAIM_C = `
+#include <spawn.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <dlfcn.h>
+extern char **environ;
+int main(int argc, char *argv[]) {
+    if (argc < 2) { fprintf(stderr, "disclaim: missing command\\n"); return 2; }
+    posix_spawnattr_t attr;
+    posix_spawnattr_init(&attr);
+    /* Disclaim responsibility so this process (and its whole child tree) is its
+     * own responsible process rather than Chrome's — the modern macOS anchor
+     * for quarantine attribution. Resolved at runtime; no-op if unavailable. */
+    int (*setdisclaim)(posix_spawnattr_t*, int) =
+        (int (*)(posix_spawnattr_t*, int))dlsym(RTLD_DEFAULT, "responsibility_spawnattrs_setdisclaim");
+    if (setdisclaim) setdisclaim(&attr, 1);
+    /* SETEXEC: replace THIS image with the target, so the caller's child keeps
+     * the same pid / process-group / stdio (group-kill + stdout parsing stay
+     * valid). */
+    short flags = 0;
+    posix_spawnattr_getflags(&attr, &flags);
+    posix_spawnattr_setflags(&attr, (short)(flags | POSIX_SPAWN_SETEXEC));
+    pid_t pid;
+    posix_spawnp(&pid, argv[1], NULL, &attr, &argv[1], environ);
+    /* Only reached if spawn failed (SETEXEC otherwise replaced us). */
+    posix_spawnattr_destroy(&attr);
+    execvp(argv[1], &argv[1]);
+    perror("disclaim: exec failed");
+    return 127;
+}
+`;
+
+let _disclaimChecked = false;
+let _disclaimPath = null;
+function ensureDisclaimHelper() {
+    if (process.platform !== 'darwin') return null;
+    if (_disclaimChecked) return _disclaimPath;
+    _disclaimChecked = true;
+    try {
+        const { execFileSync } = require('child_process');
+        const binPath = path.join(INSTALL_DIR, 'disclaim');
+        const verPath = path.join(INSTALL_DIR, '.disclaim-version');
+
+        let cachedVer = null;
+        try { cachedVer = fs.readFileSync(verPath, 'utf8').trim(); } catch { /* none */ }
+        if (fs.existsSync(binPath) && cachedVer === String(DISCLAIM_VERSION)) {
+            _disclaimPath = binPath;
+            return binPath;
+        }
+
+        // Need the C toolchain. Probe `xcode-select -p` first so we never
+        // trigger the "install Command Line Tools" popup when it's absent.
+        try { execFileSync('/usr/bin/xcode-select', ['-p'], { stdio: 'ignore' }); }
+        catch { return null; }
+
+        fs.mkdirSync(INSTALL_DIR, { recursive: true });
+        const srcPath = path.join(INSTALL_DIR, 'disclaim.c');
+        fs.writeFileSync(srcPath, DISCLAIM_C);
+        execFileSync('/usr/bin/cc', ['-O2', '-o', binPath, srcPath], { stdio: 'ignore', timeout: 30000 });
+
+        // The compiled helper itself inherits the host's quarantine flag, which
+        // would make Gatekeeper block IT on exec. Strip that one file directly —
+        // this is the only file we can't prevent (it's the bootstrap).
+        try { execFileSync('/usr/bin/xattr', ['-d', 'com.apple.quarantine', binPath], { stdio: 'ignore' }); }
+        catch { /* not present → fine */ }
+
+        if (fs.existsSync(binPath)) {
+            fs.writeFileSync(verPath, String(DISCLAIM_VERSION));
+            _disclaimPath = binPath;
+            return binPath;
+        }
+    } catch { /* best-effort — fall back to direct spawn */ }
+    return null;
+}
+
+function spawnTraceDev(cwd) {
+    if (traceProc) {
+        sendMessage({ type: 'status', running: true, pid: traceProc.pid });
+        return;
+    }
+
+    // Support local dev mode: TRACE_DEV_MODE=1 + TRACE_CLI_PATH=.../index.js
+    // In production (npm install -g), the global `trace` binary is used.
+    const devCliPath = process.env.TRACE_CLI_PATH;
+    const isDev = process.env.TRACE_DEV_MODE === '1' && devCliPath && fs.existsSync(devCliPath);
+    const traceBin = isDev ? process.execPath : (process.platform === 'win32' ? 'trace.cmd' : 'trace');
+    const traceArgs = isDev ? [devCliPath, 'dev'] : ['dev'];
+
+    // Resolve the working directory — fall back to homedir if none given
+    const resolvedCwd = cwd || os.homedir();
+
+    // Validate the directory exists before spawning — spawn() throws a cryptic
+    // ENOENT that looks like the binary is missing when actually the cwd is wrong.
+    // If it doesn't exist, try to create it (supports auto-creating workspaces).
+    if (!fs.existsSync(resolvedCwd)) {
+        try {
+            fs.mkdirSync(resolvedCwd, { recursive: true });
+        } catch (err) {
+            sendMessage({
+                type: 'error',
+                text: `Could not create project folder: ${resolvedCwd}\n\nError: ${err.message}`
+            });
+            sendMessage({ type: 'exit', code: 1 });
+            return;
+        }
+    }
+
+    // Send homedir + greenfield default alongside spawn confirmation
+    sendMessage({ type: 'output', text: `Spawning trace dev in ${resolvedCwd}` });
+    sendMessage({ type: 'homedir', path: os.homedir() });
+    const greenfield = readGreenfieldPath();
+    if (greenfield) sendMessage({ type: 'greenfield', path: greenfield });
+
+    const env = { ...process.env };
+
+    // Prevention: route the spawn through the `disclaim` shim (macOS) so the
+    // whole child tree never inherits Chrome's quarantine context. The shim
+    // exec()s traceBin, so traceProc keeps the same pid/pgid/stdio as a direct
+    // spawn — group-kill and stdout parsing below are unaffected. Falls back to
+    // a direct spawn when the shim is unavailable.
+    const disclaim = ensureDisclaimHelper();
+    const spawnBin = disclaim ? disclaim : traceBin;
+    const spawnArgs = disclaim ? [traceBin, ...traceArgs] : traceArgs;
+
+    traceProc = spawn(spawnBin, spawnArgs, {
+        cwd: resolvedCwd,
+
+        env,
+        // Launch as a process-group leader so killTraceProc() can take down
+        // trace dev AND all the children it spawns (agent server, dev server,
+        // bridge) in one shot — otherwise they orphan and hold the ports.
+        detached: true,
+        stdio: ['ignore', 'pipe', 'pipe'],
+    });
+
+    traceProc.stdout.on('data', (d) => {
+        const text = d.toString('utf8').trim();
+        sendMessage({ type: 'output', text });
+        // Detect when the agent server is up and ready to accept connections.
+        // trace dev prints "Trace Agent Server listening on port 8766" or
+        // "Agent Server ready" once the HTTP server binds successfully.
+        // We also accept the plain health probe — if 8766 responds to /session
+        // we know it's up regardless of what was printed.
+        if (/8766|Agent Server.*listen|Trace Agent.*ready|Agent.*port/i.test(text)) {
+            sendMessage({ type: 'ready', port: 8766 });
+        }
+    });
+
+    traceProc.stderr.on('data', (d) => {
+        sendMessage({ type: 'error', text: d.toString('utf8').trim() });
+    });
+
+    traceProc.on('exit', (code) => {
+        sendMessage({ type: 'exit', code });
+        traceProc = null;
+    });
+
+    traceProc.on('error', (err) => {
+        sendMessage({ type: 'error', text: `Failed to spawn trace: ${err.message}` });
+        traceProc = null;
+    });
+}
+
+// ── Message loop ─────────────────────────────────────────────────────────────
+
+async function main() {
+    while (true) {
+        let msg;
+        try { msg = await readMessage(); }
+        catch { break; }
+
+        switch (msg.cmd) {
+            case 'spawn':
+                spawnTraceDev(msg.cwd || require('os').homedir());
+                break;
+            case 'stop':
+                // Acknowledge first, then run the same graceful shutdown as a
+                // port-close: SIGTERM trace dev (so the agent reaps its
+                // detached dev servers) → SIGKILL fallback → host exits.
+                sendMessage({ type: 'exit', code: 0 });
+                shutdown();
+                break;
+            case 'status':
+                sendMessage({ type: 'status', running: !!traceProc, pid: traceProc?.pid ?? null });
+                break;
+            case 'homedir':
+                // Return the real home dir — first try os.homedir() (most reliable),
+                // then fall back to a baked .homedir file written at install time.
+                try {
+                    const home = require('os').homedir();
+                    sendMessage({ type: 'homedir', path: home });
+                } catch {
+                    try {
+                        const homedirFile = require('path').join(__dirname, '.homedir');
+                        const home = require('fs').readFileSync(homedirFile, 'utf8').trim();
+                        sendMessage({ type: 'homedir', path: home });
+                    } catch {
+                        sendMessage({ type: 'error', text: 'Could not determine home directory' });
+                    }
+                }
+                break;
+            case 'pick_folder':
+                try {
+                    const { execFile } = require('child_process');
+                    // Acknowledge immediately so the extension knows we're alive
+                    sendMessage({ type: 'folder_ack' });
+                    const promptText = (msg.prompt || 'Choose your project folder');
+
+                    if (process.platform === 'win32') {
+                        // Windows: Open a native folder picker via PowerShell
+                        const psScript = `[System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms') | Out-Null; $f = New-Object System.Windows.Forms.FolderBrowserDialog; $f.Description = '${promptText.replace(/'/g, "''")}'; $f.ShowNewFolderButton = $true; if ($f.ShowDialog() -eq 'OK') { Write-Output $f.SelectedPath } else { Write-Output 'CANCELLED' }`;
+
+                        execFile('powershell', ['-NoProfile', '-Command', psScript], { timeout: 120000 }, (err, stdout) => {
+                            if (err) {
+                                sendMessage({ type: 'error', text: `pick_folder (Windows): ${err.message}` });
+                            } else {
+                                const out = stdout.trim();
+                                if (out === 'CANCELLED' || !out) {
+                                    sendMessage({ type: 'folder_cancelled' });
+                                } else {
+                                    sendMessage({ type: 'folder_picked', path: out });
+                                }
+                            }
+                        });
+                    } else if (process.platform === 'darwin') {
+                        // macOS: Open a native folder picker via AppleScript
+                        const promptTextEscaped = promptText.replace(/"/g, '\\"');
+                        const script = `tell application "Finder" to activate
+delay 0.15
+set chosen to (choose folder with prompt "${promptTextEscaped}")
+set posix to (POSIX path of chosen)
+if posix ends with "/" then set posix to text 1 thru -2 of posix
+posix`;
+                        execFile('osascript', ['-e', script], { timeout: 120000 }, (err, stdout) => {
+                            if (err) {
+                                if (err.code === 1 || (err.message || '').includes('User canceled')) {
+                                    sendMessage({ type: 'folder_cancelled' });
+                                } else {
+                                    sendMessage({ type: 'error', text: `pick_folder: ${err.message}` });
+                                }
+                            } else {
+                                sendMessage({ type: 'folder_picked', path: stdout.trim() });
+                            }
+                        });
+                    } else {
+                        // Linux / Other: Fallback to manual entry since there is no standard GUI picker command
+                        sendMessage({ type: 'error', text: 'Folder picker is not supported on this platform. Please enter the path manually.' });
+                    }
+                } catch (e) {
+                    sendMessage({ type: 'error', text: `pick_folder failed: ${e.message}` });
+                }
+                break;
+            case 'check_paths': {
+                // Batch filesystem existence check — extension passes an array
+                // of absolute paths; host responds with a map of path → boolean.
+                // Used by the workspace dropdown to auto-prune deleted folders.
+                const paths = Array.isArray(msg.paths) ? msg.paths : [];
+                const exists = {};
+                for (const p of paths) {
+                    try { exists[p] = fs.existsSync(p); }
+                    catch { exists[p] = false; }
+                }
+                sendMessage({ type: 'paths_checked', exists });
+                break;
+            }
+            default:
+                sendMessage({ type: 'error', text: `Unknown command: ${msg.cmd}` });
+        }
+    }
+    process.exit(0);
+}
+
+main();

package/native-host/native-host-debug.log

@@ -0,0 +1,4 @@
+2026-06-25T19:19:53.055Z [host-entry] started, node=v24.4.1 pid=34002
+2026-06-25T19:19:53.058Z [host-entry] host.cjs loaded OK
+2026-06-25T19:25:54.655Z [host-entry] started, node=v24.4.1 pid=34709
+2026-06-25T19:25:54.659Z [host-entry] host.cjs loaded OK

package/native-host/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "@gettrace/native-host",
+  "type": "commonjs"
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gettrace/cli",
-  "version": "2.0.2",
+  "version": "2.0.4",
   "description": "Trace IDE Bridge for connecting local filesystem to Trace browser extensions.",
   "main": "dist/index.js",
   "type": "module",
@@ -12,7 +12,8 @@
     "build": "esbuild src/index.ts --bundle --platform=node --format=esm --packages=external --outfile=dist/index.js",
     "dev": "esbuild src/index.ts --bundle --platform=node --format=esm --packages=external --outfile=dist/index.js --watch",
     "start": "node dist/index.js",
-    "prepublishOnly": "npm run build"
+    "prepublishOnly": "npm run build",
+    "postinstall": "node scripts/postinstall.js || true"
   },
   "keywords": [
     "debugging",
@@ -40,7 +41,7 @@
     "@babel/traverse": "^7.24.0",
     "@babel/generator": "^7.24.0",
     "@babel/types": "^7.24.0",
-    "@gettrace/agent": "^2.0.2"
+    "@gettrace/agent": "^2.0.4"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",
@@ -52,6 +53,8 @@
   },
   "files": [
     "dist",
+    "native-host",
+    "scripts",
     "README.md"
   ]
 }

package/scripts/postinstall.js

@@ -0,0 +1,249 @@
+#!/usr/bin/env node
+/**
+ * Trace CLI — postinstall
+ *
+ * Registers the native messaging host so the Chrome extension can
+ * spawn `trace dev` automatically when the user clicks "Connect".
+ *
+ * This runs automatically after `npm install -g @gettrace/cli`.
+ * It's idempotent — safe to run multiple times.
+ *
+ * How it works:
+ *   1. Detects the current Node.js binary path via `process.execPath`
+ *   2. Generates `native-host/host-entry` with a hardcoded shebang
+ *      pointing to the exact node binary (e.g. #!/opt/homebrew/bin/node)
+ *   3. Registers `host-entry` in Chrome's NativeMessagingHosts manifest
+ *
+ * This is the same pattern used by 1Password, Bitwarden, and Claude
+ * Desktop — the installer generates a native host binary with all
+ * paths resolved at install time. No shell wrappers, no PATH issues.
+ *
+ * Chrome Web Store compliant: the host is registered by the CLI
+ * installer, not shipped inside the extension ZIP.
+ */
+
+import { existsSync, mkdirSync, writeFileSync, chmodSync, readFileSync } from 'fs';
+import { join, dirname, resolve } from 'path';
+import { homedir, platform } from 'os';
+import { fileURLToPath } from 'url';
+import { execSync } from 'child_process';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+// ── Configuration ──────────────────────────────────────────────────────────────
+
+// The extension IDs that are allowed to use this native host.
+const ALLOWED_EXTENSION_IDS = [
+    // Development / unpacked extension ID
+    'jefgjgdcelekglimbmgplkaaabdfpgfm',
+    // Add the published CWS extension ID here when you have it:
+    // 'PRODUCTION_EXTENSION_ID',
+];
+
+// Allow users/CI to inject additional IDs at install time via environment variable
+// e.g., TRACE_EXTENSION_IDS="abc,def" npm install -g @gettrace/cli
+if (process.env.TRACE_EXTENSION_IDS) {
+    const extraIds = process.env.TRACE_EXTENSION_IDS.split(',').map(id => id.trim()).filter(Boolean);
+    ALLOWED_EXTENSION_IDS.push(...extraIds);
+}
+
+const HOST_NAME = 'dev.gettrace.host';
+
+// Install native host files into ~/.local/share/trace/native-host/ so that
+// Chrome (and other browsers) can always read them. Files on ~/Desktop,
+// ~/Documents, ~/Downloads require explicit macOS TCC (Privacy) permission
+// which Chrome does not have by default. ~/.local/share/ is always accessible.
+const INSTALL_DIR    = join(homedir(), '.local', 'share', 'trace', 'native-host');
+const HOST_ENTRY     = join(INSTALL_DIR, 'host-entry');
+const HOST_CJS_DEST  = join(INSTALL_DIR, 'host.cjs');
+
+// Source files (from the npm package / local repo)
+const NATIVE_HOST_SRC_DIR = join(__dirname, '..', 'native-host');
+const HOST_CJS_SRC        = join(NATIVE_HOST_SRC_DIR, 'host.cjs');
+
+// Default project workspace — created at install time so first-time users
+// have a ready-to-go folder without needing to configure anything.
+// ~/Documents/Trace/greenfield is Finder-friendly and writable by Node.
+const GREENFIELD_DIR = join(homedir(), 'Documents', 'Trace', 'greenfield');
+
+// ── Step 1: Generate host-entry with hardcoded node shebang ────────────────────
+
+function generateHostEntry() {
+    // process.execPath gives us the ABSOLUTE path to the node binary that
+    // is running right now — e.g. /opt/homebrew/Cellar/node/24.4.1/bin/node
+    // This is the most reliable way to find the correct node binary on any
+    // system, regardless of PATH, nvm, fnm, brew, etc.
+    const nodePath = process.execPath;
+
+    // Also resolve the absolute path to trace binary so host.cjs can use it
+    let tracePath = '';
+    try {
+        tracePath = execSync('which trace', { encoding: 'utf8' }).trim();
+    } catch {
+        // trace might not be in PATH yet during postinstall — that's okay,
+        // host.cjs will fall back to `trace` from the inherited PATH.
+    }
+
+    // Copy host.cjs to the install dir so everything is co-located in a path
+    // that Chrome can always read (not Desktop/Documents/Downloads).
+    mkdirSync(INSTALL_DIR, { recursive: true });
+    const hostCjsSrc = readFileSync(HOST_CJS_SRC);
+    writeFileSync(HOST_CJS_DEST, hostCjsSrc, { mode: 0o644 });
+
+    // Also copy the native-host package.json (forces CJS mode for host-entry)
+    const pkgSrc = join(NATIVE_HOST_SRC_DIR, 'package.json');
+    if (existsSync(pkgSrc)) {
+        writeFileSync(join(INSTALL_DIR, 'package.json'), readFileSync(pkgSrc), { mode: 0o644 });
+    }
+
+    // Log paths — write to home dir only (always writable by Chrome)
+    const logPath1 = `${homedir()}/trace-native-host.log`;
+
+    const content = [
+        `#!${nodePath}`,
+        `// Auto-generated by @gettrace/cli postinstall — do not edit manually`,
+        `// Generated: ${new Date().toISOString()}`,
+        `// Node:  ${nodePath}`,
+        tracePath ? `// Trace: ${tracePath}` : `// Trace: (resolves from PATH)`,
+        `'use strict';`,
+        ``,
+        `// Fix PATH before anything else — Chrome launches with a minimal environment`,
+        tracePath
+            ? `process.env.PATH = '${dirname(tracePath)}:${dirname(nodePath)}:' + (process.env.PATH || '/usr/bin:/bin');`
+            : `process.env.PATH = '${dirname(nodePath)}:/opt/homebrew/bin:/usr/local/bin:' + (process.env.PATH || '/usr/bin:/bin');`,
+        ``,
+        // Inject dev mode env vars when the local CLI exists (dev workflow).
+        // In production these lines are absent — host.cjs uses the global trace binary.
+        ...(() => {
+            const localCli = resolve(__dirname, '..', 'dist', 'index.js');
+            if (existsSync(localCli)) {
+                return [
+                    `// Dev mode: use local CLI build instead of the global npm package`,
+                    `process.env.TRACE_DEV_MODE = '1';`,
+                    `process.env.TRACE_CLI_PATH = '${localCli}';`,
+                    ``,
+                ];
+            }
+            return [];
+        })(),
+        `// Diagnostic logging — written synchronously so we catch crashes before async`,
+        `const fs = require('fs');`,
+        `function log(msg) {`,
+        `    const line = new Date().toISOString() + ' ' + msg + '\\n';`,
+        `    try { fs.appendFileSync('${logPath1}', line); } catch(_) {}`,
+        `}`,
+        ``,
+        `log('[host-entry] started, node=' + process.version + ' pid=' + process.pid);`,
+        ``,
+        `try {`,
+        `    require('${HOST_CJS_DEST}');`,
+        `    log('[host-entry] host.cjs loaded OK');`,
+        `} catch (err) {`,
+        `    log('[host-entry] FATAL: ' + (err.stack || err));`,
+        `    process.exit(1);`,
+        `}`,
+    ].join('\n');
+
+    writeFileSync(HOST_ENTRY, content, { encoding: 'utf8', mode: 0o755 });
+    try { chmodSync(HOST_ENTRY, 0o755); } catch { /* non-fatal on Windows */ }
+
+    console.log(`✓ Generated native host entry: ${HOST_ENTRY}`);
+    console.log(`  Node binary: ${nodePath}`);
+    if (tracePath) console.log(`  Trace binary: ${tracePath}`);
+}
+
+// ── Step 2: Register native messaging manifest ─────────────────────────────────
+
+function getNativeHostDir() {
+    switch (platform()) {
+        case 'darwin':
+            return join(homedir(), 'Library', 'Application Support', 'Google', 'Chrome', 'NativeMessagingHosts');
+        case 'linux':
+            return join(homedir(), '.config', 'google-chrome', 'NativeMessagingHosts');
+        case 'win32':
+            return null; // Windows uses registry
+        default:
+            return null;
+    }
+}
+
+function buildManifest() {
+    return JSON.stringify({
+        name: HOST_NAME,
+        description: 'Trace native host — spawns trace dev in the user\'s project directory',
+        path: HOST_ENTRY,  // Points to the generated entry file with hardcoded node path
+        type: 'stdio',
+        allowed_origins: ALLOWED_EXTENSION_IDS.map(id => `chrome-extension://${id}/`),
+    }, null, 2);
+}
+
+function registerOnWindows() {
+    const manifest = buildManifest();
+    const manifestPath = join(homedir(), 'AppData', 'Local', 'Trace', `${HOST_NAME}.json`);
+    mkdirSync(dirname(manifestPath), { recursive: true });
+    writeFileSync(manifestPath, manifest, 'utf8');
+    const regKey = `HKCU\\Software\\Google\\Chrome\\NativeMessagingHosts\\${HOST_NAME}`;
+    try {
+        execSync(`reg add "${regKey}" /ve /t REG_SZ /d "${manifestPath}" /f`, { stdio: 'pipe' });
+        console.log(`✓ Native host registered (Windows registry)`);
+    } catch (e) {
+        console.warn('⚠ Could not register native host in Windows registry:', e.message);
+    }
+}
+
+function registerOnUnix() {
+    const dir = getNativeHostDir();
+    if (!dir) { console.warn('⚠ Unknown platform, skipping native host registration'); return; }
+
+    mkdirSync(dir, { recursive: true });
+    const manifestPath = join(dir, `${HOST_NAME}.json`);
+    writeFileSync(manifestPath, buildManifest(), 'utf8');
+    console.log(`✓ Native host manifest: ${manifestPath}`);
+}
+
+// ── Main ───────────────────────────────────────────────────────────────────────
+
+// Verify the host logic script exists
+if (!existsSync(HOST_CJS_SRC)) {
+    console.warn(`⚠ Native host script not found at ${HOST_CJS_SRC} — skipping registration`);
+    process.exit(0);
+}
+
+// 1. Generate the entry file
+generateHostEntry();
+
+// 2. Register with Chrome
+if (platform() === 'win32') {
+    registerOnWindows();
+} else {
+    registerOnUnix();
+}
+
+// 3. Create the default greenfield workspace if it doesn't already exist
+try {
+    mkdirSync(GREENFIELD_DIR, { recursive: true });
+    // Write a README so the folder isn't confusingly empty
+    const readmePath = join(GREENFIELD_DIR, 'README.md');
+    if (!existsSync(readmePath)) {
+        writeFileSync(readmePath,
+            '# Trace Greenfield\n\n' +
+            'This is your default Trace workspace for new projects.\n\n' +
+            'Trace will create new projects here when you click **Connect** ' +
+            'without selecting a specific folder.\n\n' +
+            'To work on an existing project, open the Trace extension and go to ' +
+            'Settings → Open Existing Project.\n',
+            'utf8'
+        );
+    }
+    // Persist the path so the native host can send it to the extension on connect
+    writeFileSync(join(INSTALL_DIR, '.greenfield'), GREENFIELD_DIR, 'utf8');
+    console.log(`✓ Default workspace: ${GREENFIELD_DIR}`);
+} catch (e) { console.warn('⚠ Could not create default workspace:', e.message); }
+
+// 4. Store homedir for the host to read back
+try {
+    const homedirFile = join(INSTALL_DIR, '.homedir');
+    writeFileSync(homedirFile, homedir(), 'utf8');
+} catch { /* non-fatal */ }
+
+console.log('✓ Trace ready — reload the extension and click Connect');