@kyleroche/relay 0.2.0 → 0.2.2

package/dist/relay-mcp.js

@@ -4231,9 +4231,9 @@ import { existsSync as existsSync5, readdirSync as readdirSync2, readFileSync as
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { dirname as dirname3, join as join7 } from "path";
 var AFTER_APPLY = {
-  10: async (db, log) => {
+  10: async (db, log2) => {
     const n = await backfillTaskState(db);
-    if (n) log(`schema: cached the state of ${n} task${n === 1 ? "" : "s"}`);
+    if (n) log2(`schema: cached the state of ${n} task${n === 1 ? "" : "s"}`);
   }
 };
 var beside = join7(dirname3(fileURLToPath2(import.meta.url)), "migrations");
@@ -4264,12 +4264,12 @@ async function currentVersion(db) {
   return typeof v === "number" ? v : typeof v === "string" ? Number(v) || 0 : 0;
 }
 async function migrate(db, opts = {}) {
-  const log = opts.log ?? noopLog;
+  const log2 = opts.log ?? noopLog;
   const have = await currentVersion(db);
   let applied = have;
   for (const m of loadMigrations(opts.dir)) {
     if (m.version <= have) continue;
-    log(`schema: applying ${String(m.version).padStart(3, "0")}_${m.name}`);
+    log2(`schema: applying ${String(m.version).padStart(3, "0")}_${m.name}`);
     await db.transaction(async (tx) => {
       await tx.exec(m.sql);
       await tx.query(
@@ -4278,7 +4278,7 @@ async function migrate(db, opts = {}) {
         [JSON.stringify(m.version)]
       );
     });
-    await AFTER_APPLY[m.version]?.(db, log);
+    await AFTER_APPLY[m.version]?.(db, log2);
     applied = m.version;
   }
   return applied;
@@ -5134,6 +5134,11 @@ var defaultActor = () => `human:${process.env.RELAY_ACTOR ?? process.env.USER ??
 async function refreshSiteTokenIfStale(cfg, now = Date.now()) {
   if (!cfg.site || !cfg.siteToken || !cfg.siteRefreshToken || !tokenIsStale(cfg.siteTokenExpiresAt, now)) return cfg;
   if (cfg.siteTokenSource === "env") return cfg;
+  return refreshSiteToken(cfg, now);
+}
+var canRefreshSiteToken = (cfg) => !!cfg.site && !!cfg.siteRefreshToken && cfg.siteTokenSource !== "env";
+async function refreshSiteToken(cfg, now = Date.now()) {
+  if (!cfg.site || !cfg.siteRefreshToken) throw new SiteModeError("refreshing the site token", `no refresh token is stored; run \`relay setup --site ${cfg.site ?? "<url>"}\` to approve this machine again`);
   try {
     const r = await refreshAccessToken({ site: cfg.site, refreshToken: cfg.siteRefreshToken });
     const c = credentialsFromToken(r, now);
@@ -5480,6 +5485,9 @@ var IDLE_HEARTBEAT_MS = 5 * 6e4;
 // ../core/src/work/service.ts
 import { join as join12 } from "path";
 
+// ../core/src/work/login.ts
+var LOGIN_TIMEOUT_MS = 5 * 6e4;
+
 // ../core/src/work/container.ts
 var CONTAINER_HOME = "/home/relay";
 var CONTAINER_RELAY_HOME = `${CONTAINER_HOME}/.harness`;
@@ -6092,7 +6100,7 @@ function parseUploadKey(key) {
   return { project: project === "_" ? null : project, id, filename };
 }
 async function finalizeFromKey(db, store, input) {
-  const log = input.log ?? (() => {
+  const log2 = input.log ?? (() => {
   });
   const parsed = parseUploadKey(input.key);
   if (!parsed) throw new IngestError(`not an upload key: ${input.key}`);
@@ -6106,7 +6114,7 @@ async function finalizeFromKey(db, store, input) {
   }
   const probe = await probeBytes(bytes, parsed.filename);
   const prefix = `${parsed.project ?? "_"}/${parsed.id}`;
-  const thumbKey = await storeThumbnail(store, prefix, probe, bytes, parsed.filename, { thumbSize: input.thumbSize, log });
+  const thumbKey = await storeThumbnail(store, prefix, probe, bytes, parsed.filename, { thumbSize: input.thumbSize, log: log2 });
   try {
     return await recordRow(db, { id: parsed.id, input, probe, storageKey: input.key, thumbKey, filename: parsed.filename });
   } catch (e) {
@@ -6144,6 +6152,148 @@ import { join as join21 } from "path";
 import { readFileSync as readFileSync14 } from "fs";
 import { spawnSync } from "child_process";
 
+// ../mcp/src/bridge.ts
+import { isInitializeRequest, isJSONRPCRequest } from "@modelcontextprotocol/sdk/types.js";
+var BRIDGE_UNREACHABLE = -32e3;
+var BRIDGE_UNAUTHORIZED = -32001;
+function parseMcpBody(text2, contentType) {
+  const t = text2.trim();
+  if (!t) return [];
+  if (/text\/event-stream/i.test(contentType ?? "") || !t.startsWith("{") && !t.startsWith("[")) {
+    const out = [];
+    for (const event of t.split(/\r?\n\r?\n/)) {
+      const data = event.split(/\r?\n/).filter((l) => l.startsWith("data:")).map((l) => l.slice(5).trim()).join("\n");
+      if (!data) continue;
+      const parsed2 = JSON.parse(data);
+      out.push(...Array.isArray(parsed2) ? parsed2 : [parsed2]);
+    }
+    return out;
+  }
+  const parsed = JSON.parse(t);
+  return Array.isArray(parsed) ? parsed : [parsed];
+}
+function errorOf(text2) {
+  try {
+    const j = JSON.parse(text2);
+    if (j && typeof j.error?.message === "string") return { message: j.error.message, ...j.error.data !== void 0 ? { data: j.error.data } : {} };
+  } catch {
+  }
+  return void 0;
+}
+var describe3 = (e) => e instanceof Error ? e.message : String(e);
+function createSiteBridge(opts) {
+  const site = normalizeSite(opts.site);
+  const doFetch = opts.fetch ?? fetch;
+  let protocolVersion;
+  let sessionId;
+  const post2 = (msg, token) => {
+    const headers = {
+      authorization: `Bearer ${token}`,
+      "content-type": "application/json",
+      accept: "application/json, text/event-stream",
+      "user-agent": "relay-mcp"
+    };
+    if (protocolVersion && !isInitializeRequest(msg)) headers["mcp-protocol-version"] = protocolVersion;
+    if (sessionId) headers["mcp-session-id"] = sessionId;
+    return doFetch(`${site}/mcp`, { method: "POST", headers, body: JSON.stringify(msg) });
+  };
+  return {
+    site,
+    async forward(msg) {
+      const id = isJSONRPCRequest(msg) ? msg.id : void 0;
+      const fail2 = (code, message2, data) => id === void 0 ? [] : [{ jsonrpc: "2.0", id, error: { code, message: message2, ...data !== void 0 ? { data } : {} } }];
+      let token;
+      try {
+        token = await opts.auth.token();
+      } catch (e) {
+        return fail2(BRIDGE_UNAUTHORIZED, `relay-mcp: no usable token for ${site}: ${describe3(e)}`);
+      }
+      let res;
+      let renewFailure = "";
+      try {
+        res = await post2(msg, token);
+        if (res.status === 401) {
+          let next;
+          try {
+            next = await opts.auth.renew(token);
+          } catch (e) {
+            renewFailure = describe3(e);
+          }
+          if (next) {
+            opts.log?.(`${site} refused the token (401); renewed it and retrying`);
+            res = await post2(msg, next);
+          }
+        }
+      } catch (e) {
+        return fail2(BRIDGE_UNREACHABLE, `relay-mcp: cannot reach ${site}/mcp: ${describe3(e)}`);
+      }
+      const text2 = await res.text();
+      const sid = res.headers.get("mcp-session-id");
+      if (sid) sessionId = sid;
+      if (res.status === 401) {
+        const err = errorOf(text2);
+        opts.log?.(`${site} refused the token (401)${renewFailure ? `; renewing it failed: ${renewFailure}` : ""}`);
+        return fail2(BRIDGE_UNAUTHORIZED, `${err?.message ?? `relay-mcp: ${site} refused the token (401)`}${renewFailure ? ` Renewing the token failed: ${renewFailure}` : ""}`, err?.data);
+      }
+      if (!res.ok) {
+        const err = errorOf(text2);
+        return fail2(BRIDGE_UNREACHABLE, err?.message ?? `relay-mcp: ${site}/mcp answered HTTP ${res.status}${text2.trim() ? `: ${text2.trim().slice(0, 200)}` : ""}`, err?.data);
+      }
+      let out;
+      try {
+        out = parseMcpBody(text2, res.headers.get("content-type"));
+      } catch (e) {
+        return fail2(BRIDGE_UNREACHABLE, `relay-mcp: unreadable answer from ${site}/mcp: ${describe3(e)}`);
+      }
+      if (isInitializeRequest(msg)) {
+        for (const m of out) {
+          const v = m.result?.protocolVersion;
+          if (typeof v === "string") protocolVersion = v;
+        }
+      }
+      return out;
+    }
+  };
+}
+async function serveSiteBridge(transport, bridge, onError) {
+  const inFlight = /* @__PURE__ */ new Set();
+  transport.onmessage = (msg) => {
+    const p = bridge.forward(msg).then(async (out) => {
+      for (const m of out) await transport.send(m);
+    }).catch((e) => onError?.(e)).finally(() => inFlight.delete(p));
+    inFlight.add(p);
+  };
+  transport.onerror = (e) => onError?.(e);
+  await transport.start();
+  return {
+    /** Resolves once every message received so far has been answered (stdin closed: finish, then exit). */
+    async drain() {
+      while (inFlight.size) await Promise.allSettled([...inFlight]);
+    }
+  };
+}
+var tokenLabel = (cfg) => cfg.siteTokenName ?? { device: "an unnamed device-flow token", invite: "an unnamed invite token", manual: "a pasted token", env: "RELAY_TOKEN" }[cfg.siteTokenSource ?? "manual"];
+function siteAuth(initial) {
+  let cfg = initial;
+  const reload = () => {
+    const fresh = loadConfig();
+    return fresh.site === cfg.site && fresh.siteToken ? fresh : cfg;
+  };
+  return {
+    async token() {
+      cfg = await refreshSiteTokenIfStale(reload());
+      return cfg.siteToken;
+    },
+    async renew(rejected) {
+      cfg = reload();
+      if (cfg.siteToken && cfg.siteToken !== rejected) return cfg.siteToken;
+      if (!canRefreshSiteToken(cfg)) return void 0;
+      cfg = await refreshSiteToken(cfg);
+      return cfg.siteToken;
+    }
+  };
+}
+
 // ../mcp/src/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
@@ -6849,8 +6999,34 @@ ${p.summary}` : head);
 }
 
 // ../mcp/src/stdio.ts
-async function main() {
-  const h = await openHarness(void 0, { local: true });
+var log = (m) => console.error(`relay-mcp: ${m}`);
+var describe4 = (e) => e instanceof Error ? e.message : String(e);
+async function serveSite(cfg) {
+  const site = cfg.site;
+  try {
+    cfg = await refreshSiteTokenIfStale(cfg);
+  } catch (e) {
+    log(describe4(e));
+  }
+  const bridge = createSiteBridge({ site, auth: siteAuth(cfg), log });
+  const transport = new StdioServerTransport();
+  const served = await serveSiteBridge(transport, bridge, (e) => log(describe4(e)));
+  let closing = false;
+  const finish = async () => {
+    if (closing) return;
+    closing = true;
+    await served.drain();
+    await transport.close().catch(() => {
+    });
+    process.exit(0);
+  };
+  process.stdin.on("end", () => void finish());
+  process.on("SIGINT", () => void finish());
+  process.on("SIGTERM", () => void finish());
+  log(`site mode, forwarding to ${site} as ${tokenLabel(cfg)}`);
+}
+async function serveLocal(cfg) {
+  const h = await openHarness(cfg, { local: true });
   await migrate(h.db);
   const embed = briefEmbedder(h);
   const actor = `agent:${process.env.RELAY_MCP_CLIENT ?? "mcp"}`;
@@ -6879,10 +7055,16 @@ async function main() {
   process.on("SIGINT", onSignal);
   process.on("SIGTERM", onSignal);
   await server.connect(transport);
-  console.error(`[relay-mcp] serving on stdio (${h.db.driver})`);
+  log(`local mode, ${h.db.driver === "pg" ? "postgres via DATABASE_URL" : cfg.dbFile}`);
+}
+async function main() {
+  const cfg = loadConfig();
+  ensureHome(cfg);
+  if (cfg.site && cfg.siteToken) await serveSite(cfg);
+  else await serveLocal(cfg);
 }
 main().catch((e) => {
-  console.error(`[relay-mcp] ${e instanceof Error ? e.stack ?? e.message : String(e)}`);
+  console.error(`relay-mcp: ${e instanceof Error ? e.stack ?? e.message : String(e)}`);
   process.exit(1);
 });
 export {

package/dist/relay.js

@@ -5343,6 +5343,10 @@ var defaultActor = () => `human:${process.env.RELAY_ACTOR ?? process.env.USER ??
 async function refreshSiteTokenIfStale(cfg, now = Date.now()) {
   if (!cfg.site || !cfg.siteToken || !cfg.siteRefreshToken || !tokenIsStale(cfg.siteTokenExpiresAt, now)) return cfg;
   if (cfg.siteTokenSource === "env") return cfg;
+  return refreshSiteToken(cfg, now);
+}
+async function refreshSiteToken(cfg, now = Date.now()) {
+  if (!cfg.site || !cfg.siteRefreshToken) throw new SiteModeError("refreshing the site token", `no refresh token is stored; run \`relay setup --site ${cfg.site ?? "<url>"}\` to approve this machine again`);
   try {
     const r = await refreshAccessToken({ site: cfg.site, refreshToken: cfg.siteRefreshToken });
     const c = credentialsFromToken(r, now);
@@ -5911,6 +5915,8 @@ var run = (bin, args, opts = {}) => new Promise((res) => {
     { cwd: opts.cwd, env: opts.env ?? cleanEnv(), timeout: opts.timeoutMs ?? 12e4, maxBuffer: 16 * 1024 * 1024 },
     (err, stdout, stderr) => res({ code: err && "code" in err && typeof err.code === "number" ? err.code : err ? 1 : 0, stdout: String(stdout), stderr: String(stderr) })
   );
+  child.stdin?.on("error", () => {
+  });
   child.stdin?.end(opts.input ?? "");
 });
 async function must(bin, args, opts = {}) {
@@ -6363,6 +6369,78 @@ async function runWorker(opts) {
 // ../core/src/work/service.ts
 import { join as join12 } from "path";
 
+// ../core/src/work/login.ts
+var LOGIN_PROVIDERS = ["claude", "gh", "codex", "grok"];
+var isLoginProvider = (s) => LOGIN_PROVIDERS.includes(s);
+var LOGIN_TIMEOUT_MS = 5 * 6e4;
+var fxLoginWords = (provider) => ["env", "FX_NO_OPEN_BROWSER=1", "fx", "login", provider];
+var URL_RE = /https?:\/\/[^\s"'<>)\]]+/g;
+function parseLoginUrl(text) {
+  for (const m of text.matchAll(URL_RE)) {
+    const raw = m[0].replace(/[.,;:!?]+$/, "");
+    let u;
+    try {
+      u = new URL(raw);
+    } catch {
+      continue;
+    }
+    const redirect = u.searchParams.get("redirect_uri");
+    if (!redirect) continue;
+    let r;
+    try {
+      r = new URL(redirect);
+    } catch {
+      continue;
+    }
+    if (!/^(localhost|127\.0\.0\.1|\[::1\])$/.test(r.hostname)) continue;
+    const port = r.port ? Number(r.port) : r.protocol === "https:" ? 443 : 80;
+    if (!Number.isInteger(port) || port <= 0) continue;
+    const state = u.searchParams.get("state");
+    return { url: raw, redirectUri: redirect, host: r.hostname, port, path: r.pathname || "/", ...state ? { state } : {} };
+  }
+  return void 0;
+}
+function parseLoginCallback(requestUrl) {
+  const u = new URL(requestUrl, "http://127.0.0.1");
+  const q2 = u.searchParams;
+  const out = {};
+  const code = q2.get("code");
+  const state = q2.get("state");
+  const error = q2.get("error");
+  const desc = q2.get("error_description");
+  if (code) out.code = code;
+  if (state) out.state = state;
+  if (error) out.error = error;
+  if (desc) out.errorDescription = desc;
+  return out;
+}
+function replayUrl(redirect, requestUrl) {
+  const u = new URL(requestUrl, "http://127.0.0.1");
+  return `http://${redirect.host}:${redirect.port}${redirect.path}${u.search}`;
+}
+function loginDonePage(provider, ok, detail) {
+  const title = ok ? `${provider}: signed in` : `${provider}: sign-in failed`;
+  const body = ok ? "relay has the code and is finishing the login inside the container. You can close this tab." : `${detail ?? "the provider returned an error"}. Go back to the terminal.`;
+  const esc = (s) => s.replace(/[&<>"]/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" })[c]);
+  return `<!doctype html><html><head><meta charset="utf-8"><title>${esc(title)}</title><style>body{font:16px/1.5 -apple-system,system-ui,sans-serif;margin:3rem auto;max-width:36rem;padding:0 1rem;color:#222}h1{font-size:1.25rem}</style></head><body><h1>${esc(title)}</h1><p>${esc(body)}</p></body></html>
+`;
+}
+function manualLoginSteps(provider) {
+  switch (provider) {
+    case "claude":
+      return ["relay work container shell", "claude   # then /login; open the URL it prints on this Mac, paste the code back, then /exit"];
+    case "gh":
+      return ["relay work container shell", "gh auth login --git-protocol https --web && gh auth setup-git   # the device code prints here; enter it at github.com/login/device"];
+    case "codex":
+      return ["relay work container shell", "fx login codex   # open the printed URL on this Mac; the redirect to localhost:1455 reaches the container through its published port"];
+    case "grok":
+      return [
+        "relay work container shell",
+        "FX_NO_OPEN_BROWSER=1 fx login grok   # open the printed URL on this Mac; when the browser ends on an unreachable 127.0.0.1:<port>/callback?state=\u2026&code=\u2026 page, paste only the code value into fx's prompt (the whole address fails; each code is single-use)"
+      ];
+  }
+}
+
 // ../core/src/work/container.ts
 var CONTAINER_NAME = "relay-work";
 var CONTAINER_VOLUME = "relay-work-home";
@@ -6387,6 +6465,7 @@ var LOGIN_CALLBACK_PORTS = [FX_CALLBACK_PORT, CODEX_CALLBACK_PORT];
 var LOGIN_PORTS_ENV = "RELAY_LOGIN_PORTS";
 var CONTAINER_CPUS = 4;
 var execWords = (bin, interactive) => [bin, "exec", "--user", CONTAINER_USER, ...interactive ? ["-it"] : [], CONTAINER_NAME];
+var execStdinWords = (bin) => [bin, "exec", "--user", CONTAINER_USER, "-i", CONTAINER_NAME];
 function containerPlan(s) {
   const exec = (argv, interactive = false) => [...execWords(s.bin, interactive), ...argv];
   const env = {
@@ -6439,17 +6518,26 @@ function containerPlan(s) {
     doctor: exec(["relay", "doctor"]),
     credentials: exec(["test", "-f", CONTAINER_CREDENTIALS]),
     logs: (follow, lines) => [s.bin, "logs", ...follow ? ["--follow"] : [], ...lines ? ["-n", String(lines)] : [], CONTAINER_NAME],
-    exec
+    exec,
+    login: {
+      fx: (provider) => [...execStdinWords(s.bin), ...fxLoginWords(provider)],
+      claude: exec(["claude"], true),
+      gh: exec(["gh", "auth", "login", "--git-protocol", "https", "--web"], true),
+      ghSetupGit: exec(["gh", "auth", "setup-git"]),
+      replay: (url) => exec(["curl", "-fsS", "-o", "/dev/null", url])
+    }
   };
 }
+var CONTAINER_LOGIN_COMMAND = "relay work container login all";
+var CONTAINER_LOGIN_COMMAND_WHY = "one command; opens this Mac's browser for each login and skips the ones already in the volume (claude, gh, then the optional codex and grok)";
 var CONTAINER_LOGIN_STEPS = [
   { cmd: "relay work container shell", why: "a shell inside the container, as the relay user" },
-  { cmd: "claude", why: "then /login: the OAuth paste-code flow (open the URL on this Mac, paste the code back)", login: "claude" },
-  { cmd: "gh auth login && gh auth setup-git", why: "the account the worker clones, pushes and opens PRs as", login: "gh" },
+  { cmd: "claude", why: "then /login: the OAuth paste-code flow (open the URL on this Mac, paste the code back, /exit)", login: "claude" },
+  { cmd: "gh auth login && gh auth setup-git", why: "the account the worker clones, pushes and opens PRs as (device code)", login: "gh" },
   { cmd: "fx login codex", why: "optional: the codex lane (the browser's redirect to localhost:1455 reaches the container through the published port)", login: "codex" },
   {
-    cmd: "fx login --no-browser grok",
-    why: "optional: the grok lane; open the printed address on this Mac, and when the browser ends on a 127.0.0.1:<port>/callback page that cannot load, paste that full address (or the code xAI shows) back into the fx prompt",
+    cmd: "FX_NO_OPEN_BROWSER=1 fx login grok",
+    why: "optional: the grok lane; open the printed URL on this Mac, and when the browser ends on an unreachable 127.0.0.1:<port>/callback?\u2026&code=\u2026 page, paste only the code value into fx's prompt",
     login: "grok"
   },
   { cmd: "exit", why: "then on the Mac: relay work container status" }
@@ -8783,9 +8871,11 @@ ${p.cli}${p.detected ? "" : " (not detected)"}`);
       }
       for (const n of p.notes) console.log(`  note: ${n}`);
     }
+    const mcpNote = siteCfg.site ? `memory MCP server: forwards to ${siteCfg.site} in site mode; local database otherwise` : "memory MCP server: local database (no site configured; it forwards to the site once relay setup --site <url> has run)";
     console.log(`
 hook scripts: ${join23(RELAY_ROOT, "packages", "cli", "hooks")}
 MCP entry:    ${join23(RELAY_ROOT, "packages", "mcp", "bin", "relay-mcp.mjs")}
+              ${mcpNote}
 node:         ${ctx.node}`);
     const major = Number(process.versions.node.split(".")[0]);
     if (major < 24) console.log(`note: hooks will run with Node ${process.versions.node}; relay pins Node 24. Run this through \`pnpm relay setup\` so the pinned binary is recorded instead.`);
@@ -8856,7 +8946,7 @@ async function connectSite(o) {
   } else log2(`check: ${probe.detail}`);
   const paths = writeSiteConfig({ site, token: credential });
   log2(`credential saved to ${paths.credentialsPath} (mode 0600, source: ${credential.source})`);
-  log2(`site mode on: ${site} (${paths.configPath}); memory, feed, token, invite, task and webhook commands and the hooks now use the site. relay link still digests locally and uploads.`);
+  log2(`site mode on: ${site} (${paths.configPath}); memory, feed, token, invite, task and webhook commands, the hooks and the stdio MCP server now use the site. relay link still digests locally and uploads.`);
 }
 
 // src/commands/link.ts
@@ -9581,14 +9671,146 @@ function registerWebhook(program2) {
 }
 
 // src/commands/work.ts
-import { execFileSync as execFileSync5, spawnSync as spawnSync2 } from "child_process";
+import { execFileSync as execFileSync6, spawn, spawnSync as spawnSync2 } from "child_process";
 import { appendFileSync as appendFileSync2, copyFileSync, existsSync as existsSync19, mkdirSync as mkdirSync15, readFileSync as readFileSync18, rmSync as rmSync7, writeFileSync as writeFileSync11 } from "fs";
+import { createServer } from "http";
 import { homedir as homedir10, hostname as hostname2 } from "os";
 import { dirname as dirname8, join as join27 } from "path";
 
 // src/commands/probes.ts
-import { execFile as execFile8 } from "child_process";
-import { join as join26 } from "path";
+import { execFile as execFile8, execFileSync as execFileSync5 } from "child_process";
+import { delimiter as delimiter5, join as join26 } from "path";
+
+// ../mcp/src/server.ts
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { z } from "zod";
+var ALL_SCOPES = [...TOKEN_SCOPES];
+
+// ../mcp/src/http.ts
+import { timingSafeEqual as timingSafeEqual4 } from "crypto";
+import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+
+// ../mcp/src/bridge.ts
+import { isInitializeRequest, isJSONRPCRequest } from "@modelcontextprotocol/sdk/types.js";
+var BRIDGE_UNREACHABLE = -32e3;
+var BRIDGE_UNAUTHORIZED = -32001;
+function parseMcpBody(text, contentType) {
+  const t = text.trim();
+  if (!t) return [];
+  if (/text\/event-stream/i.test(contentType ?? "") || !t.startsWith("{") && !t.startsWith("[")) {
+    const out = [];
+    for (const event of t.split(/\r?\n\r?\n/)) {
+      const data = event.split(/\r?\n/).filter((l) => l.startsWith("data:")).map((l) => l.slice(5).trim()).join("\n");
+      if (!data) continue;
+      const parsed2 = JSON.parse(data);
+      out.push(...Array.isArray(parsed2) ? parsed2 : [parsed2]);
+    }
+    return out;
+  }
+  const parsed = JSON.parse(t);
+  return Array.isArray(parsed) ? parsed : [parsed];
+}
+function errorOf(text) {
+  try {
+    const j = JSON.parse(text);
+    if (j && typeof j.error?.message === "string") return { message: j.error.message, ...j.error.data !== void 0 ? { data: j.error.data } : {} };
+  } catch {
+  }
+  return void 0;
+}
+var describe3 = (e) => e instanceof Error ? e.message : String(e);
+function createSiteBridge(opts) {
+  const site = normalizeSite(opts.site);
+  const doFetch = opts.fetch ?? fetch;
+  let protocolVersion;
+  let sessionId;
+  const post2 = (msg, token) => {
+    const headers = {
+      authorization: `Bearer ${token}`,
+      "content-type": "application/json",
+      accept: "application/json, text/event-stream",
+      "user-agent": "relay-mcp"
+    };
+    if (protocolVersion && !isInitializeRequest(msg)) headers["mcp-protocol-version"] = protocolVersion;
+    if (sessionId) headers["mcp-session-id"] = sessionId;
+    return doFetch(`${site}/mcp`, { method: "POST", headers, body: JSON.stringify(msg) });
+  };
+  return {
+    site,
+    async forward(msg) {
+      const id = isJSONRPCRequest(msg) ? msg.id : void 0;
+      const fail = (code, message2, data) => id === void 0 ? [] : [{ jsonrpc: "2.0", id, error: { code, message: message2, ...data !== void 0 ? { data } : {} } }];
+      let token;
+      try {
+        token = await opts.auth.token();
+      } catch (e) {
+        return fail(BRIDGE_UNAUTHORIZED, `relay-mcp: no usable token for ${site}: ${describe3(e)}`);
+      }
+      let res;
+      let renewFailure = "";
+      try {
+        res = await post2(msg, token);
+        if (res.status === 401) {
+          let next;
+          try {
+            next = await opts.auth.renew(token);
+          } catch (e) {
+            renewFailure = describe3(e);
+          }
+          if (next) {
+            opts.log?.(`${site} refused the token (401); renewed it and retrying`);
+            res = await post2(msg, next);
+          }
+        }
+      } catch (e) {
+        return fail(BRIDGE_UNREACHABLE, `relay-mcp: cannot reach ${site}/mcp: ${describe3(e)}`);
+      }
+      const text = await res.text();
+      const sid = res.headers.get("mcp-session-id");
+      if (sid) sessionId = sid;
+      if (res.status === 401) {
+        const err = errorOf(text);
+        opts.log?.(`${site} refused the token (401)${renewFailure ? `; renewing it failed: ${renewFailure}` : ""}`);
+        return fail(BRIDGE_UNAUTHORIZED, `${err?.message ?? `relay-mcp: ${site} refused the token (401)`}${renewFailure ? ` Renewing the token failed: ${renewFailure}` : ""}`, err?.data);
+      }
+      if (!res.ok) {
+        const err = errorOf(text);
+        return fail(BRIDGE_UNREACHABLE, err?.message ?? `relay-mcp: ${site}/mcp answered HTTP ${res.status}${text.trim() ? `: ${text.trim().slice(0, 200)}` : ""}`, err?.data);
+      }
+      let out;
+      try {
+        out = parseMcpBody(text, res.headers.get("content-type"));
+      } catch (e) {
+        return fail(BRIDGE_UNREACHABLE, `relay-mcp: unreadable answer from ${site}/mcp: ${describe3(e)}`);
+      }
+      if (isInitializeRequest(msg)) {
+        for (const m of out) {
+          const v = m.result?.protocolVersion;
+          if (typeof v === "string") protocolVersion = v;
+        }
+      }
+      return out;
+    }
+  };
+}
+async function listSiteTools(opts) {
+  const bridge = createSiteBridge({ site: opts.site, auth: { token: async () => opts.token, renew: async () => void 0 }, ...opts.fetch ? { fetch: opts.fetch } : {} });
+  const [answer] = await bridge.forward({ jsonrpc: "2.0", id: 1, method: "tools/list", params: {} });
+  if (!answer) throw new Error(`${bridge.site}/mcp returned no answer to tools/list`);
+  if ("error" in answer) throw new Error(answer.error.message);
+  const tools = (answer.result?.tools ?? []).map((t) => t.name);
+  return { tools };
+}
+var tokenLabel = (cfg) => cfg.siteTokenName ?? { device: "an unnamed device-flow token", invite: "an unnamed invite token", manual: "a pasted token", env: "RELAY_TOKEN" }[cfg.siteTokenSource ?? "manual"];
+
+// src/commands/probes.ts
+var INSTALL_HINT = {
+  claude: "install: npm install -g @anthropic-ai/claude-code (or the macOS pkg from claude.com/code), then run claude and /login",
+  codex: "install: npm install -g @openai/codex, then codex login (or use fx: fx login codex)",
+  fx: "install: the macOS arm64 tarball from https://releases.fx.sh (version in https://releases.fx.sh/latest.txt) into ~/.local/bin, then fx login codex / fx login grok",
+  grok: "install: the grok CLI from x.ai's docs, then grok login (or use fx: fx login grok)",
+  gh: "install: brew install gh, or the macOS pkg from https://github.com/cli/cli/releases/latest, then gh auth login && gh auth setup-git"
+};
 var PROBE_TOOLS = ["claude", "codex", "fx", "grok", "gh"];
 function run3(bin, args, timeoutMs = 15e3) {
   return new Promise((res) => {
@@ -9641,7 +9863,7 @@ async function probeTools() {
   for (const tool of PROBE_TOOLS) {
     const bin = onPath2(tool);
     if (!bin) {
-      checks.push({ status: tool === "gh" || tool === "claude" ? "fail" : "warn", name: `cli:${tool}`, detail: "not on PATH" });
+      checks.push({ status: tool === "gh" || tool === "claude" ? "fail" : "warn", name: `cli:${tool}`, detail: `not on PATH; ${INSTALL_HINT[tool]}` });
       continue;
     }
     checks.push({ status: "ok", name: `cli:${tool}`, detail: bin });
@@ -9664,6 +9886,31 @@ async function sandboxCheck(platform = process.platform) {
   const fix = inContainer() ? "the container is the boundary: the Claude lane runs with the allowlist alone, advertised as sandbox:container (recreate the container with `relay work --isolation container --install` to get the runtime flags it needs)" : "Claude jobs fail here (relay work never runs them unsandboxed); the kernel must allow unprivileged user namespaces";
   return { status: "warn", name: "sandbox", detail: `bubblewrap and socat on PATH but ${probe.detail}; ${fix}` };
 }
+function pathCheck(opts = {}) {
+  const find = opts.onPath ?? onPath2;
+  const found = find("relay");
+  if (found) return { status: "ok", name: "path", detail: `relay on PATH: ${found}` };
+  const prefix = (opts.npmPrefix ?? defaultNpmPrefix)();
+  const bin = prefix ? join26(prefix, "bin") : void 0;
+  const shell = opts.shell ?? process.env.SHELL ?? "";
+  const rc = shell.endsWith("zsh") ? "~/.zshrc" : shell.endsWith("fish") ? "~/.config/fish/config.fish" : "~/.bashrc";
+  const running = opts.running ?? process.argv[1] ?? "";
+  const viaNpx = /\/_npx\//.test(running);
+  const install = viaNpx ? "you are running through npx, which installs no command; run `npm install -g @kyleroche/relay`, then " : "";
+  const pathDirs = (opts.pathEnv ?? process.env.PATH ?? "").split(delimiter5).filter(Boolean);
+  if (bin && pathDirs.includes(bin)) {
+    return { status: "warn", name: "path", detail: `relay is not installed as a command: npm install -g @kyleroche/relay (a checkout uses its bin/relay)` };
+  }
+  const fix = bin ? `${install}add npm's bin directory to PATH: echo 'export PATH="${bin}:$PATH"' >> ${rc} and open a new shell` : `${install}add the directory \`npm prefix -g\`/bin prints to PATH in ${rc} and open a new shell`;
+  return { status: "warn", name: "path", detail: `relay is not on PATH; ${fix}` };
+}
+function defaultNpmPrefix() {
+  try {
+    return execFileSync5("npm", ["prefix", "-g"], { encoding: "utf8", timeout: 5e3 }).trim() || void 0;
+  } catch {
+    return void 0;
+  }
+}
 async function containerReport(opts = {}) {
   const bin = onPath2("container");
   const out = { serviceRunning: false, container: { exists: false, running: false } };
@@ -9689,7 +9936,7 @@ function containerCheck(r) {
   if (!r.serviceRunning) return { status: "warn", name, detail: `${r.bin} installed, services not running; run: container system start` };
   if (!r.container.exists) return { status: "ok", name, detail: `installed and running; no ${CONTAINER_NAME} container yet (relay work --isolation container --install)` };
   if (!r.container.running) return { status: "warn", name, detail: `${CONTAINER_NAME} exists (${r.container.state ?? "stopped"}), not running; run: relay work container start` };
-  const lanes = r.lanes === void 0 ? "lanes unknown (relay doctor inside gave no lanes line)" : r.lanes.length ? `serving ${r.lanes.join(", ")} inside` : "no lanes inside yet (log in: relay work container shell)";
+  const lanes = r.lanes === void 0 ? "lanes unknown (relay doctor inside gave no lanes line)" : r.lanes.length ? `serving ${r.lanes.join(", ")} inside` : "no lanes inside yet (log in: relay work container login all)";
   return { status: "ok", name, detail: `${CONTAINER_NAME} running${r.container.image ? ` (${r.container.image})` : ""}; ${lanes}` };
 }
 function fmtAge(ms) {
@@ -9731,8 +9978,22 @@ function lanesFromChecks(checks) {
   return { lanes, reasons };
 }
 var detectLanes = async () => lanesFromChecks(await probeTools());
+async function mcpCheck(cfg, opts) {
+  const name = "mcp";
+  if (!(cfg.site && cfg.siteToken)) return { status: "ok", name, detail: `local mode: ${opts.entry} serves ${cfg.databaseUrl ? "postgres via DATABASE_URL" : `pglite at ${cfg.dbFile}`}` };
+  const now = opts.now ?? Date.now;
+  const t0 = now();
+  const where = `site mode: ${opts.entry} forwards to ${cfg.site} as ${tokenLabel(cfg)}`;
+  try {
+    const { tools } = await (opts.listTools ?? listSiteTools)({ site: cfg.site, token: cfg.siteToken });
+    return { status: "ok", name, detail: `${where}; tools/list answered with ${tools.length} tools, ${now() - t0} ms` };
+  } catch (e) {
+    return { status: "fail", name, detail: `${where}; tools/list failed: ${(e instanceof Error ? e.message : String(e)).slice(0, 200)}` };
+  }
+}
 
 // src/commands/work.ts
+var defaultSpawn = (words) => spawn(words[0], words.slice(1), { stdio: ["pipe", "pipe", "pipe"] });
 var LANES = ["claude", "codex", "grok"];
 var list = (s) => (s ?? "").split(",").map((x) => x.trim()).filter(Boolean);
 var workLogPath = () => join27(relayHome(), "work.log");
@@ -9783,7 +10044,7 @@ function plan(o, deps, containerBin) {
 var defaultDeps = {
   sh(words, opts) {
     try {
-      return { ok: true, out: execFileSync5(words[0], words.slice(1), { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: opts?.timeoutMs ?? 3e4 }).trim() };
+      return { ok: true, out: execFileSync6(words[0], words.slice(1), { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: opts?.timeoutMs ?? 3e4 }).trim() };
     } catch (e) {
       const err = e;
       const out = [err.stderr, err.stdout].map((s) => (s ?? "").toString().trim()).filter(Boolean).join("\n");
@@ -9833,7 +10094,7 @@ async function waitForReadiness(out, forced, signal) {
     const d = forced ? { lanes: forced, reasons: [] } : await detectLanes();
     const missing = [];
     if (!site.site || !site.token) missing.push("no site yet: on the Mac run `relay work --isolation container --install`, or inside: relay setup --site <url>");
-    if (!d.lanes.length) missing.push(`no lanes yet: ${d.reasons.join("; ")}; log in with: relay work container shell`);
+    if (!d.lanes.length) missing.push(`no lanes yet: ${d.reasons.join("; ")}; log in from the Mac with: ${CONTAINER_LOGIN_COMMAND}`);
     if (!missing.length) return d.lanes;
     const msg = `waiting: ${missing.join(" | ")}`;
     if (msg !== said) out(msg);
@@ -9952,7 +10213,7 @@ function registerWork(program2, version2, deps = defaultDeps) {
     }
   });
   const container = work.command("container").enablePositionalOptions().description(`The ${CONTAINER_NAME} container (relay work --isolation container): a shell inside, its status, stop/start/rm, logs (docs/WORKERS.md "Isolation")`);
-  container.command("shell").description(`a shell inside ${CONTAINER_NAME} as the relay user (container exec -it); log in to claude, gh and fx here`).action(() => {
+  container.command("shell").description(`a shell inside ${CONTAINER_NAME} as the relay user (container exec -it); the logins by hand happen here (relay work container login does them for you)`).action(() => {
     const c = needContainer();
     process.exitCode = deps.run(c.plan.shell);
   });
@@ -9965,8 +10226,7 @@ function registerWork(program2, version2, deps = defaultDeps) {
     if (!state.running) return console.log("start it with: relay work container start");
     const doctor = deps.sh(c.plan.doctor, { timeoutMs: 12e4 }).out;
     if (doctor) console.log(doctor.replace(/^/gm, "  "));
-    const lanes = lanesFromDoctorOutput(doctor);
-    console.log(lanes === void 0 ? "lanes:     unknown (no lanes line from relay doctor inside)" : lanes.length ? `lanes:     ${lanes.join(", ")} (the container worker serves these)` : "lanes:     none yet; log in with: relay work container shell");
+    console.log(lanesLine(doctor));
   });
   container.command("stop").description(`stop ${CONTAINER_NAME} (and unload the service that keeps it running, so it stays stopped)`).action(() => {
     const c = needContainer();
@@ -9983,10 +10243,7 @@ function registerWork(program2, version2, deps = defaultDeps) {
     const c = needContainer();
     const p = plan({ jobs: "1" }, deps, c.bin);
     if (existsSync19(p.path)) {
-      for (const w of p.load) {
-        const r2 = deps.sh(w);
-        if (!r2.ok && !/already|in progress|service already loaded/i.test(r2.out)) throw new Error(`${w.join(" ")} failed: ${r2.out.split("\n")[0] ?? ""}`);
-      }
+      loadService(p.load, { tolerateLoaded: true });
       return log2(`service loaded (${p.path}); it runs: ${c.plan.attach.join(" ")}`);
     }
     const r = deps.sh(c.plan.start, { timeoutMs: 12e4 });
@@ -10008,6 +10265,172 @@ function registerWork(program2, version2, deps = defaultDeps) {
     process.exitCode = deps.run(c.plan.logs(!!o.follow, Number(o.n) || void 0));
   });
   container.command("update").description(`rebuild the ${CONTAINER_IMAGE} image from this relay and recreate ${CONTAINER_NAME} on it with today's flags; the ${CONTAINER_VOLUME} volume, its site token and its logins stay. Run after git pull or a package upgrade; prints the plan, --yes does it`).option("--site <url>", "the hosted relay to join inside, only when the volume holds no site token (default: the site this machine is in)").option("--invite <code>", "redeem an invite inside instead of the device flow, only when the volume holds no site token").option("--memory <size>", "the VM's memory (default: what the container has now)").option("--cpus <n>", "the VM's CPUs (default: what the container has now)").option("--yes", "rebuild the image and recreate the container").action((o) => containerInstall({ jobs: "1", interval: String(POLL_MS / 1e3), maxMinutes: "60", sandbox: true, ...o }, "update"));
+  container.command("login [provider]").description(
+    `make the vendor logins inside ${CONTAINER_NAME} from this Mac: ${LOGIN_PROVIDERS.join(", ")} or all (default). The ones relay doctor inside already reports are skipped. codex and grok: fx's authorize URL opens in this Mac's browser and the redirect is caught here; claude and gh: the CLI runs in this terminal (paste a code, device code)`
+  ).option("--force", "log in again even when the volume already holds that login").option("--no-open", "print each authorize URL instead of opening this Mac's browser").option("--timeout <seconds>", "how long to wait for each browser login", String(LOGIN_TIMEOUT_MS / 1e3)).action((provider, o) => containerLogin(provider ?? "all", o));
+  function lanesLine(doctor) {
+    const lanes = lanesFromDoctorOutput(doctor);
+    if (lanes === void 0) return "lanes:     unknown (no lanes line from relay doctor inside)";
+    return lanes.length ? `lanes:     ${lanes.join(", ")} (the container worker serves these)` : `lanes:     none yet; log in with: ${CONTAINER_LOGIN_COMMAND}`;
+  }
+  async function containerLogin(which, o) {
+    const c = needContainer();
+    if (which !== "all" && !isLoginProvider(which)) throw new Error(`login: '${which}' is not one of ${[...LOGIN_PROVIDERS, "all"].join(", ")}`);
+    const wanted = which === "all" ? [...LOGIN_PROVIDERS] : [which];
+    const timeoutMs = Math.max(1, Number(o.timeout) || LOGIN_TIMEOUT_MS / 1e3) * 1e3;
+    const state = containerStateFrom(deps.sh([c.bin, "list", "--all", "--format", "json"]).out);
+    if (!state.exists) throw new Error(`no ${CONTAINER_NAME} container; create it with: relay work --isolation container --install --yes`);
+    if (!state.running) throw new Error(`${CONTAINER_NAME} is not running; start it with: relay work container start`);
+    const have = loginStatesFromDoctorOutput(deps.sh(c.plan.doctor, { timeoutMs: 12e4 }).out);
+    const results = [];
+    for (const p of wanted) {
+      if (have[p] && !o.force) {
+        console.log(`${p.padEnd(7)} already in the volume (relay doctor inside); skipped (--force logs in again)`);
+        results.push({ provider: p, outcome: "skipped" });
+        continue;
+      }
+      const r = p === "claude" || p === "gh" ? ttyLogin(c.plan, p) : await oauthLogin(c.plan, p, { open: o.open, timeoutMs });
+      results.push(r);
+      console.log(`${p.padEnd(7)} ${r.outcome === "ok" ? "signed in" : `FAILED: ${r.detail ?? ""}`}${r.outcome === "ok" && r.detail ? ` (${r.detail})` : ""}`);
+      if (r.outcome === "failed" && r.manual) {
+        console.log("        by hand:");
+        for (const step of manualLoginSteps(p)) console.log(`          ${step}`);
+      }
+    }
+    const after2 = deps.sh(c.plan.doctor, { timeoutMs: 12e4 }).out;
+    const now = loginStatesFromDoctorOutput(after2);
+    console.log(`logins:    ${LOGIN_PROVIDERS.map((p) => `${p} ${now[p] ? "ok" : "missing"}`).join(", ")} (relay doctor inside)`);
+    console.log(lanesLine(after2));
+    if (results.some((r) => r.outcome === "failed")) process.exitCode = 1;
+  }
+  function ttyLogin(p, provider) {
+    if (provider === "claude") {
+      console.log(`claude  ${p.login.claude.join(" ")}`);
+      console.log("        type /login, open the URL it prints on this Mac, paste the code back, then /exit");
+      const code2 = deps.run(p.login.claude);
+      return code2 === 0 ? { provider, outcome: "ok" } : { provider, outcome: "failed", detail: `claude exited ${code2}`, manual: true };
+    }
+    console.log(`gh      ${p.login.gh.join(" ")}`);
+    console.log("        the device code prints below; enter it at github.com/login/device on this Mac");
+    const code = deps.run(p.login.gh);
+    if (code !== 0) return { provider, outcome: "failed", detail: `gh auth login exited ${code}`, manual: true };
+    const r = deps.sh(p.login.ghSetupGit, { timeoutMs: 6e4 });
+    if (!r.ok) return { provider, outcome: "failed", detail: `gh auth setup-git failed: ${r.out.split("\n")[0] ?? ""}`, manual: true };
+    return { provider, outcome: "ok", detail: "gh auth setup-git done" };
+  }
+  function oauthLogin(p, provider, o) {
+    const words = p.login.fx(provider);
+    const published = deps.publishedPorts ?? LOGIN_CALLBACK_PORTS;
+    const pad = "        ";
+    console.log(`${provider.padEnd(7)} ${words.join(" ")}`);
+    return new Promise((resolve5) => {
+      const child = (deps.spawn ?? defaultSpawn)(words);
+      let text = "";
+      let pending = "";
+      let redirect;
+      let server;
+      let settled = false;
+      let handedOver = false;
+      const flush = () => {
+        if (pending.trim()) console.log(`${pad}fx  ${pending}`);
+        pending = "";
+      };
+      const finish = (r) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        server?.close();
+        server?.closeAllConnections();
+        if (child.exitCode === null && child.signalCode === null) child.kill();
+        child.stdin?.end();
+        flush();
+        resolve5({ provider, ...r });
+      };
+      const timer = setTimeout(() => finish({ outcome: "failed", detail: `timed out after ${Math.round(o.timeoutMs / 1e3)}s waiting for the browser login`, manual: true }), o.timeoutMs);
+      const onData = (chunk) => {
+        const s = chunk.toString();
+        text += s;
+        pending += s;
+        const lines = pending.split("\n");
+        pending = lines.pop();
+        for (const l of lines) if (l.trim()) console.log(`${pad}fx  ${l}`);
+        if (!redirect) {
+          const r = parseLoginUrl(text);
+          if (r) {
+            redirect = r;
+            listen(r);
+          }
+        }
+      };
+      child.stdout?.on("data", onData);
+      child.stderr?.on("data", onData);
+      child.on("error", (e) => finish({ outcome: "failed", detail: `could not run ${words[0]}: ${e.message}`, manual: true }));
+      child.on("exit", (code, signal) => {
+        if (settled) return;
+        if (code === 0) return finish({ outcome: "ok", ...redirect ? {} : { detail: "fx needed no browser" } });
+        finish({ outcome: "failed", detail: `fx login ${provider} exited ${code ?? signal}${redirect ? "" : " before printing an authorize URL"}`, manual: true });
+      });
+      function listen(r) {
+        const srv = createServer((req, res) => handle(r, req, res));
+        srv.once("error", (e) => {
+          if (e.code === "EADDRINUSE" && published.includes(r.port)) {
+            console.log(`${pad}127.0.0.1:${r.port} is the container's published port: the browser's redirect reaches the login server inside through it; waiting for fx to finish`);
+            return openBrowser(r);
+          }
+          finish({ outcome: "failed", detail: `cannot listen on 127.0.0.1:${r.port} for the browser's redirect (${e.code === "EADDRINUSE" ? "the port is in use on this Mac" : e.message})`, manual: true });
+        });
+        srv.listen(r.port, "127.0.0.1", () => {
+          server = srv;
+          console.log(`${pad}listening on 127.0.0.1:${r.port} for the browser's redirect`);
+          openBrowser(r);
+        });
+      }
+      function openBrowser(r) {
+        if (!o.open) return console.log(`${pad}open this URL on this Mac:
+${pad}${r.url}`);
+        const opener = deps.platform === "darwin" ? "open" : "xdg-open";
+        const res = deps.sh([opener, r.url]);
+        console.log(res.ok ? `${pad}opened ${r.url.split("?")[0]} in this Mac's browser; finish the sign-in there` : `${pad}could not open the browser (${res.out.split("\n")[0] ?? ""}); open this URL yourself:
+${pad}${r.url}`);
+      }
+      function handle(r, req, res) {
+        const url = req.url ?? "/";
+        if (!url.startsWith(r.path)) {
+          res.writeHead(404);
+          res.end();
+          return;
+        }
+        const html = { "content-type": "text/html; charset=utf-8" };
+        const cb = parseLoginCallback(url);
+        if (cb.error) {
+          const detail = `${cb.error}${cb.errorDescription ? `: ${cb.errorDescription}` : ""}`;
+          res.writeHead(200, html);
+          res.end(loginDonePage(provider, false, detail));
+          return finish({ outcome: "failed", detail: `the provider answered ${detail}`, manual: true });
+        }
+        if (!cb.code) {
+          res.writeHead(400, html);
+          res.end(loginDonePage(provider, false, "the redirect carried no code"));
+          return;
+        }
+        if (r.state && cb.state && cb.state !== r.state) {
+          res.writeHead(400, html);
+          res.end(loginDonePage(provider, false, "the state does not match this login"));
+          return finish({ outcome: "failed", detail: "the redirect's state does not match the one fx sent (another login in flight?)", manual: true });
+        }
+        res.writeHead(200, html);
+        res.end(loginDonePage(provider, true));
+        if (handedOver) return;
+        handedOver = true;
+        if (provider === "codex") {
+          const rr = deps.sh(p.login.replay(replayUrl(r, url)), { timeoutMs: 3e4 });
+          console.log(rr.ok ? `${pad}redirect received; replayed to the Codex listener inside (${r.host}:${r.port}) and the code pasted to fx` : `${pad}redirect received; the replay inside failed (${rr.out.split("\n")[0] ?? ""}); pasting the code to fx`);
+        } else console.log(`${pad}redirect received; pasting the code to fx`);
+        child.stdin?.write(`${cb.code}
+`);
+      }
+    });
+  }
   function needContainer() {
     const bin = deps.onPath("container");
     if (!bin) throw new Error("Apple's container CLI is not on PATH. Install it from https://github.com/apple/container/releases, then: container system start");
@@ -10055,12 +10478,31 @@ function registerWork(program2, version2, deps = defaultDeps) {
     writeFileSync11(p.path, p.content);
     log2(`wrote ${p.path}`);
     if (deps.platform === "darwin") deps.sh(p.unload[0]);
-    for (const w of p.load) {
+    loadService(p.load);
+    log2(`service running; follow it with: tail -f ${p.logPath}; check with: relay work status`);
+  }
+  function loadService(load2, opts = {}) {
+    for (const w of load2) {
       const r = deps.sh(w);
-      if (!r.ok) throw new Error(`${w.join(" ")} failed: ${r.out.split("\n")[0] ?? ""}`);
-      log2(`ran ${w.join(" ")}`);
+      if (r.ok) {
+        log2(`ran ${w.join(" ")}`);
+        continue;
+      }
+      if (opts.tolerateLoaded && /already|in progress|service already loaded/i.test(r.out)) continue;
+      const guiIdx = w.findIndex((a) => /^gui\/\d+$/.test(a));
+      if (deps.platform === "darwin" && guiIdx >= 0) {
+        const alt = [...w];
+        alt[guiIdx] = w[guiIdx].replace(/^gui\//, "user/");
+        const r2 = deps.sh(alt);
+        if (r2.ok) {
+          log2(`ran ${alt.join(" ")}`);
+          console.log(`note        loaded into the user domain: no desktop session for this user (SSH?). It runs while this login lasts; log in on the Mac's screen (or enable automatic login) and re-run relay work --install --yes for the gui domain, which survives logouts.`);
+          continue;
+        }
+        throw new Error(`${w.join(" ")} failed: ${r.out.split("\n")[0] ?? ""} (and user domain: ${r2.out.split("\n")[0] ?? ""}); log in on the Mac's screen as this user once, then re-run`);
+      }
+      throw new Error(`${w.join(" ")} failed: ${r.out.split("\n")[0] ?? ""}`);
     }
-    log2(`service running; follow it with: tail -f ${p.logPath}; check with: relay work status`);
   }
   function containerInstallOrRemove(o) {
     if (!o.uninstall) return containerInstall(o, "install");
@@ -10108,7 +10550,9 @@ function registerWork(program2, version2, deps = defaultDeps) {
     const { steps, allKept } = containerLoginSteps(doctorText);
     if (allKept) return console.log(`logins      kept in the volume: ${steps.filter((s) => s.kept).map((s) => s.login).join(", ")} (relay doctor inside)`);
     console.log(intro);
-    for (const s of steps) console.log(`${indent}${s.cmd.padEnd(36)} ${s.kept ? "kept (already in the volume)" : s.why}`);
+    console.log(`${indent}${CONTAINER_LOGIN_COMMAND.padEnd(36)} ${CONTAINER_LOGIN_COMMAND_WHY}`);
+    console.log(`${indent}or by hand, inside, in this order:`);
+    for (const s of steps) console.log(`${indent}  ${s.cmd.padEnd(34)} ${s.kept ? "kept (already in the volume)" : s.why}`);
     if (doctorText === void 0) console.log(`${indent}(the logins already in the volume are kept; relay work container status says which)`);
   }
   function containerInstall(o, mode) {
@@ -10172,7 +10616,7 @@ function registerWork(program2, version2, deps = defaultDeps) {
     console.log(service.content.replace(/^/gm, "    "));
     for (const w of service.load) console.log(`would run   ${w.join(" ")}`);
     console.log(`log file    ${service.logPath} (the container's output; inside: ${CONTAINER_NAME}:${CONTAINER_RELAY_HOME}/work.log)`);
-    printLogins("              ", now?.doctor, "then        log in inside, in this order:");
+    printLogins("              ", now?.doctor, "then        log in inside:");
     if (deps.platform === "darwin") console.log("note        a LaunchAgent runs while this user is logged in; enable automatic login or keep a session open on a machine that must stay available");
     if (!o.yes) return console.log(`
 re-run with --yes to ${mode === "update" ? "rebuild the image, recreate the container and restart the service" : "build the image, create the container and install the service"}`);
@@ -10221,14 +10665,10 @@ re-run with --yes to ${mode === "update" ? "rebuild the image, recreate the cont
     mkdirSync15(dirname8(service.logPath), { recursive: true });
     writeFileSync11(service.path, service.content);
     log2(`wrote ${service.path}`);
-    for (const w of service.load) {
-      const r = deps.sh(w);
-      if (!r.ok) throw new Error(`${w.join(" ")} failed: ${r.out.split("\n")[0] ?? ""}`);
-      log2(`ran ${w.join(" ")}`);
-    }
+    loadService(service.load);
     console.log(`
 ${CONTAINER_NAME} is running ${image} as worker ${workerName}.`);
-    printLogins("  ", after2.doctor, "Log in inside, in this order:\n");
+    printLogins("  ", after2.doctor, "Log in inside:\n");
     console.log(`
 The logins land in the ${CONTAINER_VOLUME} volume, never on this Mac's home. Check with: relay work container status; the worker's log: relay work container logs -f`);
   }
@@ -10267,7 +10707,7 @@ program.command("init").description("Create ~/.harness/config.json if missing, r
   const h = await openHarness(cfg, { local: true });
   try {
     log3(`database: ${h.db.driver}${h.db.driver === "pglite" ? ` at ${cfg.dbFile}` : " via DATABASE_URL"}`);
-    if (cfg.site) log3(`site mode: commands talk to ${cfg.site}; this local database serves relay link's digest cache and the stdio MCP server`);
+    if (cfg.site) log3(`site mode: commands and the stdio MCP server talk to ${cfg.site}; this local database serves relay link's digest cache`);
     const v = await migrate(h.db, { log: log3 });
     log3(`schema at v${v}`);
     await seedRegistry(h, log3);
@@ -10275,10 +10715,11 @@ program.command("init").description("Create ~/.harness/config.json if missing, r
     await h.close();
   }
 });
-program.command("doctor").description("Report Node version, which CLIs are installed and logged in, the lanes this machine can serve, whether Claude's OS sandbox is available, the container worker tier (macOS), whether the database or site is reachable, how this machine authenticates, and (site mode) which linked repos still lack the GitHub App").action(async () => {
+program.command("doctor").description("Report Node version, which CLIs are installed and logged in, the lanes this machine can serve, whether Claude's OS sandbox is available, the container worker tier (macOS), whether the database or site is reachable, how this machine authenticates, which mode the installed MCP server runs in, and (site mode) which linked repos still lack the GitHub App").action(async () => {
   const checks = [];
   const major = Number(process.versions.node.split(".")[0]);
   checks.push({ status: major >= 24 ? "ok" : "fail", name: "node", detail: `v${process.versions.node}${major >= 24 ? "" : " (need 24+)"}` });
+  checks.push(pathCheck());
   const tools = await probeTools();
   checks.push(...tools);
   const lanes = lanesFromChecks(tools);
@@ -10287,8 +10728,9 @@ program.command("doctor").description("Report Node version, which CLIs are insta
   if (process.platform === "darwin" && !inContainer()) checks.push(containerCheck(await containerReport()));
   const cfg = loadConfig();
   const siteMode = !!cfg.site && !!cfg.siteToken;
+  let live = cfg;
   if (cfg.site && !cfg.siteToken) checks.push({ status: "fail", name: "mode", detail: `site ${cfg.site} is configured without a token; run: relay setup --site ${cfg.site}` });
-  else checks.push({ status: "ok", name: "mode", detail: siteMode ? `site: ${cfg.site} (memory, feed, token, invite, task and webhook commands and the hooks use it)` : "local: the database on this machine" });
+  else checks.push({ status: "ok", name: "mode", detail: siteMode ? `site: ${cfg.site} (memory, feed, token, invite, task and webhook commands, the hooks and the MCP server use it)` : "local: the database on this machine" });
   if (siteMode) {
     const t02 = Date.now();
     const sourceLabel = { device: "approved on /activate (device flow)", invite: "redeemed an invite", manual: "pasted with --token", env: "RELAY_TOKEN in the environment" }[cfg.siteTokenSource ?? "manual"];
@@ -10296,6 +10738,7 @@ program.command("doctor").description("Report Node version, which CLIs are insta
     checks.push({ status: "ok", name: "auth", detail: `${sourceLabel}${cfg.siteTokenName ? ` as ${cfg.siteTokenName}` : ""}${cfg.siteTokenExpiresAt ? `, expires ${cfg.siteTokenExpiresAt}` : ", no expiry"}${renews}` });
     try {
       const h = await openReady();
+      live = h.cfg;
       try {
         const health = await h.client.health();
         checks.push({ status: health.ok ? "ok" : "fail", name: "site", detail: `${health.detail}, ${Date.now() - t02} ms` });
@@ -10323,13 +10766,14 @@ program.command("doctor").description("Report Node version, which CLIs are insta
       await db.query("SELECT 1");
       const v = await currentVersion(db);
       const where = db.driver === "pg" ? "postgres via DATABASE_URL" : `pglite at ${cfg.dbFile}`;
-      checks.push({ status: v > 0 ? "ok" : siteMode ? "ok" : "warn", name: "database", detail: `${where}, schema v${v}${v > 0 || siteMode ? "" : " (run: relay init)"}, ${Date.now() - t0} ms${siteMode ? " (digest cache and stdio MCP only)" : ""}` });
+      checks.push({ status: v > 0 ? "ok" : siteMode ? "ok" : "warn", name: "database", detail: `${where}, schema v${v}${v > 0 || siteMode ? "" : " (run: relay init)"}, ${Date.now() - t0} ms${siteMode ? " (relay link's digest cache only)" : ""}` });
     } finally {
       await db.close();
     }
   } catch (e) {
     checks.push({ status: siteMode ? "warn" : "fail", name: "database", detail: `unreachable: ${(e instanceof Error ? e.message : String(e)).slice(0, 120)}` });
   }
+  checks.push(await mcpCheck(live, { entry: hookPaths(defaultHookContext(RELAY_ROOT)).mcpBin }));
   checks.push({ status: cfg.gateway.apiKey ? "ok" : "warn", name: "gateway", detail: cfg.gateway.apiKey ? "AI_GATEWAY_API_KEY set (embeddings on)" : "AI_GATEWAY_API_KEY unset; retrieval uses full-text only" });
   checks.push(metersCheck(cfg.home));
   for (const c of checks) console.log(`${c.status.padEnd(5)} ${c.name.padEnd(13)} ${c.detail}`);
@@ -10489,6 +10933,7 @@ program.command("usage").option("--days <n>", "window", "7").description("Ledger
   }
 });
 program.parseAsync(process.argv).catch((e) => {
-  console.error(e instanceof Error ? e.stack ?? e.message : e);
+  const msg = e instanceof Error ? e.message : String(e);
+  console.error(process.env.RELAY_DEBUG && e instanceof Error ? e.stack ?? msg : `relay: ${msg}`);
   process.exit(1);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kyleroche/relay",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "relay: your coding-agent subscriptions (Claude Code, Codex, Grok) as one system. The CLI, the session hooks and the memory MCP server.",
   "type": "module",
   "license": "Apache-2.0",
@@ -56,8 +56,8 @@
   },
   "devDependencies": {
     "tsup": "^8.5.0",
-    "@relay/mcp": "0.0.1",
-    "@relay/core": "0.0.1"
+    "@relay/core": "0.0.1",
+    "@relay/mcp": "0.0.1"
   },
   "scripts": {
     "build": "tsup",