@leadbay/mcp 0.23.10 → 0.23.11

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog — @leadbay/mcp
 
+## 0.23.11 — 2026-07-02
+
+Windows `.dxt` sign-in now opens the browser reliably (product#3839).
+
+- **`openInBrowser` (Windows)** — the auto-open resolved the moment `cmd.exe` was *created*, before its internal `start` builtin actually handed the URL to the default browser. So a silent no-op (no default-browser protocol association, a locked-down shell / AppLocker, a corrupt `HKCR\http\shell\open`) went undetected: `browserOpenFailedAtBootstrap` stayed false and the user was told "a browser may have opened" when nothing did. On Windows we now wait (bounded — 800ms for `cmd start`, 1200ms otherwise) for the launcher's **exit code**, treat a non-zero exit as failure, and fall through to `rundll32 url.dll,FileProtocolHandler` (no command interpreter — the same ShellExecute path Explorer uses, with an honest exit code) and finally PowerShell `Start-Process`. When every launcher fails, the `AUTH_REQUIRED` envelope honestly says the browser couldn't be opened and shows the clickable sign-in link. The #3801 `&`-quoting `cmd start` candidate is unchanged and still tried first. macOS/Linux keep resolve-on-`spawn` (the #3805 headless-hang fix — those launchers are the hand-off).
+- **`bin.ts` shutdown** — the `browserOpenInFlight` teardown wait rose 1.5s → 3s so the multi-launcher Windows walk can finish dispatching before exit (the sibling bootstrap wait already allows 4s; the surfaced sign-in link is the fallback either way).
+
 ## 0.23.10 — 2026-07-01
 
 A freshly-created lens no longer reads as "empty" (product#3833).
@@ -467,7 +474,7 @@ Every tool invocation now fires an `mcp tool called` event to PostHog (same proj
 
 ## 0.6.1 — 2026-05-10
 
-**Distribution**: listed in the official MCP Registry as `io.github.leadbay/leadbay-mcp` (auto-published from CI via GitHub OIDC); installable as a Claude Code plugin via `/plugin marketplace add leadbay/leadclaw` then `/plugin install leadbay@leadbay-leadclaw`; submission packets prepared for the Claude.ai connector directory and Anthropic's curated MCPB extension directory.
+**Distribution**: listed in the official MCP Registry as `io.github.leadbay/leadbay-mcp` (auto-published from CI via GitHub OIDC); installable as a Claude Code plugin via `/plugin marketplace add leadbay/mcp` then `/plugin install leadbay@leadbay-mcp`; submission packets prepared for the Claude.ai connector directory and Anthropic's curated MCPB extension directory.
 
 **Registry verification**: adds `mcpName` to the npm package metadata so the MCP Registry can verify ownership of `io.github.leadbay/leadbay-mcp` against the published `@leadbay/mcp` package.
 
@@ -649,7 +656,7 @@ New `leadbay_import_leads` composite write tool.
 Claude Desktop 2026 compatibility + install UX polish. Also publishes the `refine_prompt` `/user_prompt` wire-key fix that landed on `main` in 0.2.3 but never reached npm.
 
 - **Fix [product#3504](https://github.com/leadbay/product/issues/3504)** — `install --target claude-desktop` no longer silently no-ops on Claude Desktop 2026. The app moved to the DXT (Desktop Extension) system; the legacy `claude_desktop_config.json` is UI-prefs-only there and gets overwritten on every prefs save, so a block written to it disappears a few minutes later. `install` now detects DXT (via `Claude Extensions/`, `extensions-installations.json`, or `dxt:*` keys in `config.json`), prints a loud warning pointing at the `.dxt` bundle, and default-skips the legacy write. Pass `--force-legacy` to override.
-- **New: shipping a `.dxt` bundle** — drag-drop into Claude Desktop 2026 → Settings → Extensions. Uploaded to each [GitHub Release](https://github.com/leadbay/leadclaw/releases). Dialog asks for token + region + write-toggle; no terminal required. Manifest is DXT 0.2 (`dxt_version: "0.2"`, `user_config.leadbay_token.sensitive: true`). Source for the build lives in `packages/dxt/`.
+- **New: shipping a `.dxt` bundle** — drag-drop into Claude Desktop 2026 → Settings → Extensions. Uploaded to each [GitHub Release](https://github.com/leadbay/mcp/releases). Dialog asks for token + region + write-toggle; no terminal required. Manifest is DXT 0.2 (`dxt_version: "0.2"`, `user_config.leadbay_token.sensitive: true`). Source for the build lives in `packages/dxt/`.
 - **Fix**: `login` 401 errors no longer end with a dangling `:` when the backend returns an empty body. Messages now read `login failed (401) at <url> (wrong email or password?)`. 429/5xx get their own hints too. The core helper `formatLoginError` is exported from `@leadbay/core` so the MCP and ClawHub surfaces stay in sync.
 - **README**: new section on `npm install -g` EACCES (sudo / npx / nvm workarounds — common on the official nodejs.org `.pkg`), and a pointer to the `.dxt` install for Claude Desktop 2026.
 - **Also shipping** (previously merged but not yet published to npm) — `leadbay_refine_prompt` / `leadbay_set_user_prompt` now send `{ user_prompt }` instead of `{ prompt }` to `POST /user_prompt` ([product#3508](https://github.com/leadbay/product/issues/3508)). Fixes the JSON deserialization 400 Ludo hit during the 0.2.2 install session.

package/MIGRATION.md

@@ -166,7 +166,7 @@ The legacy `leadbay-mcp install --include-write` flag is accepted but a no-op
 
 ---
 
-# Migration: leadclaw / leadbay-mcp 0.1.x → 0.2.0
+# Migration: leadbay-mcp 0.1.x → 0.2.0
 
 This release is the autoplan-reviewed agent-experience overhaul. The OpenClaw
 plugin and MCP server gain a coherent composite-tool surface so an AI agent
@@ -277,7 +277,7 @@ additionally exposes the granular tools; most users don't need it.
 
 ### OpenClaw plugin
 
-In the plugin config (e.g. `openclaw config set plugins.entries.leadclaw.exposeWrite true`):
+In the plugin config (e.g. `openclaw config set plugins.entries.leadbay-mcp.exposeWrite true`):
 
 ```json
 {

package/dist/bin.js

@@ -9407,12 +9407,12 @@ var init_login = __esm({
       execute: async (client, params, ctx) => {
         const cleanPassword = params.password.replace(/\\(.)/g, "$1");
         const startWith = client.region === "fr" ? "fr" : "us";
-        ctx?.logger?.info?.(`LeadClaw login: email=${params.email} startRegion=${startWith}`);
+        ctx?.logger?.info?.(`Leadbay login: email=${params.email} startRegion=${startWith}`);
         try {
           const result = await resolveRegion(params.email, cleanPassword, startWith);
           if (client.baseUrl !== result.baseUrl) {
             client.setBaseUrl(result.baseUrl, result.region);
-            ctx?.logger?.info?.(`LeadClaw login: switched to region=${result.region} (account is in the ${result.region.toUpperCase()} backend)`);
+            ctx?.logger?.info?.(`Leadbay login: switched to region=${result.region} (account is in the ${result.region.toUpperCase()} backend)`);
           }
           client.setToken(result.token);
           client.prefetchOrgData().catch(() => {
@@ -9424,7 +9424,7 @@ var init_login = __esm({
             verified: result.verified
           };
         } catch (err) {
-          ctx?.logger?.error?.(`LeadClaw login: failed: ${err?.message}`);
+          ctx?.logger?.error?.(`Leadbay login: failed: ${err?.message}`);
           return {
             error: true,
             code: "LOGIN_FAILED",
@@ -25800,7 +25800,7 @@ function buildServer(client, opts = {}) {
   }
   const exposedNames = new Set(toolByName.keys());
   const server = new Server(
-    { name: "leadbay", version: opts.version ?? "0.0.0-dev" },
+    { name: "leadbay-mcp", version: opts.version ?? "0.0.0-dev" },
     {
       capabilities: {
         tools: {},
@@ -27582,6 +27582,17 @@ function browserOpenCandidates(url) {
     { cmd: "xdg-open", args: [url] }
   ];
 }
+function windowsFallbackCandidates(url) {
+  const sysRoot = process.env.SystemRoot || process.env.windir || "C:\\Windows";
+  const psLiteral = `'${url.replace(/'/g, "''")}'`;
+  return [
+    { cmd: `${sysRoot}\\System32\\rundll32.exe`, args: ["url.dll,FileProtocolHandler", url] },
+    {
+      cmd: `${sysRoot}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`,
+      args: ["-NoProfile", "-NonInteractive", "-Command", "Start-Process", psLiteral]
+    }
+  ];
+}
 function browserLaunchEnv(debug) {
   const env = { ...process.env };
   if (process.platform !== "linux") return env;
@@ -27646,7 +27657,7 @@ function browserLaunchEnv(debug) {
   return env;
 }
 async function openInBrowser(url, debug) {
-  const candidates = browserOpenCandidates(url);
+  const candidates = process.platform === "win32" ? [...browserOpenCandidates(url), ...windowsFallbackCandidates(url)] : browserOpenCandidates(url);
   const launchEnv = browserLaunchEnv(debug);
   debug?.(
     `openInBrowser: platform=${process.platform} DISPLAY=${launchEnv.DISPLAY ?? "<unset>"} WAYLAND=${launchEnv.WAYLAND_DISPLAY ?? "<unset>"} DBUS=${launchEnv.DBUS_SESSION_BUS_ADDRESS ? "set" : "<unset>"} candidates=[${candidates.map((c) => c.cmd).join(", ")}]`
@@ -27655,14 +27666,43 @@ async function openInBrowser(url, debug) {
   for (const { cmd, args } of candidates) {
     try {
       await new Promise((resolve, reject) => {
-        const spawnOpts = { stdio: "ignore", detached: true, env: launchEnv };
-        if (process.platform === "win32") spawnOpts.windowsVerbatimArguments = true;
+        const isWin = process.platform === "win32";
+        const spawnOpts = { stdio: "ignore", detached: !isWin, env: launchEnv };
+        if (isWin) spawnOpts.windowsVerbatimArguments = true;
         const child = spawn3(cmd, args, spawnOpts);
         child.on("error", reject);
-        child.on("spawn", () => {
-          debug?.(`spawn OK: ${cmd} (pid=${child.pid})`);
+        if (!isWin) {
+          child.on("spawn", () => {
+            debug?.(`spawn OK: ${cmd} (pid=${child.pid})`);
+            child.unref();
+            resolve();
+          });
+          return;
+        }
+        const isCmd = /cmd(\.exe)?$/i.test(cmd);
+        const budgetMs = isCmd ? 800 : 1200;
+        let settled = false;
+        const finish = (fn) => {
+          if (settled) return;
+          settled = true;
+          fn();
+        };
+        const timer = setTimeout(() => {
+          debug?.(`exit-wait timeout (${budgetMs}ms): ${cmd} \u2014 assuming launched`);
           child.unref();
-          resolve();
+          finish(resolve);
+        }, budgetMs);
+        timer.unref?.();
+        child.on("spawn", () => debug?.(`spawn OK: ${cmd} (pid=${child.pid}) \u2014 awaiting exit`));
+        child.on("exit", (code) => {
+          clearTimeout(timer);
+          if (code === 0 || code === null) {
+            debug?.(`exit ${code}: ${cmd} \u2014 launched OK`);
+            finish(resolve);
+          } else {
+            debug?.(`exit ${code}: ${cmd} \u2014 treating as failed, next candidate`);
+            finish(() => reject(new Error(`${cmd} exited ${code}`)));
+          }
         });
       });
       return;
@@ -27767,7 +27807,7 @@ var OAUTH_BASE_URLS = {
     fr: "https://staging.api.leadbay.app"
   }
 };
-var VERSION = "0.23.10";
+var VERSION = "0.23.11";
 var HELP = `
 leadbay-mcp ${VERSION} \u2014 Leadbay Model Context Protocol server
 
@@ -29044,11 +29084,11 @@ async function main() {
       }
     }
     if (browserOpenInFlight) {
-      bootstrapDebug(`shutdown(code=${code}) browser-open still in flight \u2014 waiting up to 1.5s`);
+      bootstrapDebug(`shutdown(code=${code}) browser-open still in flight \u2014 waiting up to 3s`);
       try {
         await Promise.race([
           browserOpenInFlight,
-          new Promise((r) => setTimeout(r, 1500))
+          new Promise((r) => setTimeout(r, 3e3))
         ]);
       } catch {
       }

package/dist/http-server.js

@@ -10529,12 +10529,12 @@ var login = {
   execute: async (client, params, ctx) => {
     const cleanPassword = params.password.replace(/\\(.)/g, "$1");
     const startWith = client.region === "fr" ? "fr" : "us";
-    ctx?.logger?.info?.(`LeadClaw login: email=${params.email} startRegion=${startWith}`);
+    ctx?.logger?.info?.(`Leadbay login: email=${params.email} startRegion=${startWith}`);
     try {
       const result = await resolveRegion(params.email, cleanPassword, startWith);
       if (client.baseUrl !== result.baseUrl) {
         client.setBaseUrl(result.baseUrl, result.region);
-        ctx?.logger?.info?.(`LeadClaw login: switched to region=${result.region} (account is in the ${result.region.toUpperCase()} backend)`);
+        ctx?.logger?.info?.(`Leadbay login: switched to region=${result.region} (account is in the ${result.region.toUpperCase()} backend)`);
       }
       client.setToken(result.token);
       client.prefetchOrgData().catch(() => {
@@ -10546,7 +10546,7 @@ var login = {
         verified: result.verified
       };
     } catch (err) {
-      ctx?.logger?.error?.(`LeadClaw login: failed: ${err?.message}`);
+      ctx?.logger?.error?.(`Leadbay login: failed: ${err?.message}`);
       return {
         error: true,
         code: "LOGIN_FAILED",
@@ -23375,7 +23375,7 @@ function buildServer(client, opts = {}) {
   }
   const exposedNames = new Set(toolByName.keys());
   const server = new Server(
-    { name: "leadbay", version: opts.version ?? "0.0.0-dev" },
+    { name: "leadbay-mcp", version: opts.version ?? "0.0.0-dev" },
     {
       capabilities: {
         tools: {},
@@ -24062,7 +24062,7 @@ function parseWriteEnv(env = process.env) {
 }
 
 // src/http-server.ts
-var VERSION = true ? "0.23.10" : "0.0.0-dev";
+var VERSION = true ? "0.23.11" : "0.0.0-dev";
 var PORT = Number(process.env.PORT ?? 8080);
 var HOST = process.env.HOST ?? "0.0.0.0";
 var sseSessions = /* @__PURE__ */ new Map();

package/dist/installer-electron.js

@@ -867,6 +867,17 @@ function browserOpenCandidates(url) {
     { cmd: "xdg-open", args: [url] }
   ];
 }
+function windowsFallbackCandidates(url) {
+  const sysRoot = process.env.SystemRoot || process.env.windir || "C:\\Windows";
+  const psLiteral = `'${url.replace(/'/g, "''")}'`;
+  return [
+    { cmd: `${sysRoot}\\System32\\rundll32.exe`, args: ["url.dll,FileProtocolHandler", url] },
+    {
+      cmd: `${sysRoot}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`,
+      args: ["-NoProfile", "-NonInteractive", "-Command", "Start-Process", psLiteral]
+    }
+  ];
+}
 function browserLaunchEnv(debug) {
   const env = { ...process.env };
   if (process.platform !== "linux") return env;
@@ -931,7 +942,7 @@ function browserLaunchEnv(debug) {
   return env;
 }
 async function openInBrowser(url, debug) {
-  const candidates = browserOpenCandidates(url);
+  const candidates = process.platform === "win32" ? [...browserOpenCandidates(url), ...windowsFallbackCandidates(url)] : browserOpenCandidates(url);
   const launchEnv = browserLaunchEnv(debug);
   debug?.(
     `openInBrowser: platform=${process.platform} DISPLAY=${launchEnv.DISPLAY ?? "<unset>"} WAYLAND=${launchEnv.WAYLAND_DISPLAY ?? "<unset>"} DBUS=${launchEnv.DBUS_SESSION_BUS_ADDRESS ? "set" : "<unset>"} candidates=[${candidates.map((c) => c.cmd).join(", ")}]`
@@ -940,14 +951,43 @@ async function openInBrowser(url, debug) {
   for (const { cmd, args } of candidates) {
     try {
       await new Promise((resolve, reject) => {
-        const spawnOpts = { stdio: "ignore", detached: true, env: launchEnv };
-        if (process.platform === "win32") spawnOpts.windowsVerbatimArguments = true;
+        const isWin = process.platform === "win32";
+        const spawnOpts = { stdio: "ignore", detached: !isWin, env: launchEnv };
+        if (isWin) spawnOpts.windowsVerbatimArguments = true;
         const child = spawn3(cmd, args, spawnOpts);
         child.on("error", reject);
-        child.on("spawn", () => {
-          debug?.(`spawn OK: ${cmd} (pid=${child.pid})`);
+        if (!isWin) {
+          child.on("spawn", () => {
+            debug?.(`spawn OK: ${cmd} (pid=${child.pid})`);
+            child.unref();
+            resolve();
+          });
+          return;
+        }
+        const isCmd = /cmd(\.exe)?$/i.test(cmd);
+        const budgetMs = isCmd ? 800 : 1200;
+        let settled = false;
+        const finish = (fn) => {
+          if (settled) return;
+          settled = true;
+          fn();
+        };
+        const timer = setTimeout(() => {
+          debug?.(`exit-wait timeout (${budgetMs}ms): ${cmd} \u2014 assuming launched`);
           child.unref();
-          resolve();
+          finish(resolve);
+        }, budgetMs);
+        timer.unref?.();
+        child.on("spawn", () => debug?.(`spawn OK: ${cmd} (pid=${child.pid}) \u2014 awaiting exit`));
+        child.on("exit", (code) => {
+          clearTimeout(timer);
+          if (code === 0 || code === null) {
+            debug?.(`exit ${code}: ${cmd} \u2014 launched OK`);
+            finish(resolve);
+          } else {
+            debug?.(`exit ${code}: ${cmd} \u2014 treating as failed, next candidate`);
+            finish(() => reject(new Error(`${cmd} exited ${code}`)));
+          }
         });
       });
       return;
@@ -1764,7 +1804,7 @@ var init_installer_gui = __esm({
     init_install_dxt();
     init_install_shared();
     init_oauth();
-    VERSION = true ? "0.23.10" : "0.0.0-dev";
+    VERSION = true ? "0.23.11" : "0.0.0-dev";
     MESSAGES = {
       en: {
         installer: {

package/dist/installer-gui.js

@@ -853,6 +853,17 @@ function browserOpenCandidates(url) {
     { cmd: "xdg-open", args: [url] }
   ];
 }
+function windowsFallbackCandidates(url) {
+  const sysRoot = process.env.SystemRoot || process.env.windir || "C:\\Windows";
+  const psLiteral = `'${url.replace(/'/g, "''")}'`;
+  return [
+    { cmd: `${sysRoot}\\System32\\rundll32.exe`, args: ["url.dll,FileProtocolHandler", url] },
+    {
+      cmd: `${sysRoot}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`,
+      args: ["-NoProfile", "-NonInteractive", "-Command", "Start-Process", psLiteral]
+    }
+  ];
+}
 function browserLaunchEnv(debug) {
   const env = { ...process.env };
   if (process.platform !== "linux") return env;
@@ -917,7 +928,7 @@ function browserLaunchEnv(debug) {
   return env;
 }
 async function openInBrowser(url, debug) {
-  const candidates = browserOpenCandidates(url);
+  const candidates = process.platform === "win32" ? [...browserOpenCandidates(url), ...windowsFallbackCandidates(url)] : browserOpenCandidates(url);
   const launchEnv = browserLaunchEnv(debug);
   debug?.(
     `openInBrowser: platform=${process.platform} DISPLAY=${launchEnv.DISPLAY ?? "<unset>"} WAYLAND=${launchEnv.WAYLAND_DISPLAY ?? "<unset>"} DBUS=${launchEnv.DBUS_SESSION_BUS_ADDRESS ? "set" : "<unset>"} candidates=[${candidates.map((c) => c.cmd).join(", ")}]`
@@ -926,14 +937,43 @@ async function openInBrowser(url, debug) {
   for (const { cmd, args } of candidates) {
     try {
       await new Promise((resolve, reject) => {
-        const spawnOpts = { stdio: "ignore", detached: true, env: launchEnv };
-        if (process.platform === "win32") spawnOpts.windowsVerbatimArguments = true;
+        const isWin = process.platform === "win32";
+        const spawnOpts = { stdio: "ignore", detached: !isWin, env: launchEnv };
+        if (isWin) spawnOpts.windowsVerbatimArguments = true;
         const child = spawn3(cmd, args, spawnOpts);
         child.on("error", reject);
-        child.on("spawn", () => {
-          debug?.(`spawn OK: ${cmd} (pid=${child.pid})`);
+        if (!isWin) {
+          child.on("spawn", () => {
+            debug?.(`spawn OK: ${cmd} (pid=${child.pid})`);
+            child.unref();
+            resolve();
+          });
+          return;
+        }
+        const isCmd = /cmd(\.exe)?$/i.test(cmd);
+        const budgetMs = isCmd ? 800 : 1200;
+        let settled = false;
+        const finish = (fn) => {
+          if (settled) return;
+          settled = true;
+          fn();
+        };
+        const timer = setTimeout(() => {
+          debug?.(`exit-wait timeout (${budgetMs}ms): ${cmd} \u2014 assuming launched`);
           child.unref();
-          resolve();
+          finish(resolve);
+        }, budgetMs);
+        timer.unref?.();
+        child.on("spawn", () => debug?.(`spawn OK: ${cmd} (pid=${child.pid}) \u2014 awaiting exit`));
+        child.on("exit", (code) => {
+          clearTimeout(timer);
+          if (code === 0 || code === null) {
+            debug?.(`exit ${code}: ${cmd} \u2014 launched OK`);
+            finish(resolve);
+          } else {
+            debug?.(`exit ${code}: ${cmd} \u2014 treating as failed, next candidate`);
+            finish(() => reject(new Error(`${cmd} exited ${code}`)));
+          }
         });
       });
       return;
@@ -1027,7 +1067,7 @@ async function oauthLogin(opts) {
 }
 
 // installer/installer-gui.ts
-var VERSION = true ? "0.23.10" : "0.0.0-dev";
+var VERSION = true ? "0.23.11" : "0.0.0-dev";
 var MESSAGES = {
   en: {
     installer: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leadbay/mcp",
-  "version": "0.23.10",
+  "version": "0.23.11",
   "mcpName": "io.github.leadbay/leadbay-mcp",
   "description": "Model Context Protocol (MCP) server for Leadbay — AI lead discovery, qualification, and enrichment for Claude Desktop, Cursor, and Claude Code.",
   "type": "module",