@mehmoodqureshi/chrome-mcp 0.9.5 → 0.9.7

package/README.md

@@ -160,23 +160,41 @@ bundled file.
 
 ### Running more than one session
 
-The extension dials exactly **one** bridge port, so only one chrome-mcp can drive
-your Chrome at a time — but every MCP host session (each Claude tab/window)
-spawns its own server. With a pinned `--port`, the newest session **takes the
-port over**: it reads the owning pid from `handshake.json`, confirms that process
-really is a chrome-mcp, and stops it. Newest tab wins; the older session's browser
-tools go quiet until it reconnects. Nothing that isn't a verified chrome-mcp is
-ever touched — a port held by some other program is reported, never killed.
-
-Two servers can only run side by side if each has its own port **and** its own
-paired extension — i.e. a separate Chrome profile running its own copy of the
-extension, pointed at the other port (`--port 9223`). A single Chrome pairs to one
-server at a time, so a second server with no extension of its own can drive
-nothing.
-
-One server can, however, serve **several browsers at once**: connections are
-routed by profile key (`--profile <name>`, matching the profile set in the
-extension's Options), so each paired Chrome gets its own routing slot.
+Every MCP host session (each Claude terminal, tab or window) starts its own
+chrome-mcp, and they all share your Chrome at once. The first one to start owns
+the bridge port and the extension connections — the **hub**. Each later session
+finds the port held by a live chrome-mcp and joins it as a **peer**: its tool
+calls are relayed through the hub to the same browsers, so every session keeps
+working side by side. Nobody is disconnected.
+
+When the hub's session ends, its peers race for the port; one takes it over
+(with the same token, so the extension re-pairs by itself within a few seconds)
+and the rest join the new hub. A call that was in flight at that moment fails
+once with `EXTENSION_DISCONNECTED` and is retried automatically when it is safe
+to repeat.
+
+Peers authenticate with the pairing token from the 0600 handshake file, so only
+your own OS user can join. A chrome-mcp too old to share the port is replaced as
+before: it is verified to be chrome-mcp, then stopped. Anything that isn't a
+verified chrome-mcp is never touched — a port held by some other program is
+reported, never killed.
+
+Sessions share one browser, so they also share its tabs: two sessions driving
+the same tab at the same moment will step on each other. Give each session its
+own tabs (`tab_new`), or its own Chrome profile (below).
+
+Each session can also drive **several browsers at once**: load the extension
+in each Chrome profile and they all pair to the same server, each under its own
+profile name. Tools act on the active profile — pick it with `--profile <name>`
+at startup or the `profile_use` tool at runtime.
+
+Naming is automatic. Chrome won't tell an extension which profile it runs in, so
+each install keeps a random id and the server names it: the first browser is
+`default`, the next `profile-2`, then `profile-3`, and so on. Names are stored in
+`~/.chrome-mcp/profiles.json`, so a browser keeps its name across restarts.
+`chrome_status` lists every paired browser (with its active tab as a hint), and
+`profile_rename` gives one a friendly name (`profile-2` → `work`). To pin a name
+yourself instead, type it into the extension's Options → Profile; that always wins.
 
 Without `--port`, each server binds an ephemeral port (no conflict ever), but the
 port changes every boot — so you'd re-pair the extension each time. Pin `--port`
@@ -502,6 +520,31 @@ group/other-accessible. Windows has no such bits — `chmod` there only toggles
 read-only attribute — so the check is skipped and the token's confidentiality
 rests on the per-user ACL of `%USERPROFILE%\.chrome-mcp`.
 
+## Telemetry
+
+The chrome-mcp **server** sends anonymous usage statistics to PostHog, so the
+project can see how many installs are active, which versions and platforms are
+in use, and which tools fail most. A notice is printed the first time it runs.
+
+What is sent: a random install id (kept in `~/.chrome-mcp/telemetry.json`), the
+chrome-mcp version, OS, CPU architecture and Node major version, whether the
+session owns the bridge port or shares it, how many browsers are paired, and
+per-tool call and error **counts** with error codes — batched every 10 minutes.
+
+What is never sent: URLs, domains, tool arguments, page content, screenshots,
+cookies, profile names, tokens, file paths, or anything you type. Events are
+personless and GeoIP lookup is disabled.
+
+The **browser extension sends nothing** — it only ever talks to `127.0.0.1`.
+
+Turn it off with any of:
+
+```bash
+CHROME_MCP_TELEMETRY=0     # or false / off
+DO_NOT_TRACK=1
+--no-telemetry             # server flag
+```
+
 ## Develop
 
 ```

package/dist/shared/protocol.d.ts

@@ -64,6 +64,10 @@ export interface HelloFrame extends BaseFrame {
      *  NOT a security boundary (the token is) — it selects which connection slot the
      *  server routes commands to, so several browsers can stay paired at once. */
     profile?: string;
+    /** Random id this extension install keeps in its chrome.storage.local — one per
+     *  Chrome profile. With no `profile` label, the server names the browser from it
+     *  ("default", "profile-2", ...) so two blank-profile browsers never collide. */
+    installId?: string;
     /** Optional capability advertisements (see `WIRE_CAP_TAB_URL`). An extension
      *  that sends none gets the conservative path, so old builds stay correct. */
     caps?: string[];
@@ -97,6 +101,9 @@ export interface WelcomeFrame extends BaseFrame {
     heartbeatMs: number;
     /** The active policy, so the extension can mirror the server-side gate. */
     policy: WirePolicy;
+    /** The profile name this browser was paired as (shown in the Options page).
+     *  Optional so an older server's welcome still parses. */
+    profile?: string;
 }
 export interface UnauthFrame extends BaseFrame {
     type: 'unauthorized';

package/dist/src/bridge/evict.d.ts

@@ -1,11 +1,11 @@
 /**
  * src/bridge/evict.ts — take a pinned port back from a stale chrome-mcp.
  *
- * The extension dials exactly ONE bridge port, so only one server can own a
- * given Chrome at a time. But every MCP host session spawns its own chrome-mcp
- * child, so a second session (another Claude tab/window) racing for a pinned
- * `--port` would otherwise just fail with EADDRINUSE and force the user to kill
- * the old process by hand. Newest-session-wins: we do that kill for them.
+ * A second session normally JOINS the chrome-mcp holding the port as a peer
+ * (see ./peer) and nobody is stopped. This is the fallback for when joining
+ * fails: an older chrome-mcp that can't share the port, or a hung one. It will
+ * never release the port on its own, so rather than fail with EADDRINUSE and
+ * make the user kill it by hand, we do that for them.
  *
  * The safety bar is high, because a pid can be recycled onto an unrelated
  * process. We evict ONLY when every check agrees:

package/dist/src/bridge/evict.js

@@ -2,11 +2,11 @@
 /**
  * src/bridge/evict.ts — take a pinned port back from a stale chrome-mcp.
  *
- * The extension dials exactly ONE bridge port, so only one server can own a
- * given Chrome at a time. But every MCP host session spawns its own chrome-mcp
- * child, so a second session (another Claude tab/window) racing for a pinned
- * `--port` would otherwise just fail with EADDRINUSE and force the user to kill
- * the old process by hand. Newest-session-wins: we do that kill for them.
+ * A second session normally JOINS the chrome-mcp holding the port as a peer
+ * (see ./peer) and nobody is stopped. This is the fallback for when joining
+ * fails: an older chrome-mcp that can't share the port, or a hung one. It will
+ * never release the port on its own, so rather than fail with EADDRINUSE and
+ * make the user kill it by hand, we do that for them.
  *
  * The safety bar is high, because a pid can be recycled onto an unrelated
  * process. We evict ONLY when every check agrees:

package/dist/src/bridge/peer.d.ts

@@ -0,0 +1,94 @@
+/**
+ * src/bridge/peer.ts — let several chrome-mcp servers share one Chrome.
+ *
+ * Every MCP host session (each Claude terminal/tab) spawns its own chrome-mcp,
+ * but a browser's extension dials exactly one port. So the first server to bind
+ * the port is the HUB: it owns the extension connections. A later server that
+ * finds the port held by a live chrome-mcp joins it as a PEER over the same
+ * port and relays its commands through the hub, instead of killing it. If the
+ * hub exits, its peers race to bind the port; the winner becomes the new hub
+ * (with the same token, so the extension re-pairs on its own) and the rest join
+ * it.
+ *
+ * Peers authenticate with the same token the extension uses — the handshake
+ * file is 0600, so only the same OS user can read it — and speak a small
+ * server-to-server protocol that the extension never sees:
+ *   peer → hub:  peer_hello, relay (a wire command), peer_rename
+ *   hub → peer:  peer_welcome, peer_state (paired browsers), relay_result
+ */
+import { PROTOCOL_VERSION, type WireMethod } from '../../shared/protocol';
+import type { PairedProfile } from './server';
+/** How long a joining server waits for the hub's welcome before giving up. */
+export declare const JOIN_TIMEOUT_MS = 2000;
+export interface PeerHelloFrame {
+    type: 'peer_hello';
+    v: typeof PROTOCOL_VERSION;
+    token: string;
+    pid: number;
+}
+export interface RelayFrame {
+    type: 'relay';
+    id: string;
+    method: WireMethod;
+    params: Record<string, unknown>;
+    opts?: {
+        tabId?: string;
+        timeoutMs?: number;
+        profile?: string;
+    };
+}
+export interface PeerRenameFrame {
+    type: 'peer_rename';
+    id: string;
+    from: string;
+    to: string;
+}
+export type PeerToHubFrame = PeerHelloFrame | RelayFrame | PeerRenameFrame;
+export interface PeerWelcomeFrame {
+    type: 'peer_welcome';
+    hubPid: number;
+}
+export interface PeerStateFrame {
+    type: 'peer_state';
+    profiles: PairedProfile[];
+}
+export interface RelayResultFrame {
+    type: 'relay_result';
+    id: string;
+    ok: boolean;
+    data?: unknown;
+    /** Set when the hub failed with an ExecutorError, so the peer rethrows the same code. */
+    code?: string;
+    message?: string;
+}
+export type HubToPeerFrame = PeerWelcomeFrame | PeerStateFrame | RelayResultFrame;
+/** Encode a hub-side failure so the peer can rethrow it with its code intact. */
+export declare function relayError(id: string, err: unknown): RelayResultFrame;
+/**
+ * A peer's connection to the hub. Mirrors the hub's paired-browser list (pushed
+ * on every change) so the synchronous `hasConnection` checks stay synchronous,
+ * and relays commands as request/response pairs.
+ */
+export declare class HubLink {
+    private readonly ws;
+    readonly hubPid: number;
+    private readonly onClose;
+    profiles: PairedProfile[];
+    private readonly pending;
+    private seq;
+    private closed;
+    private constructor();
+    /**
+     * Join the hub on `port` with `token`. Resolves null when nothing answers as a
+     * chrome-mcp hub in time: a wrong token, an older server that doesn't speak
+     * the peer protocol (it ignores the frame and times us out), or no listener.
+     */
+    static join(host: string, port: number, token: string, onClose: () => void): Promise<HubLink | null>;
+    isOpen(): boolean;
+    relay(method: WireMethod, params: Record<string, unknown>, opts?: RelayFrame['opts']): Promise<unknown>;
+    rename(from: string, to: string): Promise<unknown>;
+    close(): void;
+    private request;
+    private handleMessage;
+    private handleClose;
+}

package/dist/src/bridge/peer.js

@@ -0,0 +1,187 @@
+"use strict";
+/**
+ * src/bridge/peer.ts — let several chrome-mcp servers share one Chrome.
+ *
+ * Every MCP host session (each Claude terminal/tab) spawns its own chrome-mcp,
+ * but a browser's extension dials exactly one port. So the first server to bind
+ * the port is the HUB: it owns the extension connections. A later server that
+ * finds the port held by a live chrome-mcp joins it as a PEER over the same
+ * port and relays its commands through the hub, instead of killing it. If the
+ * hub exits, its peers race to bind the port; the winner becomes the new hub
+ * (with the same token, so the extension re-pairs on its own) and the rest join
+ * it.
+ *
+ * Peers authenticate with the same token the extension uses — the handshake
+ * file is 0600, so only the same OS user can read it — and speak a small
+ * server-to-server protocol that the extension never sees:
+ *   peer → hub:  peer_hello, relay (a wire command), peer_rename
+ *   hub → peer:  peer_welcome, peer_state (paired browsers), relay_result
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HubLink = exports.JOIN_TIMEOUT_MS = void 0;
+exports.relayError = relayError;
+const ws_1 = require("ws");
+const protocol_1 = require("../../shared/protocol");
+const types_1 = require("../executor/types");
+/** How long a joining server waits for the hub's welcome before giving up. */
+exports.JOIN_TIMEOUT_MS = 2_000;
+/** Slack on top of the hub's own command timeout, so the hub always answers first. */
+const RELAY_GRACE_MS = 5_000;
+/** Upper bound for a relayed command whose caller gave no timeout. */
+const RELAY_DEFAULT_TIMEOUT_MS = 65_000;
+/** Encode a hub-side failure so the peer can rethrow it with its code intact. */
+function relayError(id, err) {
+    return {
+        type: 'relay_result',
+        id,
+        ok: false,
+        ...(err instanceof types_1.ExecutorError ? { code: err.code } : {}),
+        message: err instanceof Error ? err.message : String(err),
+    };
+}
+/**
+ * A peer's connection to the hub. Mirrors the hub's paired-browser list (pushed
+ * on every change) so the synchronous `hasConnection` checks stay synchronous,
+ * and relays commands as request/response pairs.
+ */
+class HubLink {
+    ws;
+    hubPid;
+    onClose;
+    profiles = [];
+    pending = new Map();
+    seq = 0;
+    closed = false;
+    constructor(ws, hubPid, onClose) {
+        this.ws = ws;
+        this.hubPid = hubPid;
+        this.onClose = onClose;
+        ws.on('message', (raw) => this.handleMessage(raw.toString()));
+        ws.on('close', () => this.handleClose());
+        ws.on('error', () => this.handleClose());
+    }
+    /**
+     * Join the hub on `port` with `token`. Resolves null when nothing answers as a
+     * chrome-mcp hub in time: a wrong token, an older server that doesn't speak
+     * the peer protocol (it ignores the frame and times us out), or no listener.
+     */
+    static join(host, port, token, onClose) {
+        return new Promise((resolve) => {
+            let settled = false;
+            const ws = new ws_1.WebSocket(`ws://${host}:${port}`);
+            const done = (link) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                ws.off('message', onFirst);
+                if (!link) {
+                    try {
+                        ws.terminate();
+                    }
+                    catch {
+                        /* ignore */
+                    }
+                }
+                resolve(link);
+            };
+            const timer = setTimeout(() => done(null), exports.JOIN_TIMEOUT_MS);
+            timer.unref?.();
+            const onFirst = (raw) => {
+                let frame;
+                try {
+                    frame = JSON.parse(raw.toString());
+                }
+                catch {
+                    return done(null);
+                }
+                if (frame.type !== 'peer_welcome')
+                    return done(null); // 'unauthorized' or anything else
+                done(new HubLink(ws, typeof frame.hubPid === 'number' ? frame.hubPid : 0, onClose));
+            };
+            ws.on('message', onFirst);
+            ws.once('open', () => {
+                const hello = { type: 'peer_hello', v: protocol_1.PROTOCOL_VERSION, token, pid: process.pid };
+                ws.send(JSON.stringify(hello));
+            });
+            ws.once('error', () => done(null));
+            ws.once('close', () => done(null));
+        });
+    }
+    isOpen() {
+        return !this.closed && this.ws.readyState === ws_1.WebSocket.OPEN;
+    }
+    relay(method, params, opts) {
+        const timeoutMs = (opts?.timeoutMs ?? RELAY_DEFAULT_TIMEOUT_MS - RELAY_GRACE_MS) + RELAY_GRACE_MS;
+        return this.request({ type: 'relay', id: '', method, params, ...(opts ? { opts } : {}) }, timeoutMs);
+    }
+    rename(from, to) {
+        return this.request({ type: 'peer_rename', id: '', from, to }, exports.JOIN_TIMEOUT_MS * 2);
+    }
+    close() {
+        try {
+            this.ws.close(1001, 'peer stopping');
+        }
+        catch {
+            /* ignore */
+        }
+        this.handleClose();
+    }
+    request(frame, timeoutMs) {
+        if (!this.isOpen()) {
+            return Promise.reject(new types_1.ExecutorError('EXTENSION_DISCONNECTED', 'the shared chrome-mcp hub is not reachable'));
+        }
+        const id = String(++this.seq);
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.pending.delete(id);
+                reject(new types_1.ExecutorError('TIMEOUT', `the shared chrome-mcp hub did not answer ${frame.type} within ${timeoutMs} ms`));
+            }, timeoutMs);
+            timer.unref?.();
+            this.pending.set(id, { resolve, reject, timer });
+            this.ws.send(JSON.stringify({ ...frame, id }));
+        });
+    }
+    handleMessage(raw) {
+        let frame;
+        try {
+            frame = JSON.parse(raw);
+        }
+        catch {
+            return;
+        }
+        if (frame.type === 'peer_state') {
+            this.profiles = Array.isArray(frame.profiles) ? frame.profiles : [];
+            return;
+        }
+        if (frame.type !== 'relay_result')
+            return;
+        const p = this.pending.get(frame.id);
+        if (!p)
+            return;
+        this.pending.delete(frame.id);
+        clearTimeout(p.timer);
+        if (frame.ok)
+            p.resolve(frame.data);
+        else if (frame.code)
+            p.reject(new types_1.ExecutorError(frame.code, frame.message ?? 'hub error'));
+        else
+            p.reject(new Error(frame.message ?? 'hub error'));
+    }
+    handleClose() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        this.profiles = [];
+        for (const [, p] of this.pending) {
+            clearTimeout(p.timer);
+            // Retryable: the dispatcher re-runs idempotent calls once, by which time a
+            // surviving server has usually taken the port over.
+            p.reject(new types_1.ExecutorError('EXTENSION_DISCONNECTED', 'the shared chrome-mcp hub went away mid-call'));
+        }
+        this.pending.clear();
+        this.onClose();
+    }
+}
+exports.HubLink = HubLink;
+//# sourceMappingURL=peer.js.map

package/dist/src/bridge/profiles.d.ts

@@ -0,0 +1,44 @@
+/**
+ * src/bridge/profiles.ts — automatic profile names for paired browsers.
+ *
+ * Chrome gives an extension no way to learn which Chrome profile it runs in, so
+ * before this every browser that left Profile blank paired as "default" — and a
+ * second one silently superseded the first. Now each extension install sends a
+ * stable random `installId` (kept in that profile's chrome.storage.local), and
+ * the server gives each install its own name: "default" for the first,
+ * "profile-2", "profile-3", ... after that. The mapping persists in
+ * `<dataDir>/profiles.json`, so a browser keeps its name across restarts and
+ * `profile_rename` can give it a friendly one.
+ *
+ * A Profile typed into the extension's Options still wins — that label is the
+ * user's explicit choice and is never renamed from here.
+ */
+export declare const REGISTRY_FILE = "profiles.json";
+/** The name the first auto-named browser gets — the pre-registry default. */
+export declare const FIRST_AUTO_NAME = "default";
+/** An installId is opaque, but it becomes a JSON key and a log line: keep it tame. */
+export declare function isValidInstallId(id: unknown): id is string;
+export declare class ProfileRegistry {
+    private readonly dataDir?;
+    private installs;
+    /** `dataDir` undefined → in-memory only (tests, and servers run without one). */
+    constructor(dataDir?: string | undefined);
+    /** The name already assigned to this install, if any. */
+    nameOf(installId: string): string | undefined;
+    /** The install that owns `name` in the registry, if any. */
+    ownerOf(name: string): string | undefined;
+    /**
+     * Name for an install with no explicit label: its remembered name, else the
+     * first of "default", "profile-2", ... that no other install owns and
+     * `isLive(name)` doesn't report as held by someone else right now.
+     */
+    assign(installId: string, isLive: (name: string) => boolean): string;
+    /**
+     * Give the install currently named `from` the name `to`. Throws when `from`
+     * isn't an auto-named install or `to` is already owned by another one; the
+     * caller checks live connections (explicitly labelled browsers aren't here).
+     */
+    rename(from: string, to: string): string;
+    private load;
+    private save;
+}

package/dist/src/bridge/profiles.js

@@ -0,0 +1,121 @@
+"use strict";
+/**
+ * src/bridge/profiles.ts — automatic profile names for paired browsers.
+ *
+ * Chrome gives an extension no way to learn which Chrome profile it runs in, so
+ * before this every browser that left Profile blank paired as "default" — and a
+ * second one silently superseded the first. Now each extension install sends a
+ * stable random `installId` (kept in that profile's chrome.storage.local), and
+ * the server gives each install its own name: "default" for the first,
+ * "profile-2", "profile-3", ... after that. The mapping persists in
+ * `<dataDir>/profiles.json`, so a browser keeps its name across restarts and
+ * `profile_rename` can give it a friendly one.
+ *
+ * A Profile typed into the extension's Options still wins — that label is the
+ * user's explicit choice and is never renamed from here.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProfileRegistry = exports.FIRST_AUTO_NAME = exports.REGISTRY_FILE = void 0;
+exports.isValidInstallId = isValidInstallId;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const config_1 = require("../config");
+exports.REGISTRY_FILE = 'profiles.json';
+/** The name the first auto-named browser gets — the pre-registry default. */
+exports.FIRST_AUTO_NAME = 'default';
+/** An installId is opaque, but it becomes a JSON key and a log line: keep it tame. */
+function isValidInstallId(id) {
+    return typeof id === 'string' && /^[A-Za-z0-9-]{8,64}$/.test(id);
+}
+class ProfileRegistry {
+    dataDir;
+    installs = {};
+    /** `dataDir` undefined → in-memory only (tests, and servers run without one). */
+    constructor(dataDir) {
+        this.dataDir = dataDir;
+        this.load();
+    }
+    /** The name already assigned to this install, if any. */
+    nameOf(installId) {
+        return this.installs[installId]?.name;
+    }
+    /** The install that owns `name` in the registry, if any. */
+    ownerOf(name) {
+        for (const [id, rec] of Object.entries(this.installs))
+            if (rec.name === name)
+                return id;
+        return undefined;
+    }
+    /**
+     * Name for an install with no explicit label: its remembered name, else the
+     * first of "default", "profile-2", ... that no other install owns and
+     * `isLive(name)` doesn't report as held by someone else right now.
+     */
+    assign(installId, isLive) {
+        const now = new Date().toISOString();
+        const known = this.installs[installId];
+        if (known) {
+            known.lastSeen = now;
+            this.save();
+            return known.name;
+        }
+        let name = exports.FIRST_AUTO_NAME;
+        for (let n = 2; this.ownerOf(name) !== undefined || isLive(name); n++)
+            name = `profile-${n}`;
+        this.installs[installId] = { name, firstSeen: now, lastSeen: now };
+        this.save();
+        return name;
+    }
+    /**
+     * Give the install currently named `from` the name `to`. Throws when `from`
+     * isn't an auto-named install or `to` is already owned by another one; the
+     * caller checks live connections (explicitly labelled browsers aren't here).
+     */
+    rename(from, to) {
+        const target = (0, config_1.sanitizeName)(to, 'profile');
+        const id = this.ownerOf(from);
+        if (id === undefined) {
+            throw new Error(`"${from}" is not an automatically named profile. A name typed into the ` +
+                `extension's Options can only be changed there.`);
+        }
+        if (target === from)
+            return target;
+        if (this.ownerOf(target) !== undefined)
+            throw new Error(`profile "${target}" is already taken`);
+        this.installs[id].name = target;
+        this.save();
+        return target;
+    }
+    load() {
+        if (!this.dataDir)
+            return;
+        const path = (0, node_path_1.join)(this.dataDir, exports.REGISTRY_FILE);
+        if (!(0, node_fs_1.existsSync)(path))
+            return;
+        try {
+            const parsed = JSON.parse((0, node_fs_1.readFileSync)(path, 'utf8'));
+            for (const [id, rec] of Object.entries(parsed.installs ?? {})) {
+                if (isValidInstallId(id) && rec && typeof rec.name === 'string')
+                    this.installs[id] = rec;
+            }
+        }
+        catch {
+            // A corrupt file must not stop pairing: start empty and rewrite on next save.
+        }
+    }
+    save() {
+        if (!this.dataDir)
+            return;
+        const path = (0, node_path_1.join)(this.dataDir, exports.REGISTRY_FILE);
+        const tmp = `${path}.tmp`;
+        try {
+            (0, node_fs_1.writeFileSync)(tmp, JSON.stringify({ installs: this.installs }, null, 2), { mode: 0o600 });
+            (0, node_fs_1.renameSync)(tmp, path);
+        }
+        catch {
+            // Best-effort: names still work for this run, they just won't persist.
+        }
+    }
+}
+exports.ProfileRegistry = ProfileRegistry;
+//# sourceMappingURL=profiles.js.map