@minhspark/codex-mcp-bridge 1.26.3 → 1.26.5

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-mcp-bridge",
-  "version": "1.26.3",
+  "version": "1.26.5",
   "description": "Connect ChatGPT to your own Codex Desktop projects and conversations.",
   "author": {
     "name": "Bui Dang Minh"

package/CHANGELOG.md

@@ -4,6 +4,36 @@ Follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and [SemVer](ht
 
 ## [Unreleased]
 
+## [1.26.5] - 2026-11-02
+
+### Fixed
+
+- Add `codex-bridge-update --user` to pin installation to the per-user npm prefix before inspecting or replacing packages. The recommended Windows command now avoids `EPERM` when Node resolves its global prefix to `Program Files`, including machines with several Node installations. Existing owned relay runtimes, project grants and disabled-service choices are preserved when moving between prefixes.
+- Install the global package with npm lifecycle scripts disabled, then apply managed setup directly using Node and verify settings and live relay readiness. This removes the lifecycle shell and npm script-approval dependency, and preserves the installed package if setup needs repair.
+- Report installation permission failures, numeric child exit codes, signals and timeouts explicitly while keeping raw child output and credentials out of diagnostics.
+
+### Upgrade
+
+Windows PowerShell, without administrator rights:
+
+```powershell
+npx.cmd --yes --ignore-scripts --package=@minhspark/codex-mcp-bridge@latest -- codex-bridge-update --user
+```
+
+This single command updates the package, applies all managed client settings and verifies the independent background relay. On macOS/Linux, keep using the installation command in the README; optional `--user` selects `~/.local`.
+
+## [1.26.4] - 2026-11-01
+
+### Fixed
+
+- `codex-bridge-update` no longer stops with `UPDATE_SETUP_INCOMPLETE` / `WORKER_MCP_COLLISION` on machines with more than one Node.js installation. The Antigravity `worker-relay` entry is still recognised as the bridge's own when it launches this package's `background-relay-mcp.mjs` through another existing `node` / `node.exe`, matching how every other bridge MCP entry is checked. Entries that use a different script, a non-Node launcher, a missing executable, a URL, headers or embedded environment are still refused and left unchanged.
+
+### Upgrade
+
+```sh
+npm exec --yes --ignore-scripts --package=@minhspark/codex-mcp-bridge@latest -- codex-bridge-update
+```
+
 ## [1.26.3] - 2026-11-01
 
 ### Fixed

package/README.md

@@ -36,10 +36,10 @@ npm exec --yes --ignore-scripts --package=@minhspark/codex-mcp-bridge@latest --
 **Windows PowerShell**
 
 ```powershell
-npm.cmd exec --yes --ignore-scripts --package=@minhspark/codex-mcp-bridge@latest -- codex-bridge-update
+npx.cmd --yes --ignore-scripts --package=@minhspark/codex-mcp-bridge@latest -- codex-bridge-update --user
 ```
 
-Requires **Node.js 22.13+**. Use `.cmd` for this package's commands in Windows PowerShell. **Use this same single command for a fresh install and every update**, including upgrades from 1.26.0 or 1.26.1. npm fetches the latest updater into its cache without running setup there. The updater installs that exact resolved version globally, runs the managed setup hook, and verifies the global version, saved settings and service activation separately. A second installation command is not required.
+Requires **Node.js 22.13+**. Use `.cmd` for this package's commands in Windows PowerShell. **Use this same single command for a fresh install and every update**, including upgrades from 1.26.0 or 1.26.1. On Windows, `--user` selects `%APPDATA%\npm`, avoiding protected `Program Files` prefixes and administrator rights even when switching Node installations. npm fetches the latest updater into its cache without running setup there. The updater installs that exact resolved version globally with lifecycle scripts disabled, applies managed setup directly using Node, and verifies the global version, saved settings and service activation separately. A second installation command is not required.
 
 For an enabled legacy Windows relay from 1.26.0 or 1.26.1, the updater moves only this package's owned service to newer code using private relay storage as its working directory before replacing the global package. The temporary service runtime points to the downloaded updater package; changing the working directory releases the old package lock. It waits for active work to drain and the replacement transport to become ready without killing processes or opening apps or chats. If migration is still pending after its bounded wait, it reports `UPDATE_RELAY_PENDING`; keep the existing jobs and receipts and rerun the same command after they finish. Intentionally disabled services stay disabled and are not reported as ready.
 
@@ -65,7 +65,7 @@ Keep the same request UUID for retries and read its durable receipt. Queued work
 
 Worker delegation is bounded. `WORKER_DELEGATION_CAPACITY` means the destination has no free execution slot and that delegation was not sent or queued behind waiting workers. Inspect or finish existing delegated work before retrying the same unsent request. Queue and delegation limits are reported explicitly.
 
-The recommended command's `--ignore-scripts` applies only to downloading the updater into npm's cache. The updater explicitly enables this package's setup hook for the global installation and displays its progress. This avoids client MCP registrations pointing into a temporary npm cache directory. A direct global npm install remains an advanced alternative, but it skips the updater's migration of an old service that can lock the package on Windows.
+The updater disables npm lifecycle scripts for both the cached download and the global installation, then runs the installed package's managed setup directly using Node. This avoids npm script-policy differences, lifecycle shell failures and client MCP registrations pointing into a temporary npm cache directory. A direct global npm install remains an advanced alternative, but it skips the updater's migration of an old service that can lock the package on Windows.
 
 | Client | Installed entry | Purpose |
 | --- | --- | --- |
@@ -79,11 +79,11 @@ The recommended command's `--ignore-scripts` applies only to downloading the upd
 
 For native Claude-to-Codex handoffs, use an existing native Claude **Code** session and the same local project saved in Codex Desktop. The shared `codex-bridge-desktop` connector has its own legacy route; it does not establish a native Code sender identity. Setup applies saved configuration without opening or restarting apps. Saved configuration is not proof of a live connection; available supervisors reload compatible workers when idle. Complete [verification](#verify-the-installation) with the tools already available in the actual clients. If a native host is unloaded, report the diagnostic instead of opening chats to load a relay.
 
-Automatic setup runs during the updater's **global npm installation**. Local `npm install` and `npm ci` do not change app settings. For a deliberate package-only installation, use a direct global npm install with `CODEX_BRIDGE_SKIP_SETUP=1` or `--ignore-scripts`; that opt-out is separate from the cache-only `--ignore-scripts` in the recommended updater command. The optional [workflow skill](#workflow-skill--npx-skills), VS Code preview, and hosted ChatGPT pairing retain their separate setup steps.
+Managed setup runs **after the updater's global npm installation succeeds**, outside npm's lifecycle hook. Local `npm install` and `npm ci` do not change app settings. For a deliberate package-only installation, use a direct global npm install with `CODEX_BRIDGE_SKIP_SETUP=1` or `--ignore-scripts`; the complete updater always applies and verifies setup, and refuses an explicit `CODEX_BRIDGE_SKIP_SETUP=1` opt-out. The optional [workflow skill](#workflow-skill--npx-skills), VS Code preview, and hosted ChatGPT pairing retain their separate setup steps.
 
 ### Setup recovery and checks
 
-If service migration, installation or managed setup fails, the updater returns a nonzero exit and reports the failed step. Inspect that component and the installed version, correct the reported cause, and rerun the same update command above. npm can roll back package files while settings already written remain changed. For configuration-only repair of an already installed package, the following is an optional alternative:
+If service migration, installation or managed setup fails, the updater returns a nonzero exit and reports the failed step. Inspect that component and the installed version, correct the reported cause, and rerun the same update command above. A completed package installation is preserved if managed setup fails. For configuration-only repair of an already installed package, the following is an optional alternative:
 
 ```bash
 codex-bridge-setup
@@ -549,10 +549,10 @@ Node.js 22.13+ is required. If a command is missing, open a new terminal and che
 If the package or registrations are missing, use the complete installation command:
 
 ```powershell
-npm.cmd exec --yes --ignore-scripts --package=@minhspark/codex-mcp-bridge@latest -- codex-bridge-update
+npx.cmd --yes --ignore-scripts --package=@minhspark/codex-mcp-bridge@latest -- codex-bridge-update --user
 ```
 
-This runs the latest updater outside the global package directory, handles an owned legacy service that can lock that directory, and installs the exact resolved package with its setup hook enabled. `--ignore-scripts` suppresses setup only for the temporary cached updater. If a previous direct install printed `1 package had install scripts blocked`, use this same updater command to install and apply the managed settings together. Intentional setup opt-outs and disabled-service choices are not silently removed.
+This runs the latest updater outside the global package directory, handles an owned legacy service that can lock that directory, installs the exact resolved package into the per-user npm prefix, then directly applies and verifies managed setup. Lifecycle scripts remain disabled during npm installation. If a previous update reported `UPDATE_NPM_FAILED` or `UPDATE_INSTALL_PERMISSION` because npm selected a protected directory, `--user` selects the user-writable destination. If a previous direct install printed `1 package had install scripts blocked`, this same updater command installs and applies the managed settings together. Intentional setup opt-outs and disabled-service choices are not silently removed. On macOS/Linux, use the installation command above; optional `--user` selects `~/.local`, whose `bin` directory must be on `PATH` for terminal commands.
 
 For an already-installed package, these optional commands preview or repair configuration without updating package files:
 

package/docs/new-macos-setup.md

@@ -19,9 +19,9 @@ npm exec --yes --ignore-scripts --package=@minhspark/codex-mcp-bridge@latest --
 ```
 
 npm downloads the latest updater into its cache. `--ignore-scripts` suppresses
-setup only in that temporary location. The updater installs its exact resolved
-version globally, enables this package's managed setup hook, displays progress
-and verifies the global version and configuration. No second installation or
+setup in that temporary location. The updater installs its exact resolved
+version globally with lifecycle scripts disabled, runs managed setup directly
+using Node and verifies the global version and configuration. No second installation or
 setup command is required. Existing disabled choices, authentication and custom
 project grants are preserved; the updater does not open apps or chats or kill
 processes. A pending service migration is reported instead of interrupting work.
@@ -32,8 +32,8 @@ official package under `~/.config/GptClaudeBridge/tools` (or
 `XDG_CONFIG_HOME/GptClaudeBridge/tools`). No separate Codex CLI install command
 is required. Run the install under the account that uses the apps, without `sudo`.
 If setup or update exits nonzero, inspect the reported component and installed
-version, correct the cause, and rerun the same updater command. npm can roll back
-package files without restoring settings already written or command shims.
+version, correct the cause, and rerun the same updater command. A completed
+package installation is preserved when managed setup fails.
 
 The command also installs an independent per-user LaunchAgent for separate
 Claude, Codex and Antigravity CLI workers and updates its managed settings on
@@ -101,8 +101,8 @@ a nonzero exit status while configuration is incomplete.
 
 Local `npm install` and `npm ci` do not change app settings. For a deliberate
 package-only installation, a direct global npm install can use
-`CODEX_BRIDGE_SKIP_SETUP=1` or `--ignore-scripts`; this differs from the cache-only
-script suppression in the recommended updater command. For Homebrew, run
+`CODEX_BRIDGE_SKIP_SETUP=1` or `--ignore-scripts`; the complete updater runs
+managed setup directly after package installation. For Homebrew, run
 `codex-bridge-setup` after installing the formula. A pinned source checkout can
 use `node scripts/setup.mjs`.
 

package/docs/new-windows-setup.md

@@ -7,13 +7,15 @@ does not require the Desktop apps to be open. Use this one PowerShell command
 for a fresh installation or an update, including from 1.26.0 or 1.26.1:
 
 ```powershell
-npm.cmd exec --yes --ignore-scripts --package=@minhspark/codex-mcp-bridge@latest -- codex-bridge-update
+npx.cmd --yes --ignore-scripts --package=@minhspark/codex-mcp-bridge@latest -- codex-bridge-update --user
 ```
 
-npm downloads the latest updater into its cache. `--ignore-scripts` prevents
-setup from running in that temporary location; the updater then installs its
-exact resolved version globally with this package's managed setup hook enabled.
-It displays progress and verifies the global version and saved settings.
+npm downloads the latest updater into its cache. `--user` selects `%APPDATA%\npm`
+instead of a protected Node installation directory such as `Program Files`;
+administrator rights are not required. The updater installs its exact resolved
+version globally with lifecycle scripts disabled, then runs managed setup
+directly using Node. It displays progress and verifies the global version,
+saved settings and relay activation.
 No second installation or setup command is required.
 
 An older Windows background service can keep the global npm package directory
@@ -33,8 +35,8 @@ official package in the current user's `.config\GptClaudeBridge\tools`
 directory. It also configures native pipe forwarding and bootstraps the relay
 executor. A failed component is reported as incomplete rather than ready. If
 setup or update exits nonzero, inspect the reported component and installed
-version, correct the cause, and rerun the same updater command. npm can roll back
-package files without restoring settings already written or command shims.
+version, correct the cause, and rerun the same updater command. A completed
+package installation is preserved when managed setup fails.
 
 The same command installs the independent worker relay as a hidden per-user
 scheduled task and applies its managed settings on every update. It registers
@@ -104,8 +106,8 @@ attempting delivery.
 Local `npm install` and `npm ci` do not configure apps. For a deliberate
 package-only installation, a direct global npm install can use
 `CODEX_BRIDGE_SKIP_SETUP=1` or `--ignore-scripts`. This differs from the
-recommended updater command, which suppresses setup only in its temporary cache
-and enables it for the final global installation. A direct install skips the
+recommended updater command, which disables lifecycle scripts and runs managed
+setup directly after the final global installation. A direct install skips the
 updater's migration of legacy Windows services that can lock the package.
 The optional card extension, hosted ChatGPT pairing, and VS Code preview have
 separate installation steps.

package/docs/project-onboarding.md

@@ -7,12 +7,12 @@ configures the independent worker relay automatically:
 npm exec --yes --ignore-scripts --package=@minhspark/codex-mcp-bridge@latest -- codex-bridge-update
 ```
 
-In Windows PowerShell use `npm.cmd`. npm fetches the latest updater into its
+In Windows PowerShell use `npx.cmd --yes --ignore-scripts --package=@minhspark/codex-mcp-bridge@latest -- codex-bridge-update --user` to select the per-user npm prefix without administrator rights. npm fetches the latest updater into its
 cache with setup disabled there. The updater moves an owned legacy service to
 newer code using private relay storage as its working directory when needed,
 temporarily using the downloaded updater package. It waits for active work to
-drain, then installs its exact resolved version globally with the setup hook
-enabled. It verifies the global installation and managed settings. No second
+drain, then installs its exact resolved version globally with lifecycle scripts
+disabled and runs managed setup directly using Node. It verifies the global installation and managed settings. No second
 installation command is required. It does not open apps or chats or kill
 processes. The setup creates
 `codex-bridge` for Claude Code and the separate `codex-bridge-desktop` shared
@@ -37,10 +37,10 @@ setup after correcting an incomplete component. Add `.cmd` on Windows and
 `--json` for structured output. Local package installs do not run setup.
 For a deliberate package-only direct global installation,
 `CODEX_BRIDGE_SKIP_SETUP=1` or npm `--ignore-scripts` opts out of setup; this is
-separate from the cache-only script suppression in the recommended updater.
+separate from the complete updater, which runs managed setup directly after installation.
 Failed setup or update returns a nonzero exit. Inspect the reported component
 and installed version, correct the cause, then rerun the same updater command.
-npm can roll back package files without restoring settings or command shims.
+A completed package installation is preserved when managed setup fails.
 Explicit setup and `--check` also return a nonzero status until the saved
 configuration passes verification.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@minhspark/codex-mcp-bridge",
-  "version": "1.26.3",
+  "version": "1.26.5",
   "description": "Connect Claude, Codex, and Antigravity through MCP, with native Desktop handoffs and bridge-owned Antigravity CLI sessions.",
   "keywords": [
     "mcp",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "codex-mcp-bridge",
-  "version": "1.26.3",
+  "version": "1.26.5",
   "description": "Connect ChatGPT to your own Codex Desktop projects and conversations.",
   "author": {
     "name": "Bui Dang Minh",

package/scripts/install-native-relay.mjs

@@ -25,7 +25,7 @@ import { removeRelayFile } from "../src/native-relay-files.mjs";
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.26.3";
+const VERSION = "1.26.5";
 const root = stableInstallPath(path.resolve(path.dirname(fileURLToPath(import.meta.url)), ".."));
 const entry = path.join(root, "src", "mcp-supervisor.mjs");
 const entryArgs = ["native-relay-companion.mjs"];

package/scripts/update.mjs

@@ -87,11 +87,19 @@ function neutralDirectory(roots, env) {
 }
 
 function childFailure(result, phase) {
-  const match = /npm\s+(?:ERR!|error)\s+code\s+([A-Z][A-Z0-9_]{0,79})\b/.exec(String(result?.stderr ?? ""));
-  const code = match?.[1] ?? (/^[A-Z][A-Z0-9_]{0,79}$/.test(result?.error?.code ?? "") ? result.error.code : null);
+  const match = /npm\s+(?:ERR!|error)\s+code\s+([A-Z][A-Z0-9_]{0,79}|\d{1,10})\b/.exec(String(result?.stderr ?? ""));
+  const signal = result?.error?.signal ?? result?.signal;
+  const value = match?.[1] ?? result?.error?.code ?? (signal ? null : result?.status ?? result?.exitCode);
+  const timedOut = value === "ETIMEDOUT" || result?.error?.killed === true && signal === "SIGTERM";
+  const code = timedOut ? "ETIMEDOUT" : /^\d{1,10}$/.test(String(value)) ? `EXIT_${value}`
+    : /^[A-Z][A-Z0-9_]{0,79}$/.test(value ?? "") ? value
+    : /^SIG[A-Z0-9]{1,20}$/.test(signal ?? "") ? `SIGNAL_${signal}` : null;
   const cause = code ? Object.assign(new Error("The child command reported a failure."), { code }) : undefined;
-  return failure(code === "EBUSY" ? "UPDATE_PACKAGE_BUSY" : phase === "verification" ? "UPDATE_SETUP_INCOMPLETE" : "UPDATE_NPM_FAILED",
-    code === "EBUSY" ? `The installed package is still held open by another process. No process was stopped. ${RETRY}`
+  const permissionDenied = phase === "installation" && ["EPERM", "EACCES"].includes(code);
+  return failure(permissionDenied ? "UPDATE_INSTALL_PERMISSION" : code === "EBUSY" ? "UPDATE_PACKAGE_BUSY" : timedOut ? "UPDATE_COMMAND_TIMEOUT" : phase === "verification" ? "UPDATE_SETUP_INCOMPLETE" : "UPDATE_NPM_FAILED",
+    permissionDenied ? "npm could not write to the installation directory. Run codex-bridge-update --user to install and configure the bridge in your user account without administrator rights. Existing work and receipts were preserved."
+      : timedOut ? `The update command exceeded its deadline. ${RETRY}`
+      : code === "EBUSY" ? `The installed package is still held open by another process. No process was stopped. ${RETRY}`
       : `The ${phase === "verification" ? "installed setup verification" : "npm command"} did not complete. ${RETRY}`, phase, cause);
 }
 
@@ -114,28 +122,35 @@ function serviceQuiescent(config) {
 export async function runUpdate({ args = [], env = process.env, platform = process.platform, root = ROOT, run = execute,
   installService = installBackgroundRelay, readConfig = readRelayConfiguration, readRuntime = readRelayServiceRuntime,
   quiescent = serviceQuiescent, now = Date.now, sleep = pause, waitMs = 120000, onProgress = () => {} } = {}) {
-  if (args.some(arg => !["--help", "--json"].includes(arg))) throw failure("UPDATE_ARGUMENT_INVALID", "Usage: codex-bridge-update [--json] [--help]", "preflight");
-  if (args.includes("--help")) return { help: "Usage: codex-bridge-update [--json]\nSafely update the global bridge and all managed settings. Legacy Windows relays migrate when existing work finishes; pending migrations can be retried with the same command." };
+  if (args.some(arg => !["--help", "--json", "--user"].includes(arg))) throw failure("UPDATE_ARGUMENT_INVALID", "Usage: codex-bridge-update [--user] [--json] [--help]", "preflight");
+  if (args.includes("--help")) return { help: "Usage: codex-bridge-update [--user] [--json]\nSafely update the global bridge and all managed settings. --user selects the per-user npm prefix (Windows: AppData/Roaming/npm; macOS/Linux: ~/.local) without administrator rights. Legacy Windows relays migrate when existing work finishes; pending migrations can be retried with the same command." };
   if (env.CODEX_BRIDGE_SKIP_SETUP === "1") throw failure("UPDATE_SETUP_DISABLED", "CODEX_BRIDGE_SKIP_SETUP=1 disables managed setup. Remove that explicit opt-out before requesting this complete update.", "preflight");
   if (!Number.isSafeInteger(waitMs) || waitMs < 1 || waitMs > 600000) throw failure("UPDATE_ARGUMENT_INVALID", "The update readiness deadline is invalid.", "preflight");
   root = fs.realpathSync.native(root);
   const version = packageVersion(root);
   const npm = resolveUpdateNpm(env);
+  const userPrefix = args.includes("--user") ? platform === "win32"
+    ? path.join(env.APPDATA || path.join(env.USERPROFILE || os.homedir(), "AppData", "Roaming"), "npm")
+    : path.join(env.HOME || os.homedir(), ".local") : null;
+  if (userPrefix && (!path.isAbsolute(userPrefix) || /[\u0000-\u001f\u007f]/.test(userPrefix))) {
+    throw failure("UPDATE_GLOBAL_ROOT_INVALID", "The per-user installation directory is invalid.", "preflight");
+  }
+  const prefixArgs = userPrefix ? ["--prefix", userPrefix] : [];
   let cwd = neutralDirectory([root], env);
   let childEnv = Object.fromEntries(Object.entries(env).filter(([name]) => !/^AGENT_RELAY_(?!DIRECTORY$)/i.test(name)));
-  const command = async (arguments_, phase, timeout = 600000) => {
+  const command = async (arguments_, phase, timeout = 600000, environment = childEnv) => {
     let result;
     try {
-      result = await run(process.execPath, arguments_, { env: childEnv, cwd, encoding: "utf8", windowsHide: true,
+      result = await run(process.execPath, arguments_, { env: environment, cwd, encoding: "utf8", windowsHide: true,
         shell: false, timeout, maxBuffer: 8 * 1024 * 1024, stdio: ["ignore", "pipe", "pipe"] });
     } catch (error) { throw childFailure({ error, stderr: error.stderr }, phase); }
     if (result?.error || (result?.status ?? result?.exitCode ?? 0) !== 0) throw childFailure(result, phase);
     return String(result?.stdout ?? "");
   };
-  const modules = (await command([npm, "root", "--global"], "preflight", 30000)).trim();
+  const modules = (await command([npm, "root", "--global", ...prefixArgs], "preflight", 30000)).trim();
   if (!path.isAbsolute(modules) || /[\u0000-\u001f\u007f]/.test(modules)) throw failure("UPDATE_GLOBAL_ROOT_INVALID", "npm returned an invalid global installation directory.", "preflight");
-  const prefix = (await command([npm, "prefix", "--global"], "preflight", 30000)).trim();
-  if (!path.isAbsolute(prefix) || /[\u0000-\u001f\u007f]/.test(prefix)
+  const prefix = (await command([npm, "prefix", "--global", ...prefixArgs], "preflight", 30000)).trim();
+  if (!path.isAbsolute(prefix) || /[\u0000-\u001f\u007f]/.test(prefix) || userPrefix && path.relative(userPrefix, prefix) !== ""
       || path.relative(modules, path.join(prefix, ...(platform === "win32" ? [] : ["lib"]), "node_modules")) !== "") {
     throw failure("UPDATE_GLOBAL_ROOT_INVALID", "npm returned inconsistent global prefix and installation directories.", "preflight");
   }
@@ -146,7 +161,7 @@ export async function runUpdate({ args = [], env = process.env, platform = proce
   const config = readConfig({ env: childEnv, platform, missing: true });
   let runtime;
   if (config) {
-    runtime = readRuntime(config.paths.root, { root: globalRoot, nodeExecutable: process.execPath });
+    runtime = readRuntime(config.paths.root, { root: globalRoot, nodeExecutable: process.execPath, allowMissingFiles: true });
     if (runtime.packageVersion && newerVersion(runtime.packageVersion, version)) throw failure("UPDATE_DOWNGRADE_REFUSED", "The owned relay runtime is newer than this updater. Run the update command with the latest published package.", "preflight");
     if (runtime.environment !== undefined) childEnv = { ...Object.fromEntries(Object.entries(childEnv).filter(([name]) => !MANAGED_ENV.has(name.toUpperCase()))), ...runtime.environment };
     childEnv.AGENT_RELAY_DIRECTORY = config.paths.root;
@@ -176,19 +191,22 @@ export async function runUpdate({ args = [], env = process.env, platform = proce
       if (!quiescent(config)) throw Object.assign(failure("UPDATE_RELAY_PENDING", `The disabled relay still has an owned process whose release could not be verified. ${RETRY}`, "migration"), { pending: true });
     } else {
       onProgress("Waiting for the legacy relay to finish existing work and activate the update runtime.");
-      const staged = runtime.packageVersion && !legacy(runtime.packageVersion) && !newerVersion("1.26.2", runtime.packageVersion);
+      const staged = runtime.filesAvailable !== false && runtime.packageVersion && !legacy(runtime.packageVersion) && !newerVersion("1.26.2", runtime.packageVersion);
       const service = await awaitService(staged ? runtime.packageRoot : root, !staged, "migration", staged ? runtime.packageVersion : version);
       migrated = !staged && service.enabled;
     }
   }
-  onProgress(`Installing bridge ${version} and applying managed settings.`);
-  await command([npm, "install", "--global", "--prefix", prefix, `${PACKAGE}@${version}`, "--ignore-scripts=false", `--allow-scripts=${PACKAGE}`, "--foreground-scripts"], "installation");
+  onProgress(`Installing bridge ${version}.`);
+  await command([npm, "install", "--global", "--prefix", prefix, `${PACKAGE}@${version}`, "--ignore-scripts"],
+    "installation", 600000, { ...childEnv, CODEX_BRIDGE_SKIP_SETUP: "1" });
   if (packageVersion(globalRoot) !== version) throw failure("UPDATE_VERSION_MISMATCH", "The global package version does not match the updater version. Rerun the same update command.", "verification");
-  onProgress("Verifying the global bridge settings and owned relay runtime.");
-  let setup;
-  try { setup = JSON.parse(await command([path.join(globalRoot, "scripts", "setup.mjs"), "--check", "--json"], "verification")); }
-  catch (error) { if (error?.code) throw error; throw failure("UPDATE_SETUP_INCOMPLETE", `Global setup did not return a verifiable result. ${RETRY}`, "verification"); }
-  if (setup?.configured !== true) throw failure("UPDATE_SETUP_INCOMPLETE", `The global bridge settings are incomplete. ${RETRY}`, "verification");
+  for (const check of [false, true]) {
+    onProgress(check ? "Verifying the global bridge settings and owned relay runtime." : "Applying managed settings from the installed bridge.");
+    let setup;
+    try { setup = JSON.parse(await command([path.join(globalRoot, "scripts", "setup.mjs"), ...(check ? ["--check"] : []), "--json"], "verification")); }
+    catch (error) { if (error?.code) throw error; throw failure("UPDATE_SETUP_INCOMPLETE", `Global setup did not return a verifiable result. ${RETRY}`, "verification"); }
+    if (setup?.configured !== true) throw failure("UPDATE_SETUP_INCOMPLETE", `The global bridge settings are incomplete. ${RETRY}`, "verification");
+  }
   const service = await awaitService(globalRoot, false, "verification");
   return { updated: true, configured: true, version, previousVersion, migrated, service, opensApps: false, opensChats: false };
 }

package/src/background-relay-registration.mjs

@@ -120,9 +120,16 @@ function samePath(left, right, platform) {
   catch { return false; }
 }
 
+function nodeLauncher(command, expected, platform) {
+  if (samePath(command, expected, platform)) return true;
+  if (typeof command !== "string" || !path.isAbsolute(command) || command.includes("\0")) return false;
+  if (!(platform === "win32" ? /^node\.exe$/i : /^node$/).test(path.basename(command))) return false;
+  try { return fs.statSync(command).isFile(); } catch { return false; }
+}
+
 function ownedEntry(entry, expected, platform) {
   if (entry === undefined) return;
-  if (!object(entry) || !samePath(entry.command, expected.command, platform)
+  if (!object(entry) || !nodeLauncher(entry.command, expected.command, platform)
       || !Array.isArray(entry.args) || entry.args.length !== 1 || !samePath(entry.args[0], expected.args[0], platform)
       || entry.type !== undefined && entry.type !== "stdio"
       || ["url", "serverUrl", "serverURL", "httpUrl", "headers", "oauth", "authProviderType"].some((key) => Object.hasOwn(entry, key))

package/src/background-relay-service.mjs

@@ -66,7 +66,7 @@ export function relayServiceRuntimeId(runtime) {
   return createHash("sha256").update(JSON.stringify([runtime.packageRoot, runtime.nodeExecutable, runtime.packageVersion ?? null, runtime.environment ?? {}])).digest("hex");
 }
 
-export function readRelayServiceRuntime(directory, { root = ROOT, nodeExecutable = stableNodeBin() } = {}) {
+export function readRelayServiceRuntime(directory, { root = ROOT, nodeExecutable = stableNodeBin(), allowMissingFiles = false } = {}) {
   let text;
   try { text = readRegularConfigFile(path.join(directory, "service-runtime.json"), { missing: true, maxBytes: 64 * 1024 }); }
   catch { throw serviceFailure("SERVICE_RUNTIME_INVALID"); }
@@ -78,11 +78,17 @@ export function readRelayServiceRuntime(directory, { root = ROOT, nodeExecutable
       || ![value.packageRoot, value.nodeExecutable].every((entry) => typeof entry === "string" && path.isAbsolute(entry) && !/[\u0000-\u001f\u007f]/.test(entry))
       || value.environment !== undefined && (!value.environment || typeof value.environment !== "object" || Array.isArray(value.environment)
         || Object.entries(value.environment).some(([name, entry]) => !["HOME", "PATH", "CODEX_HOME", "CLAUDE_CONFIG_DIR", "XDG_CONFIG_HOME"].includes(name)
-          || typeof entry !== "string" || !entry || /[\u0000-\u001f\u007f]/.test(entry)))
-      || ![path.join(value.packageRoot, "src", "background-relay-service.mjs"), path.join(value.packageRoot, "src", "background-relay-daemon.mjs"), value.nodeExecutable].every((entry) => {
-        try { return fs.statSync(entry).isFile(); } catch { return false; }
-      })) throw serviceFailure("SERVICE_RUNTIME_INVALID");
-  return value;
+          || typeof entry !== "string" || !entry || /[\u0000-\u001f\u007f]/.test(entry)))) throw serviceFailure("SERVICE_RUNTIME_INVALID");
+  let filesAvailable = true;
+  for (const entry of [path.join(value.packageRoot, "src", "background-relay-service.mjs"), path.join(value.packageRoot, "src", "background-relay-daemon.mjs"), value.nodeExecutable]) {
+    try {
+      if (!fs.statSync(entry).isFile()) throw serviceFailure("SERVICE_RUNTIME_INVALID");
+    } catch (error) {
+      if (!allowMissingFiles || error.code !== "ENOENT") throw serviceFailure("SERVICE_RUNTIME_INVALID");
+      filesAvailable = false;
+    }
+  }
+  return allowMissingFiles ? { ...value, filesAvailable } : value;
 }
 
 export function acquireRelayServiceLock(root, { pid = process.pid, isAlive = alive, identity = processIdentity } = {}) {

package/src/claude-bridge.mjs

@@ -31,7 +31,7 @@ import { BACKGROUND_WORKER_GUIDANCE, registerBackgroundTools } from "./backgroun
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.26.3";
+const VERSION = "1.26.5";
 void import("./telemetry.mjs").then(({ startUsageReporting }) => startUsageReporting({ version: VERSION })).catch(() => {});
 const FORWARD_MIN_INTERVAL_MS = 5000;
 const FORWARD_MAX_PER_SESSION = 50;

package/src/index.mjs

@@ -44,7 +44,7 @@ import { BACKGROUND_WORKER_GUIDANCE, registerBackgroundTools } from "./backgroun
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.26.3";
+const VERSION = "1.26.5";
 void import("./telemetry.mjs").then(({ startUsageReporting }) => startUsageReporting({ version: VERSION })).catch(() => {});
 const log = (msg) => process.stderr.write(`[codex-mcp-bridge] ${msg}\n`);
 

package/src/native-relay-companion.mjs

@@ -43,7 +43,7 @@ import { remoteCodexSocketPath, remoteNativeAdapter, remoteRequestResponse } fro
 
 exitForVersionRequest(import.meta.url);
 
-const VERSION = "1.26.3";
+const VERSION = "1.26.5";
 const log = (msg) => process.stderr.write(`[native-relay] ${msg}\n`);
 
 function errorResponse(code, message, sent, details) {

package/src/setup.mjs

@@ -179,7 +179,7 @@ export function checkSetup({ env = process.env, platform = process.platform, roo
 
 export function runSetup({ args = [], env = process.env, platform = process.platform, root = ROOT, run = execute, resolve = resolveCodexBin } = {}) {
   const options = setupArguments(args);
-  if (options.help) return { help: "Usage: codex-bridge-setup [--check|--dry-run] [--json] [--no-download]\nUpdate the package and apply managed settings with: npm install -g @minhspark/codex-mcp-bridge@latest --allow-scripts=@minhspark/codex-mcp-bridge --foreground-scripts\nGlobal npm installation configures Claude Desktop, Claude Code, Codex, Antigravity and the independent worker relay automatically. CODEX_BRIDGE_SKIP_SETUP=1 opts out. Saved configuration, background relay health and loaded native app connections are verified separately." };
+  if (options.help) return { help: `Usage: codex-bridge-setup [--check|--dry-run] [--json] [--no-download]\nUpdate the package and apply managed settings with: ${platform === "win32" ? "npx.cmd" : "npx"} --yes --ignore-scripts --package=@minhspark/codex-mcp-bridge@latest -- codex-bridge-update${platform === "win32" ? " --user" : ""}\nThe updater installs the package with lifecycle scripts disabled, then directly configures Claude Desktop, Claude Code, Codex, Antigravity and the independent worker relay. CODEX_BRIDGE_SKIP_SETUP=1 opts out. Saved configuration, background relay health and loaded native app connections are verified separately.` };
   if (options.postinstall && !automaticSetupEnabled(env)) return { skipped: true, reason: "Automatic configuration runs only for a global npm install; use codex-bridge-setup for manual setup." };
   if (options.check) return checkSetup({ env, platform, root, run, resolve });
   const native = platform === "win32" || platform === "darwin";