@mnemonik/cli 7.100.0 → 7.101.3

package/dist/install/hosts.js

@@ -4684,14 +4684,8 @@ function apiOrigin(env = process.env) {
 }
 
 // packages/cli/src/install/hosts.ts
-import {
-  bindInstalledHostGrants,
-  grantHost,
-  matchHostGrant
-} from "../auth/status.js";
 import { readFile, rm } from "node:fs/promises";
 import { dirname as dirname2, join as join2, resolve } from "node:path";
-import { setTimeout as delay } from "node:timers/promises";
 import {
   hostPackageImports
 } from "./adapters.js";
@@ -4708,29 +4702,12 @@ import {
 } from "./ownership.js";
 import { ensureInstallSession } from "../auth/installSession.js";
 import { createCliCredentials } from "../auth/credentials.js";
+import { readInstallation } from "../installation.js";
 function codexTrustAction(resolvedPath) {
   const desktop = resolvedPath?.includes("/ChatGPT.app/") || /[\\/]Programs[\\/]OpenAI[\\/]Codex[\\/]/i.test(resolvedPath ?? "");
   return desktop ? "Open the ChatGPT app and use the 'Hooks need review' notice at startup to review and allow the Mnemonik hooks. If the notice does not appear, restart the app once." : "Run the codex command in a terminal and use its hook trust prompt to allow the Mnemonik hooks; then quit and reopen Codex.";
 }
 var CODEX_TRUST_ACTION = codexTrustAction();
-var hostLabels = {
-  "claude-code": "Claude Code",
-  codex: "Codex",
-  cursor: "Cursor",
-  grok: "Grok"
-};
-var hostNotConnectedCondition = (host) => ({
-  kind: "host_not_connected",
-  component: host,
-  reason: `${host}: signed in, not connected yet`,
-  action: `open ${hostLabels[host]} and start a session, then run mnemonik status`
-});
-var hostStillConnectingCondition = (host) => ({
-  kind: "login_pending",
-  component: host,
-  reason: `${hostLabels[host]} is still connecting. Finish the sign-in in the app, then run mnemonik status.`,
-  action: "mnemonik status"
-});
 var identity = (t) => `${t.host}:${t.component ?? "hooks"}:${t.scope}:${t.profilePath ?? (t.scope === "user" ? t.home : t.projectRoot)}`;
 async function hostSource(host, packagePath = new URL("../../package.json", import.meta.url)) {
   const pkg = JSON.parse(await readFile(packagePath, "utf8"));
@@ -4775,11 +4752,7 @@ async function apply(journal, run2) {
   for (const target of journal.data.targets.filter((t) => t.group === run2.id))
     await journal.commit(target);
 }
-function actionFor(reason, selection, searchedLocations = [], resolvedPath) {
-  if (reason === "not_found") {
-    const name2 = hostLabels[selection.host];
-    return searchedLocations.length ? `${name2} was not found (looked on PATH and in ${searchedLocations.join(", ")}). Install it, or open a new terminal if you just installed it.` : `${name2} was not found on PATH. Install it, or open a new terminal if you just installed it.`;
-  }
+function actionFor(reason, selection, resolvedPath) {
   if (reason === "unsupported_version")
     return `upgrade ${selection.host} to ${selection.host === "codex" ? "0.145.0" : "a supported version"} and retry`;
   if (reason === "unverified_version")
@@ -4792,15 +4765,10 @@ function actionFor(reason, selection, searchedLocations = [], resolvedPath) {
     return `Resolve the existing Mnemonik MCP declaration in ${selection.host}, then retry.`;
   if (reason === "project_shared_declaration_conflict")
     return "Ask the collaborator who owns the project declaration to reconcile it, then retry.";
-  if (reason === "host_grant_unverified") return `Run mnemonik connect ${selection.host}.`;
-  if (reason === "host_enable_required")
-    return `Enable Mnemonik in ${hostLabels[selection.host]}, then run mnemonik connect ${selection.host}.`;
   if (reason === "hooks_missing" || reason === "mcp_declaration_missing")
     return `mnemonik repair --host ${selection.host} --component ${selection.component ?? "hooks"}`;
   if (reason === "installation_required") return "Run mnemonik install first.";
   if (reason === "digest_mismatch") return "mnemonik repair";
-  if (reason === "host_account_mismatch")
-    return `Sign out of Mnemonik in ${selection.host}${selection.profilePath ? ` profile ${selection.profilePath}` : ""}, then run mnemonik connect ${selection.host}.`;
   if (reason === "hook_credential_authorization_required")
     return "Run `mnemonik auth login --reopen-install` to start a new install session";
   return void 0;
@@ -4857,6 +4825,8 @@ var protectInstall = (deps, work) => async (journal) => {
   }
 };
 async function runHosts(command, selections, deps, allowMigration = false) {
+  if (command === "install")
+    selections = selections.map((selection) => ({ ...selection, scope: "user" }));
   const pending = (await interrupted(deps.stateDir))[0];
   if (pending && !pending.data.hostRequest) throw new Error("resolve_interrupted_install_first");
   const outcome = await withInstall(
@@ -4888,7 +4858,7 @@ async function runHosts(command, selections, deps, allowMigration = false) {
           return { results, reports: journal.data.reports, journal: journal.data };
         }
         const completed = journal.data.hostRuns.filter(
-          (run2) => (run2.status === "complete" || run2.status === "verified" || run2.reason === "host_skipped") && !journal.data.targets.some(
+          (run2) => (run2.status === "complete" || run2.status === "verified") && !journal.data.targets.some(
             (target) => target.group === run2.id && target.status === "restored"
           )
         );
@@ -4910,8 +4880,8 @@ async function runHosts(command, selections, deps, allowMigration = false) {
           results.push({
             target: run2.id,
             elapsedMs: run2.elapsedMs ?? 0,
-            status: run2.reason === "host_skipped" ? "LIMITED" : run2.candidate?.component === "mcp" && !run2.candidate.grant ? "ACTION_REQUIRED" : deps.grants ? "READY" : "LIMITED",
-            reason: run2.reason ?? "host_grant_unverified"
+            status: run2.reason === "codex_trust_pending" ? "ACTION_REQUIRED" : "READY",
+            reason: run2.reason ?? "declaration installed"
           });
         }
         selections = request.selections.filter(
@@ -4936,8 +4906,8 @@ async function runHosts(command, selections, deps, allowMigration = false) {
             results.push({
               target: run2.id,
               elapsedMs: run2.elapsedMs ?? 0,
-              status: run2.reason === "uninstalled" ? "READY" : run2.candidate?.component === "mcp" && !run2.candidate.grant ? "ACTION_REQUIRED" : "LIMITED",
-              reason: run2.reason ?? "host_grant_unverified"
+              status: run2.reason === "codex_trust_pending" ? "ACTION_REQUIRED" : "READY",
+              reason: run2.reason ?? "declaration installed"
             });
         }
         if (request.command === "uninstall")
@@ -4971,8 +4941,7 @@ async function runHosts(command, selections, deps, allowMigration = false) {
         journal.data.hostRuns.push(run2);
         await journal.save();
         let freshRuntimeVersion;
-        let searchedLocations = [];
-        let resolvedPath;
+        let runtimeChanged = false;
         try {
           const pointer = store.pointerPath(selection.host);
           const beforePointer = await bytesAt(pointer);
@@ -4981,6 +4950,7 @@ async function runHosts(command, selections, deps, allowMigration = false) {
           if (command === "update" || command === "install") {
             const source = await (deps.source ?? hostSource)(selection.host);
             const previous = beforePointer ? JSON.parse(beforePointer.toString()) : void 0;
+            runtimeChanged = previous?.current.version !== source.manifest.version;
             const proposed = previous?.current.version === source.manifest.version ? beforePointer : Buffer.from(
               JSON.stringify({
                 current: {
@@ -5001,6 +4971,11 @@ async function runHosts(command, selections, deps, allowMigration = false) {
             await journal.commit(runtimeTarget);
           } else runtime = await store.verifyRuntime(selection.host);
           const target = targetFor(selection, runtime, store, old);
+          if (target.component === "mcp" && target.scope === "user") {
+            target.installationId = await readInstallation(deps.stateDir);
+            if (command !== "uninstall" && !target.installationId)
+              throw new Error("installation_required");
+          }
           const module2 = await (deps.imports ?? hostPackageImports)[selection.host](runtime);
           const adapter = module2.createHostAdapter({
             target,
@@ -5009,17 +4984,6 @@ async function runHosts(command, selections, deps, allowMigration = false) {
             artifactDigest: runtime.reference.manifestSha256
           });
           if (adapter.name !== selection.host) throw new Error("adapter_identity_mismatch");
-          const detected = await adapter.detect();
-          resolvedPath = detected.resolvedPath;
-          if (!detected.supported) {
-            searchedLocations = detected.searchedLocations ?? [];
-            if (target.component === "mcp" && command !== "update" && command !== "repair") {
-              const instruction = await adapter.launch();
-              journal.data.reports.push(instruction);
-              deps.instruction?.(instruction);
-            }
-            throw new Error(detected.reason ?? "unverified_version");
-          }
           if (!adapter.capabilities().components.includes(target.component))
             throw new Error("unsupported_component");
           if (!adapter.capabilities().scopes.includes(selection.scope))
@@ -5033,7 +4997,7 @@ async function runHosts(command, selections, deps, allowMigration = false) {
             target.credentialFamily = old?.credentialFamily ?? record.targets.find(
               (candidate) => candidate.host === selection.host && candidate.component === "hooks" && candidate.home === selection.home
             )?.credentialFamily ?? "";
-            if (command !== "uninstall" && (!target.credentialFamily || !await credentials.readFamily(target.credentialFamily))) {
+            if (command !== "update" && command !== "uninstall" && (!target.credentialFamily || !await credentials.readFamily(target.credentialFamily))) {
               let bearer = await deps.getCliBearer?.();
               if (!bearer) throw new Error("hook_credential_authorization_required");
               const issue = () => (deps.credentialFetch ?? fetch)(`${apiOrigin()}/api/v1/component-credentials`, {
@@ -5048,10 +5012,8 @@ async function runHosts(command, selections, deps, allowMigration = false) {
               let response = await issue();
               const body2 = response.status === 403 ? await response.json().catch(() => ({})) : void 0;
               if (body2?.error === "install_session_required") {
-                const installation = (await deps.grants?.list())?.deviceInstallationId;
+                const installation = await readInstallation(deps.stateDir);
                 if (!installation) throw new Error("hook_credential_authorization_required");
-                if (!deps.authorizeInstallSession && !deps.timeout)
-                  throw new Error("hook_credential_authorization_required");
                 try {
                   bearer = await ensureInstallSession({
                     stateDir: deps.stateDir,
@@ -5141,44 +5103,19 @@ async function runHosts(command, selections, deps, allowMigration = false) {
           if (command === "uninstall") {
             if ((await adapter.verify(target)).declarationPresent)
               throw new Error("uninstall_verification_failed");
-            if (target.component === "mcp" && await deps.offerRevoke?.(selection.host)) {
-              await revokeHostGrants(selection.host, deps, old?.grant?.id);
-              if (old?.grant && adapter.revoke) await adapter.revoke(old.grant);
-              else deps.instruction?.(adapter.revokeAction);
-            }
           } else {
-            try {
-              inspection = await waitForHost(
-                adapter,
-                target,
-                selection.host,
-                {
-                  ...deps,
-                  instruction: (text) => {
-                    journal.data.reports.push(`${run2.id}: ${text}`);
-                    deps.instruction?.(text);
-                  }
-                },
-                old?.grant,
-                command
-              );
-              run2.reason = inspection.trustPending ? "codex_trust_pending" : target.component === "hooks" || inspection.grant ? "hooks_not_verified" : "host_grant_unverified";
-              if (inspection.trustPending)
-                journal.data.reports.push(
-                  `codex: ${codexTrustAction(inspection.resolvedPath ?? resolvedPath)}`
-                );
-            } catch (error) {
-              if (target.component !== "mcp") throw error;
-              run2.reason = error instanceof Error ? error.message : "host_verification_timeout";
-              if (deps.afterHosts && run2.reason === "host_verification_timeout")
-                run2.reason = "login_pending";
-              journal.data.reports.push(
-                `${run2.id}: URL-only entry retained, not connected. Run mnemonik connect ${selection.host}.`
+            inspection = await adapter.verify(target);
+            if (inspection.trustDeclined) throw new Error("codex_trust_declined");
+            if (!inspection.declarationPresent)
+              throw new Error(
+                target.component === "hooks" ? "hooks_missing" : "mcp_declaration_missing"
               );
-            }
+            run2.reason = inspection.trustPending ? "codex_trust_pending" : target.component === "hooks" ? "hooks installed" : "MCP entry declared";
+            if (inspection.trustPending)
+              journal.data.reports.push(`codex: ${codexTrustAction(inspection.resolvedPath)}`);
           }
           await journal.event("host_observed", run2.id);
-          const migrated = inspection?.grant || target.component === "hooks" ? otherScopes : [];
+          const migrated = inspection?.declarationPresent ? otherScopes : [];
           for (const other of migrated) {
             const removals = [];
             const otherOwned = record.targets.find(
@@ -5207,16 +5144,13 @@ async function runHosts(command, selections, deps, allowMigration = false) {
           if (command !== "uninstall") {
             const profilePath2 = old?.profilePath ?? ownedChanges.at(-1)?.path;
             if (!profilePath2) throw new Error("adapter_empty_plan");
-            const grant = inspection?.grant ?? old?.grant;
             const candidate = {
               ...selection,
               id: run2.id,
               component: target.component,
               credentialFamily: target.credentialFamily,
-              ...grant ? { grant } : {},
               profilePath: profilePath2,
               version: runtime.manifest.version,
-              ...detected.version ? { editorVersion: detected.version } : {},
               artifactDigest: runtime.reference.manifestSha256,
               runtimePointer: pointer,
               files: ownedChanges.map((c) => {
@@ -5240,7 +5174,7 @@ async function runHosts(command, selections, deps, allowMigration = false) {
                 }
               } : {}
             };
-            if (!grant) delete candidate.grant;
+            delete candidate.grant;
             run2.candidate = candidate;
           }
           run2.reason ??= "uninstalled";
@@ -5250,70 +5184,38 @@ async function runHosts(command, selections, deps, allowMigration = false) {
           await saveOwnership(deps.stateDir, journal, run2);
           run2.status = "complete";
           await journal.event("local_commit", run2.id);
-          if (command === "update")
+          if (command === "update" && runtimeChanged)
             journal.data.reports.push(
               `${selection.host}: shared runtime updated for all scopes to ${runtime.manifest.version}.`
             );
           const result = {
             target: run2.id,
             elapsedMs: run2.elapsedMs ?? 0,
-            status: inspection?.trustPending || target.component === "mcp" && command !== "uninstall" && !inspection?.grant ? "ACTION_REQUIRED" : deps.grants ? "READY" : "LIMITED",
+            status: inspection?.trustPending ? "ACTION_REQUIRED" : "READY",
             reason: run2.reason,
-            ...actionFor(run2.reason, selection, [], inspection?.resolvedPath ?? resolvedPath) ? {
-              action: actionFor(
-                run2.reason,
-                selection,
-                [],
-                inspection?.resolvedPath ?? resolvedPath
-              )
+            ...actionFor(run2.reason, selection, inspection?.resolvedPath) ? {
+              action: actionFor(run2.reason, selection, inspection?.resolvedPath)
             } : {}
           };
           results.push(result);
-          if (command === "install" && deps.afterHosts && (inspection?.trustPending || run2.reason === "login_pending"))
+          if (command === "install" && deps.afterHosts && inspection?.trustPending)
             completionChecks.push(async () => {
               const reread = await adapter.verify(target);
               if (reread.trustDeclined) {
                 result.status = "ACTION_REQUIRED";
                 result.reason = "codex_trust_declined";
-                result.action = actionFor(
-                  result.reason,
-                  selection,
-                  [],
-                  reread.resolvedPath ?? resolvedPath
-                );
+                result.action = actionFor(result.reason, selection, reread.resolvedPath);
                 return;
               }
               if (reread.trustPending) return;
               if (target.component === "hooks") {
-                result.status = reread.declarationPresent ? deps.grants ? "READY" : "LIMITED" : "ACTION_REQUIRED";
-                result.reason = reread.declarationPresent ? "hooks_not_verified" : "hooks_missing";
+                result.status = reread.declarationPresent ? "READY" : "ACTION_REQUIRED";
+                result.reason = reread.declarationPresent ? "hooks installed" : "hooks_missing";
                 if (reread.declarationPresent) delete result.action;
                 else result.action = `mnemonik repair --host ${selection.host} --component hooks`;
-                const report = `codex: ${codexTrustAction(reread.resolvedPath ?? resolvedPath)}`;
+                const report = `codex: ${codexTrustAction(reread.resolvedPath)}`;
                 const index = journal.data.reports.indexOf(report);
                 if (index >= 0) journal.data.reports.splice(index, 1);
-                return;
-              }
-              if (!deps.grants) return;
-              const listing = await deps.grants.list();
-              if (!deps.account || listing.account !== deps.account) return;
-              const grants = listing.grants.filter(
-                (grant) => grantHost(grant) === selection.host && grant.resource === `${apiOrigin()}/mcp` && grant.scopes.includes("mcp:use")
-              );
-              const bound = grants.find(
-                (grant) => listing.deviceInstallationId && grant.deviceInstallationId === listing.deviceInstallationId && grant.activatedAt
-              ) ?? grants.find(
-                (grant) => listing.deviceInstallationId && grant.deviceInstallationId === listing.deviceInstallationId
-              );
-              if (bound && !bound.activatedAt) {
-                const condition = hostNotConnectedCondition(selection.host);
-                result.status = "LIMITED";
-                result.reason = condition.reason;
-                result.action = condition.action;
-              } else if (bound?.activatedAt && reread.declarationPresent && reread.authenticatedTools) {
-                result.status = "READY";
-                result.reason = "connected to this machine";
-                delete result.action;
               }
             });
         } catch (error) {
@@ -5334,7 +5236,7 @@ async function runHosts(command, selections, deps, allowMigration = false) {
             status: "ACTION_REQUIRED",
             reason: run2.reason,
             ...detail ? { detail } : {},
-            ...actionFor(run2.reason, selection, searchedLocations, resolvedPath) ? { action: actionFor(run2.reason, selection, searchedLocations, resolvedPath) } : {}
+            ...actionFor(run2.reason, selection) ? { action: actionFor(run2.reason, selection) } : {}
           });
           await journal.save();
         } finally {
@@ -5478,167 +5380,13 @@ async function hookStatusConditions(deps, hosts) {
   }
   return conditions;
 }
-async function finishMcpTarget(adapter, target, deps, status) {
-  if (adapter.capabilities().nativeListing === false) {
-    if (!status.declarationPresent || !deps.grants) return status;
-    const hookPath = (await adapter.verify({ ...target, component: "hooks" })).declarationPath;
-    const hooks = (await readOwnership(deps.stateDir)).targets.find(
-      (t) => t.host === adapter.name && t.component === "hooks" && t.profilePath === hookPath
-    );
-    if (!hooks?.credentialFamily || !(await adapter.verify({
-      ...target,
-      component: "hooks",
-      credentialFamily: hooks.credentialFamily
-    })).declarationPresent)
-      return status;
-    const listing = await deps.grants.list();
-    if (!deps.account || listing.account !== deps.account) throw new Error("host_account_mismatch");
-    return {
-      ...status,
-      authenticatedTools: listing.grants.some(
-        (g) => grantHost(g) === adapter.name && g.resource === `${apiOrigin()}/mcp` && !!g.activatedAt && g.scopes.includes("mcp:use")
-      )
-    };
-  }
-  if (!status.enableRequired) return status;
-  const instruction = await adapter.enable?.();
-  if (instruction) deps.instruction?.(instruction);
-  const verified = await adapter.verify(target);
-  if (!verified.authenticatedTools) throw new Error("host_enable_required");
-  return verified;
-}
-async function waitForHost(adapter, target, host, deps, recorded, command) {
-  if (command === "update" || command === "repair") {
-    let status = await adapter.verify(target);
-    if (!status.trustPending && !status.trustDeclined && status.enableRequired) {
-      const instruction = await adapter.enable?.();
-      if (instruction) deps.instruction?.(instruction);
-      status = await adapter.verify(target);
-    }
-    if (status.trustDeclined) throw new Error("codex_trust_declined");
-    if (status.trustPending) return status;
-    if (status.enableRequired) throw new Error("host_enable_required");
-    if (!status.declarationPresent)
-      throw new Error(target.component === "hooks" ? "hooks_missing" : "mcp_declaration_missing");
-    if (target.component === "hooks") return status;
-    if (!deps.grants) throw new Error("host_grant_unverified");
-    if (!recorded) {
-      if (!deps.account) throw new Error("host_account_mismatch");
-      status = await finishMcpTarget(adapter, target, deps, status);
-      if (!status.authenticatedTools) throw new Error("host_grant_unverified");
-      try {
-        const matched = await matchHostGrant(
-          status,
-          host,
-          deps.account,
-          deps.grants,
-          (deps.now ?? Date.now)(),
-          void 0,
-          deps.approveHost,
-          "recovered"
-        );
-        if (matched.grant?.installationId) return matched;
-      } catch (error) {
-        if (error instanceof Error && error.message === "host_connection_pending")
-          throw new Error("host_grant_unverified");
-        throw error;
-      }
-      throw new Error("host_grant_unverified");
-    }
-    const listing = await deps.grants.list();
-    if (!deps.account || listing.account !== deps.account || recorded.account !== deps.account)
-      throw new Error("host_account_mismatch");
-    const live = listing.grants.find(
-      (grant) => grant.id === recorded.id && grantHost(grant) === host && grant.resource === `${apiOrigin()}/mcp` && !!grant.activatedAt && grant.scopes.includes("mcp:use") && (!grant.deviceInstallationId || grant.deviceInstallationId === listing.deviceInstallationId) && (!recorded.installationId || recorded.installationId === listing.deviceInstallationId)
-    );
-    if (!live) throw new Error("host_grant_unverified");
-    return { ...status, grant: { ...recorded, scopes: live.scopes } };
-  }
-  for (; ; ) {
-    const now = deps.now ?? Date.now;
-    const attemptStartedAt = now();
-    let signedIn = false;
-    let waitingForActivation = false;
-    let staleRecord = false;
-    const match = async (status, approvalMode = "all") => {
-      const grants = deps.grants;
-      if (!grants) return status;
-      try {
-        return await matchHostGrant(
-          status,
-          host,
-          deps.account,
-          grants,
-          attemptStartedAt,
-          recorded,
-          deps.approveHost,
-          approvalMode
-        );
-      } catch (error) {
-        if (!(error instanceof Error) || error.message !== "host_connection_pending") throw error;
-        if (approvalMode === "recovered" && recorded) {
-          staleRecord = true;
-          deps.instruction?.(
-            `${hostLabels[host]} is no longer signed in to Mnemonik; starting a new sign-in.`
-          );
-          return void 0;
-        }
-        if (!waitingForActivation && !staleRecord)
-          deps.instruction?.(
-            `${host === "codex" ? "Codex" : host} is still finishing its connection.`
-          );
-        waitingForActivation = true;
-        return void 0;
-      }
-    };
-    if (target.component === "mcp" && deps.grants) {
-      const status = await finishMcpTarget(adapter, target, deps, await adapter.verify(target));
-      if (status.declarationPresent && status.authenticatedTools) {
-        const matched = await match(status, "recovered");
-        if (matched?.grant?.installationId) return matched;
-        signedIn = !staleRecord && (waitingForActivation || !!matched?.grant);
-      }
-    }
-    if (target.component === "mcp" && adapter.capabilities().nativeConnect && deps.grants && !signedIn && !staleRecord) {
-      const status = await deps.grants.list();
-      if (!deps.account || status.account !== deps.account)
-        throw new Error("host_account_mismatch");
-      signedIn = status.grants.some(
-        (grant) => grantHost(grant) === host && grant.resource === `${apiOrigin()}/mcp` && !!grant.activatedAt && grant.scopes.includes("mcp:use")
-      );
-    }
-    const instruction = target.component === "mcp" && !waitingForActivation ? await adapter.launch({ signedIn: signedIn && !staleRecord }) : "";
-    if (instruction) deps.instruction?.(instruction);
-    const deadline = now() + 12e4;
-    while (now() < deadline) {
-      const status = target.component === "mcp" ? await finishMcpTarget(adapter, target, deps, await adapter.verify(target)) : await adapter.verify(target);
-      if (status.trustDeclined) throw new Error("codex_trust_declined");
-      if (status.trustPending) return status;
-      if (status.declarationPresent && (target.component === "hooks" || status.authenticatedTools)) {
-        if (target.component === "hooks") return status;
-        if (!deps.grants) throw new Error("host_grant_unverified");
-        try {
-          const matched = await match(status);
-          if (matched) return matched;
-        } catch (error) {
-          deps.instruction?.(`Sign out of Mnemonik in ${host}, then run mnemonik connect ${host}.`);
-          throw error;
-        }
-      }
-      await (deps.sleep ?? delay)(Math.max(0, Math.min(2e3, deadline - now())));
-    }
-    if (host === "cursor" && instruction) deps.instruction?.(instruction);
-    deps.instruction?.(`mnemonik connect ${host}: retry or skip this host for now.`);
-    if (await deps.timeout?.(host) !== "retry") throw new Error("host_verification_timeout");
-  }
-}
 async function revokeHostGrants(host, deps, grantId) {
   if (!deps.grants) throw new Error("host_grant_unverified");
   const status = await deps.grants.list();
   if (status.account !== deps.account) throw new Error("host_account_mismatch");
-  const { grantHost: grantHost2 } = await import("../auth/status.js");
+  const { grantHost } = await import("../auth/status.js");
   const grants = status.grants.filter(
-    (g) => (!grantId || g.id === grantId) && grantHost2(g) === host && g.resource === `${apiOrigin()}/mcp`
+    (g) => (!grantId || g.id === grantId) && grantHost(g) === host && g.resource === `${apiOrigin()}/mcp`
   );
   for (const grant of grants) await deps.grants.revoke(grant.id);
   return grants.map((g) => g.id);
@@ -5663,66 +5411,22 @@ async function logoutHost(host, deps) {
   return ids;
 }
 async function connectHost(selection, deps) {
-  return withInstall(
-    deps.stateDir,
-    {
-      account: deps.account,
-      hosts: [selection.host],
-      components: ["mcp"],
-      scopes: {},
-      roots: [],
-      credentials: []
-    },
-    void 0,
-    async (journal) => {
-      const now = deps.now ?? Date.now;
-      const startedAt = now();
-      const current = (await readOwnership(deps.stateDir)).targets.find(
-        (t) => t.id === selection.id
-      );
-      if (!current || current.component !== "mcp") throw new Error("no_recorded_targets");
-      const store = new RuntimeStore(deps.stateDir);
-      const runtime = await store.verifyRuntime(current.host);
-      const target = targetFor(current, runtime, store);
-      const adapter = (await (deps.imports ?? hostPackageImports)[current.host](runtime)).createHostAdapter({ target, env: environment(current, deps.env) });
-      let reason = "hooks_not_verified";
-      let status = "LIMITED";
-      const candidate = { ...current };
-      const run2 = { id: current.id, host: current.host, status: "verified", candidate };
-      try {
-        const inspection = await waitForHost(adapter, target, current.host, deps, current.grant);
-        if (deps.grants) {
-          const listing = await deps.grants.list();
-          if (listing.account !== deps.account) throw new Error("host_account_mismatch");
-          await bindInstalledHostGrants(listing, [current.host], deps.grants);
-        }
-        if (inspection.grant) run2.candidate = { ...candidate, grant: inspection.grant };
-        if (inspection.grant?.installationId) {
-          status = "READY";
-          reason = "connected to this machine";
-        } else reason = "host_grant_unbound";
-      } catch (error) {
-        reason = error instanceof Error ? error.message : "host_verification_timeout";
-        status = "ACTION_REQUIRED";
-      }
-      await saveOwnership(deps.stateDir, journal, run2);
-      journal.data.phase = "complete";
-      journal.data.state = status;
-      run2.elapsedMs = Math.max(0, now() - startedAt);
-      journal.data.hostRuns = [run2];
-      await journal.event("complete");
-      return {
-        target: current.id,
-        elapsedMs: run2.elapsedMs,
-        status,
-        reason,
-        ...status === "ACTION_REQUIRED" ? {
-          action: reason === "installation_required" ? "Run mnemonik install first." : reason === "host_account_mismatch" ? `Sign out of Mnemonik in ${current.host} profile ${current.profilePath}, then run mnemonik connect ${current.host}.` : `Run mnemonik connect ${current.host}.`
-        } : {}
-      };
-    },
-    deps.fault
-  );
+  const now = deps.now ?? Date.now;
+  const startedAt = now();
+  const current = (await readOwnership(deps.stateDir)).targets.find((t) => t.id === selection.id);
+  if (!current || current.component !== "mcp") throw new Error("no_recorded_targets");
+  const store = new RuntimeStore(deps.stateDir);
+  const runtime = await store.verifyRuntime(current.host);
+  const target = targetFor(current, runtime, store);
+  const adapter = (await (deps.imports ?? hostPackageImports)[current.host](runtime)).createHostAdapter({ target, env: environment(current, deps.env) });
+  const instruction = await adapter.launch();
+  if (instruction) deps.instruction?.(instruction);
+  return {
+    target: current.id,
+    elapsedMs: Math.max(0, now() - startedAt),
+    status: "READY",
+    reason: "native_login"
+  };
 }
 export {
   CODEX_TRUST_ACTION,
@@ -5730,12 +5434,9 @@ export {
   codexTrustConditions,
   connectHost,
   hookStatusConditions,
-  hostNotConnectedCondition,
   hostSource,
-  hostStillConnectingCondition,
   logoutHost,
   revokeHostGrants,
   runHosts,
-  selectOwned,
-  waitForHost
+  selectOwned
 };