@researai/deepscientist 1.5.15 → 1.5.17

package/bin/ds.js

@@ -36,7 +36,7 @@ const pythonCommands = new Set([
 const UPDATE_PACKAGE_NAME = String(packageJson.name || '@researai/deepscientist').trim() || '@researai/deepscientist';
 const UPDATE_CHECK_TTL_MS = 12 * 60 * 60 * 1000;
 
-const optionsWithValues = new Set(['--home', '--host', '--port', '--quest-id', '--mode', '--proxy', '--codex-profile', '--codex']);
+const optionsWithValues = new Set(['--home', '--host', '--port', '--quest-id', '--mode', '--proxy', '--codex-profile', '--codex', '--auth']);
 
 function buildCodexOverrideEnv({ yolo = true, profile = null, binary = null } = {}) {
   const normalizedProfile = typeof profile === 'string' ? profile.trim() : '';
@@ -77,6 +77,33 @@ function parseBooleanFlagValue(rawValue) {
   return null;
 }
 
+function parseCodexCliVersion(text) {
+  const match = String(text || '').match(/codex-cli\s+(\d+)\.(\d+)\.(\d+)/i);
+  if (!match) {
+    return null;
+  }
+  return [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+
+function formatCodexCliVersion(version) {
+  if (!Array.isArray(version) || version.length !== 3) {
+    return '';
+  }
+  return version.join('.');
+}
+
+function compareCodexCliVersion(left, right) {
+  const leftParts = Array.isArray(left) ? left : [0, 0, 0];
+  const rightParts = Array.isArray(right) ? right : [0, 0, 0];
+  for (let index = 0; index < 3; index += 1) {
+    const delta = Number(leftParts[index] || 0) - Number(rightParts[index] || 0);
+    if (delta !== 0) {
+      return delta;
+    }
+  }
+  return 0;
+}
+
 function parseYoloArg(args, index, currentValue = true) {
   const arg = args[index];
   if (arg === '--yolo') {
@@ -112,6 +139,7 @@ Usage:
   ds update
   ds update --check
   ds update --yes
+  ds uninstall
   ds migrate /data/DeepScientist
   ds --here
   ds --yolo --port 20999 --here
@@ -130,6 +158,7 @@ Usage:
 Launcher flags:
   --host <host>         Bind host for the local web daemon
   --port <port>         Bind port for the local web daemon
+  --auth [true|false]   Require a 16-character local browser password. Default is false
   --tui                 Start the terminal workspace only
   --both                Start web + terminal workspace together
   --no-browser          Do not auto-open the browser
@@ -154,6 +183,9 @@ Migration:
   ds migrate <target>   Move the DeepScientist home/install root to a new absolute path
   ds migrate <target> --yes --restart
 
+Uninstall:
+  ds uninstall          Remove code/runtime only and preserve local data
+
 Runtime:
   DeepScientist uses uv to manage a locked local Python runtime.
   If uv is missing, ds bootstraps a local copy under the DeepScientist home automatically.
@@ -192,6 +224,47 @@ function normalizeProxyUrl(rawValue) {
   return value || null;
 }
 
+function normalizeLegacyHostFlagArgs(argv) {
+  const args = [];
+  let warned = false;
+  let legacyValue = null;
+
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === '--ip') {
+      warned = true;
+      legacyValue = argv[index + 1] || legacyValue;
+      args.push('--host');
+      if (argv[index + 1]) {
+        args.push(argv[index + 1]);
+        index += 1;
+      }
+      continue;
+    }
+    if (typeof arg === 'string' && arg.startsWith('--ip=')) {
+      warned = true;
+      legacyValue = arg.slice('--ip='.length) || legacyValue;
+      args.push('--host', arg.slice('--ip='.length));
+      continue;
+    }
+    args.push(arg);
+  }
+
+  if (!warned) {
+    return { args, warnings: [] };
+  }
+
+  const normalizedValue = String(legacyValue || '').trim();
+  const bindHint =
+    normalizedValue && ['0.0.0.0', '::', '[::]'].includes(normalizedValue)
+      ? ' Note: bind-all addresses such as 0.0.0.0 are valid for `--host`, but local browser access still uses 127.0.0.1.'
+      : '';
+  return {
+    args,
+    warnings: [`Launcher note: \`--ip\` is deprecated. Use \`--host\` instead.${bindHint}`],
+  };
+}
+
 function applyLauncherProxy(proxyUrl) {
   const normalized = normalizeProxyUrl(proxyUrl);
   if (!normalized) {
@@ -562,6 +635,20 @@ function bindUiUrl(host, port) {
   return `http://${formatHttpHost(normalized)}:${port}`;
 }
 
+function generateBrowserAuthToken() {
+  return crypto.randomBytes(8).toString('hex');
+}
+
+function appendBrowserAuthToken(url, authToken) {
+  const normalized = typeof authToken === 'string' ? authToken.trim() : '';
+  if (!normalized) {
+    return url;
+  }
+  const target = new URL(url);
+  target.searchParams.set('token', normalized);
+  return target.toString();
+}
+
 function normalizeMode(value) {
   const normalized = String(value || '')
     .trim()
@@ -588,6 +675,66 @@ function parseBooleanSetting(rawValue, fallback = false) {
   return fallback;
 }
 
+function shouldCompileRuntimeBytecode() {
+  return parseBooleanSetting(process.env.DEEPSCIENTIST_RUNTIME_COMPILE_BYTECODE, false);
+}
+
+function readRequiredOptionValue(args, index, optionName) {
+  const value = args[index + 1];
+  if (!value || String(value).startsWith('--')) {
+    return {
+      ok: false,
+      error: `Missing value for ${optionName}.`,
+    };
+  }
+  return {
+    ok: true,
+    value,
+  };
+}
+
+function parseStrictBooleanOption(rawValue, optionName) {
+  const parsed = parseBooleanFlagValue(rawValue);
+  if (parsed === null) {
+    return {
+      ok: false,
+      error: `Invalid value for ${optionName}: ${rawValue}. Use true or false.`,
+    };
+  }
+  return {
+    ok: true,
+    value: parsed,
+  };
+}
+
+function parseStrictPortOption(rawValue, optionName) {
+  const port = Number(rawValue);
+  if (!Number.isInteger(port) || port <= 0 || port > 65535) {
+    return {
+      ok: false,
+      error: `Invalid value for ${optionName}: ${rawValue}. Expected an integer between 1 and 65535.`,
+    };
+  }
+  return {
+    ok: true,
+    value: port,
+  };
+}
+
+function parseStrictModeOption(rawValue, optionName) {
+  const normalized = String(rawValue || '').trim().toLowerCase();
+  if (!['web', 'tui', 'both'].includes(normalized)) {
+    return {
+      ok: false,
+      error: `Invalid value for ${optionName}: ${rawValue}. Expected one of: web, tui, both.`,
+    };
+  }
+  return {
+    ok: true,
+    value: normalized,
+  };
+}
+
 function supportsAnsi() {
   return Boolean(process.stdout.isTTY && process.env.TERM !== 'dumb');
 }
@@ -623,6 +770,64 @@ function colorize(code, text) {
   return `${code}${text}\u001B[0m`;
 }
 
+function readCodexProviderMetadata(configDir, profile) {
+  const normalizedProfile = String(profile || '').trim();
+  const expandedDir = expandUserPath(configDir || path.join(os.homedir(), '.codex'));
+  const configPath = path.join(expandedDir, 'config.toml');
+  if (!normalizedProfile || !fs.existsSync(configPath)) {
+    return {
+      provider: null,
+      model: null,
+      envKey: null,
+      baseUrl: null,
+      wireApi: null,
+      requiresOpenAiAuth: null,
+    };
+  }
+  const text = fs.readFileSync(configPath, 'utf8');
+  const profileBlock = text.match(new RegExp(`\\[profiles\\.${normalizedProfile.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\$&')}\\]([\\s\\S]*?)(?:\\n\\[|$)`));
+  const provider = profileBlock?.[1]?.match(/^\s*model_provider\s*=\s*["']([^"']+)["']/m)?.[1]?.trim() || text.match(/^\s*model_provider\s*=\s*["']([^"']+)["']/m)?.[1]?.trim() || null;
+  const model = profileBlock?.[1]?.match(/^\s*model\s*=\s*["']([^"']+)["']/m)?.[1]?.trim() || text.match(/^\s*model\s*=\s*["']([^"']+)["']/m)?.[1]?.trim() || null;
+  if (!provider) {
+    return {
+      provider: null,
+      model,
+      envKey: null,
+      baseUrl: null,
+      wireApi: null,
+      requiresOpenAiAuth: null,
+    };
+  }
+  const providerBlock = text.match(new RegExp(`\\[model_providers\\.${provider.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\$&')}\\]([\\s\\S]*?)(?:\\n\\[|$)`));
+  const providerText = providerBlock?.[1] || '';
+  const envKey = providerText.match(/^\s*env_key\s*=\s*["']([^"']+)["']/m)?.[1]?.trim() || null;
+  const baseUrl = providerText.match(/^\s*base_url\s*=\s*["']([^"']+)["']/m)?.[1]?.trim() || null;
+  const wireApi = providerText.match(/^\s*wire_api\s*=\s*["']([^"']+)["']/m)?.[1]?.trim() || null;
+  const requiresOpenAiAuthRaw = providerText.match(/^\s*requires_openai_auth\s*=\s*(true|false)\s*$/m)?.[1] || null;
+  const requiresOpenAiAuth = requiresOpenAiAuthRaw === null ? null : requiresOpenAiAuthRaw === 'true';
+  return {
+    provider,
+    model,
+    envKey,
+    baseUrl,
+    wireApi,
+    requiresOpenAiAuth,
+  };
+}
+
+function installedCodexCliVersion(binaryPath) {
+  const resolved = resolveExecutableOnPath(binaryPath || 'codex') || binaryPath || 'codex';
+  try {
+    const result = spawnSync(resolved, ['--version'], syncSpawnOptions({ encoding: 'utf8' }));
+    if (result.status !== 0) {
+      return null;
+    }
+    return parseCodexCliVersion(`${result.stdout || ''}\n${result.stderr || ''}`);
+  } catch {
+    return null;
+  }
+}
+
 const OFFICIAL_REPOSITORY_URL = 'https://github.com/ResearAI/DeepScientist';
 
 function officialRepositoryLine() {
@@ -685,7 +890,7 @@ function pythonVersionText(probe) {
   return version;
 }
 
-function renderLaunchHints({ home, url, bindUrl, pythonSelection, yolo }) {
+function renderLaunchHints({ home, url, bindUrl, pythonSelection, yolo, authEnabled, authToken }) {
   const runtimeRows = [
     ['Version', packageJson.version],
     ['Home', truncateMiddle(home)],
@@ -694,6 +899,9 @@ function renderLaunchHints({ home, url, bindUrl, pythonSelection, yolo }) {
     ['Python', truncateMiddle(pythonVersionText(pythonSelection))],
     ['Codex mode', yolo ? 'YOLO (never + danger-full-access)' : 'Default (on-request + workspace-write)'],
   ];
+  if (authEnabled && authToken) {
+    runtimeRows.splice(4, 0, ['Auth token', authToken]);
+  }
   if (pythonSelection && pythonSelection.sourceLabel) {
     runtimeRows.push(['Python source', pythonSelection.sourceLabel]);
   }
@@ -706,6 +914,7 @@ function renderLaunchHints({ home, url, bindUrl, pythonSelection, yolo }) {
     ['ds --yolo --port 20999 --here', 'Start in ./DeepScientist under the current directory with YOLO Codex access'],
     ['ds --port 21000', 'Change the web port'],
     ['ds --host 0.0.0.0 --port 21000', 'Bind on all interfaces'],
+    ['ds --auth true', 'Enable the local browser password for this launch'],
     ['ds --here', 'Use ./DeepScientist under the current directory as home'],
     ['ds --both', 'Start web + TUI together'],
     ['ds --tui', 'Start the terminal workspace only'],
@@ -729,6 +938,8 @@ function printLaunchCard({
   home,
   pythonSelection,
   yolo,
+  authEnabled,
+  authToken,
 }) {
   const width = Math.max(72, Math.min(process.stdout.columns || 100, 108));
   const divider = colorize('\u001B[38;5;245m', '─'.repeat(Math.max(36, width - 6)));
@@ -787,13 +998,18 @@ function printLaunchCard({
   console.log(centerText(colorize('\u001B[1m', workspaceMode), width));
   console.log(centerText(urlLabel, width));
   console.log(centerText(divider, width));
+  if (authEnabled && authToken) {
+    console.log('');
+    console.log(centerText(colorize('\u001B[1;38;5;214m', authToken), width));
+    console.log('');
+  }
   console.log(centerText(browserLine, width));
   console.log(centerText(nextStep, width));
   console.log(centerText('Run ds --stop to stop the managed daemon.', width));
   console.log(centerText('Need to move this installation later? Use ds migrate /new/path.', width));
   console.log(centerText(officialRepositoryLine(), width));
   console.log('');
-  renderLaunchHints({ home, url, bindUrl, pythonSelection, yolo });
+  renderLaunchHints({ home, url, bindUrl, pythonSelection, yolo, authEnabled, authToken });
 }
 
 function escapeHtml(value) {
@@ -816,10 +1032,10 @@ function writeCodexPreflightReport(home, probe) {
   const profile = typeof details.profile === 'string' ? details.profile.trim() : '';
   const intro = profile
     ? `DeepScientist blocked startup because the Codex hello probe did not pass for profile \`${profile}\`. Verify that \`codex --profile ${profile}\` works on this machine and that the profile's provider-specific API key, Base URL, and model configuration are already set up.`
-    : 'DeepScientist blocked startup because the Codex hello probe did not pass. In most installs, `npm install -g @researai/deepscientist` also installs the bundled Codex dependency. If `codex` is still missing, repair it with `npm install -g @openai/codex`. Then run `codex --login` (or `codex`), finish authentication, run `ds doctor`, and launch `ds` again.';
+    : 'DeepScientist blocked startup because the Codex hello probe did not pass. In most installs, `npm install -g @researai/deepscientist` also installs the bundled Codex dependency. If `codex` is still missing, repair it with `npm install -g @openai/codex`. Then run `codex login` (or just `codex`), finish authentication, run `ds doctor`, and launch `ds` again.';
   const introZh = profile
     ? `DeepScientist 启动前进行了 Codex 可用性检查，但 profile \`${profile}\` 的 hello 探测没有通过。请先确认 \`codex --profile ${profile}\` 在当前机器上可以正常启动，并确保该 profile 依赖的 provider API Key、Base URL 和模型配置都已经在 Codex 中配置好。`
-    : 'DeepScientist 启动前进行了 Codex 可用性检查，但 hello 探测没有通过。正常情况下，`npm install -g @researai/deepscientist` 也会一并安装 bundled Codex 依赖；如果此后 `codex` 仍不可用，请再执行 `npm install -g @openai/codex` 修复。然后运行 `codex --login`（或 `codex`）完成认证，再执行 `ds doctor`，最后重新启动 `ds`。';
+    : 'DeepScientist 启动前进行了 Codex 可用性检查，但 hello 探测没有通过。正常情况下，`npm install -g @researai/deepscientist` 也会一并安装 bundled Codex 依赖；如果此后 `codex` 仍不可用，请再执行 `npm install -g @openai/codex` 修复。然后运行 `codex login`（或直接运行 `codex`）完成认证，再执行 `ds doctor`，最后重新启动 `ds`。';
   const renderItems = (items, tone) =>
     items
       .map(
@@ -1020,6 +1236,7 @@ function parseLauncherArgs(argv) {
   let daemonOnly = false;
   let skipUpdateCheck = false;
   let yolo = true;
+  let auth = null;
   let codexProfile = null;
   let codexBinary = null;
 
@@ -1040,21 +1257,71 @@ function parseLauncherArgs(argv) {
     else if (arg === '--open-browser') openBrowser = true;
     else if (arg === '--daemon-only') daemonOnly = true;
     else if (arg === '--skip-update-check') skipUpdateCheck = true;
+    else if (arg === '--here') continue;
     else {
       const parsedYolo = parseYoloArg(args, index, yolo);
       if (parsedYolo.matched) {
         yolo = parsedYolo.value;
         index += Math.max(0, parsedYolo.consumed - 1);
-      } else if (arg === '--codex-profile' && args[index + 1]) codexProfile = args[++index];
-      else if (arg === '--codex' && args[index + 1]) codexBinary = args[++index];
-      else if (arg === '--host' && args[index + 1]) host = args[++index];
-      else if (arg === '--port' && args[index + 1]) port = Number(args[++index]);
-      else if (arg === '--home' && args[index + 1]) home = path.resolve(args[++index]);
-      else if (arg === '--proxy' && args[index + 1]) proxy = args[++index];
-      else if (arg === '--quest-id' && args[index + 1]) questId = args[++index];
-      else if (arg === '--mode' && args[index + 1]) mode = normalizeMode(args[++index]);
+      } else if (arg === '--auth') {
+        const next = readRequiredOptionValue(args, index, '--auth');
+        if (!next.ok) return { help: false, error: next.error };
+        const parsed = parseStrictBooleanOption(next.value, '--auth');
+        if (!parsed.ok) return { help: false, error: parsed.error };
+        auth = parsed.value;
+        index += 1;
+      } else if (typeof arg === 'string' && arg.startsWith('--auth=')) {
+        const parsed = parseStrictBooleanOption(arg.slice('--auth='.length), '--auth');
+        if (!parsed.ok) return { help: false, error: parsed.error };
+        auth = parsed.value;
+      } else if (arg === '--codex-profile') {
+        const next = readRequiredOptionValue(args, index, '--codex-profile');
+        if (!next.ok) return { help: false, error: next.error };
+        codexProfile = next.value;
+        index += 1;
+      } else if (arg === '--codex') {
+        const next = readRequiredOptionValue(args, index, '--codex');
+        if (!next.ok) return { help: false, error: next.error };
+        codexBinary = next.value;
+        index += 1;
+      } else if (arg === '--host') {
+        const next = readRequiredOptionValue(args, index, '--host');
+        if (!next.ok) return { help: false, error: next.error };
+        host = next.value;
+        index += 1;
+      } else if (arg === '--port') {
+        const next = readRequiredOptionValue(args, index, '--port');
+        if (!next.ok) return { help: false, error: next.error };
+        const parsed = parseStrictPortOption(next.value, '--port');
+        if (!parsed.ok) return { help: false, error: parsed.error };
+        port = parsed.value;
+        index += 1;
+      } else if (arg === '--home') {
+        const next = readRequiredOptionValue(args, index, '--home');
+        if (!next.ok) return { help: false, error: next.error };
+        home = path.resolve(next.value);
+        index += 1;
+      } else if (arg === '--proxy') {
+        const next = readRequiredOptionValue(args, index, '--proxy');
+        if (!next.ok) return { help: false, error: next.error };
+        proxy = next.value;
+        index += 1;
+      } else if (arg === '--quest-id') {
+        const next = readRequiredOptionValue(args, index, '--quest-id');
+        if (!next.ok) return { help: false, error: next.error };
+        questId = next.value;
+        index += 1;
+      } else if (arg === '--mode') {
+        const next = readRequiredOptionValue(args, index, '--mode');
+        if (!next.ok) return { help: false, error: next.error };
+        const parsed = parseStrictModeOption(next.value, '--mode');
+        if (!parsed.ok) return { help: false, error: parsed.error };
+        mode = parsed.value;
+        index += 1;
+      }
       else if (arg === '--help' || arg === '-h') return { help: true };
-      else if (!arg.startsWith('--')) return null;
+      else if (arg.startsWith('--')) return { help: false, error: `Unknown launcher flag: ${arg}` };
+      else return { help: false, error: `Unexpected launcher argument: ${arg}` };
     }
   }
 
@@ -1073,8 +1340,10 @@ function parseLauncherArgs(argv) {
     daemonOnly,
     skipUpdateCheck,
     yolo,
+    auth,
     codexProfile,
     codexBinary,
+    error: null,
   };
 }
 
@@ -1116,6 +1385,26 @@ Flags:
 `);
 }
 
+function printUninstallHelp() {
+  console.log(`DeepScientist uninstall
+
+Usage:
+  ds uninstall
+  ds uninstall --home /absolute/home/path
+  ds uninstall --yes
+
+Behavior:
+  - removes DeepScientist code, launcher wrappers, and local runtime code
+  - preserves local data such as quests, memory, config, logs, plugins, and cache
+  - if this command is run from the globally installed npm package, it also removes the npm package itself
+
+Flags:
+  --yes              Skip the interactive confirmation prompt
+  --home <path>      Override the target DeepScientist home/root
+  --origin <value>   Internal use for npm uninstall integration
+`);
+}
+
 function parseUpdateArgs(argv) {
   const args = [...argv];
   if (args[0] === 'update') {
@@ -1148,12 +1437,32 @@ function parseUpdateArgs(argv) {
     else if (arg === '--worker') worker = true;
     else if (arg === '--restart-daemon') restartDaemon = true;
     else if (arg === '--skip-update-check') skipUpdateCheck = true;
-    else if (arg === '--home' && args[index + 1]) home = path.resolve(args[++index]);
-    else if (arg === '--host' && args[index + 1]) host = args[++index];
-    else if (arg === '--port' && args[index + 1]) port = Number(args[++index]);
-    else if (arg === '--proxy' && args[index + 1]) proxy = args[++index];
+    else if (arg === '--home') {
+      const next = readRequiredOptionValue(args, index, '--home');
+      if (!next.ok) return { help: false, error: next.error };
+      home = path.resolve(next.value);
+      index += 1;
+    } else if (arg === '--host') {
+      const next = readRequiredOptionValue(args, index, '--host');
+      if (!next.ok) return { help: false, error: next.error };
+      host = next.value;
+      index += 1;
+    } else if (arg === '--port') {
+      const next = readRequiredOptionValue(args, index, '--port');
+      if (!next.ok) return { help: false, error: next.error };
+      const parsed = parseStrictPortOption(next.value, '--port');
+      if (!parsed.ok) return { help: false, error: parsed.error };
+      port = parsed.value;
+      index += 1;
+    } else if (arg === '--proxy') {
+      const next = readRequiredOptionValue(args, index, '--proxy');
+      if (!next.ok) return { help: false, error: next.error };
+      proxy = next.value;
+      index += 1;
+    }
     else if (arg === '--help' || arg === '-h') return { help: true };
-    else if (!arg.startsWith('--')) return null;
+    else if (arg.startsWith('--')) return { help: false, error: `Unknown update flag: ${arg}` };
+    else return { help: false, error: `Unexpected update argument: ${arg}` };
   }
 
   return {
@@ -1172,6 +1481,7 @@ function parseUpdateArgs(argv) {
     proxy,
     restartDaemon,
     skipUpdateCheck,
+    error: null,
   };
 }
 
@@ -1189,15 +1499,23 @@ function parseMigrateArgs(argv) {
     const arg = args[index];
     if (arg === '--yes') yes = true;
     else if (arg === '--restart') restart = true;
-    else if (arg === '--home' && args[index + 1]) home = path.resolve(expandUserPath(args[++index]));
+    else if (arg === '--home') {
+      const next = readRequiredOptionValue(args, index, '--home');
+      if (!next.ok) return { help: false, error: next.error };
+      home = path.resolve(expandUserPath(next.value));
+      index += 1;
+    }
     else if (arg === '--help' || arg === '-h') return { help: true };
-    else if (arg.startsWith('--')) return null;
+    else if (arg.startsWith('--')) return { help: false, error: `Unknown migrate flag: ${arg}` };
     else if (!target) target = path.resolve(expandUserPath(arg));
-    else return null;
+    else return { help: false, error: `Unexpected migrate argument: ${arg}` };
   }
 
   if (!target) {
-    return null;
+    return {
+      help: false,
+      error: 'Missing migration target path.',
+    };
   }
 
   return {
@@ -1206,6 +1524,44 @@ function parseMigrateArgs(argv) {
     target,
     yes,
     restart,
+    error: null,
+  };
+}
+
+function parseUninstallArgs(argv) {
+  const args = [...argv];
+  if (args[0] === 'uninstall') {
+    args.shift();
+  }
+  let home = null;
+  let yes = false;
+  let origin = null;
+
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === '--yes') yes = true;
+    else if (arg === '--home') {
+      const next = readRequiredOptionValue(args, index, '--home');
+      if (!next.ok) return { help: false, error: next.error };
+      home = path.resolve(expandUserPath(next.value));
+      index += 1;
+    } else if (arg === '--origin') {
+      const next = readRequiredOptionValue(args, index, '--origin');
+      if (!next.ok) return { help: false, error: next.error };
+      origin = String(next.value || '').trim().toLowerCase() || null;
+      index += 1;
+    }
+    else if (arg === '--help' || arg === '-h') return { help: true };
+    else if (arg.startsWith('--')) return { help: false, error: `Unknown uninstall flag: ${arg}` };
+    else return { help: false, error: `Unexpected uninstall argument: ${arg}` };
+  }
+
+  return {
+    help: false,
+    home,
+    yes,
+    origin,
+    error: null,
   };
 }
 
@@ -2152,13 +2508,34 @@ function ensureUvBinary(home) {
 }
 
 function buildUvRuntimeEnv(home, extraEnv = {}) {
-  return {
+  const env = {
     ...process.env,
     UV_CACHE_DIR: runtimeUvCachePath(home),
     UV_PROJECT_ENVIRONMENT: runtimePythonEnvPath(home),
     UV_PYTHON_INSTALL_DIR: runtimeUvPythonInstallPath(home),
     ...extraEnv,
   };
+  for (const key of ['PYTHONPATH', 'PYTHONHOME', 'VIRTUAL_ENV', '__PYVENV_LAUNCHER__']) {
+    delete env[key];
+  }
+  for (const key of Object.keys(env)) {
+    if (key === 'CONDA_EXE' || key === 'CONDA_PYTHON_EXE' || key === '_CE_CONDA' || key === '_CE_M') {
+      delete env[key];
+      continue;
+    }
+    if (key === 'MAMBA_EXE' || key === 'MAMBA_ROOT_PREFIX') {
+      delete env[key];
+      continue;
+    }
+    if (key === 'CONDA_PREFIX' || key === 'CONDA_DEFAULT_ENV' || key === 'CONDA_PROMPT_MODIFIER' || key === 'CONDA_SHLVL') {
+      delete env[key];
+      continue;
+    }
+    if (/^CONDA_PREFIX_\d+$/.test(key)) {
+      delete env[key];
+    }
+  }
+  return env;
 }
 
 function ensureUvLockPresent() {
@@ -2171,6 +2548,43 @@ function ensureUvLockPresent() {
   process.exit(1);
 }
 
+function buildUvSyncFailureGuidance({ installMode = detectInstallMode(repoRoot), env = process.env } = {}) {
+  const guidance = [];
+  if (installMode === 'source-checkout') {
+    guidance.push('If you changed Python dependencies in a source checkout, run `uv lock` and try again.');
+  } else {
+    guidance.push('This npm install already includes a locked `uv.lock`, so this is usually a local Python or network environment issue rather than a missing lockfile.');
+    guidance.push('Re-run `ds` in a clean shell first. If you have an active conda or virtualenv, try deactivating it before starting DeepScientist.');
+  }
+
+  const hasPythonEnv =
+    Boolean(String(env.VIRTUAL_ENV || '').trim())
+    || Boolean(String(env.CONDA_PREFIX || '').trim())
+    || Boolean(String(env.PYTHONPATH || '').trim())
+    || Boolean(String(env.PYTHONHOME || '').trim());
+  if (hasPythonEnv) {
+    guidance.push('An active Python environment was detected. `VIRTUAL_ENV`, `CONDA_PREFIX`, `PYTHONPATH`, or `PYTHONHOME` can interfere with uv runtime bootstrap.');
+  }
+
+  const hasCustomIndex =
+    Object.keys(env).some((key) => /^PIP_/i.test(key))
+    || Boolean(String(env.UV_INDEX_URL || '').trim())
+    || Boolean(String(env.UV_EXTRA_INDEX_URL || '').trim());
+  if (hasCustomIndex) {
+    guidance.push('Custom package index settings were detected. Check `PIP_*`, `UV_INDEX_URL`, or `UV_EXTRA_INDEX_URL` if uv could not download packages.');
+  }
+
+  const hasProxyOrCert =
+    ['HTTP_PROXY', 'HTTPS_PROXY', 'ALL_PROXY', 'http_proxy', 'https_proxy', 'all_proxy', 'SSL_CERT_FILE', 'REQUESTS_CA_BUNDLE']
+      .some((key) => Boolean(String(env[key] || '').trim()));
+  if (hasProxyOrCert) {
+    guidance.push('Proxy or certificate overrides were detected. If uv reported TLS, certificate, or download errors above, verify those settings and try again.');
+  }
+
+  guidance.push('Look at the uv error printed above this message. That original uv output is the real failure reason.');
+  return guidance;
+}
+
 function resolveUvVersion(uvBinary) {
   const result = runSync(uvBinary, ['--version'], { capture: true, allowFailure: true });
   if (result.status !== 0) {
@@ -2237,7 +2651,10 @@ function resolveBackgroundPythonExecutable(runtimePython) {
 }
 
 function syncUvProjectEnvironment(home, uvBinary, pythonTarget, editable) {
-  const args = ['sync', '--frozen', '--no-dev', '--compile-bytecode', '--python', pythonTarget];
+  const args = ['sync', '--frozen', '--no-dev', '--python', pythonTarget];
+  if (shouldCompileRuntimeBytecode()) {
+    args.splice(3, 0, '--compile-bytecode');
+  }
   if (!editable) {
     args.push('--no-editable');
   }
@@ -2250,7 +2667,9 @@ function syncUvProjectEnvironment(home, uvBinary, pythonTarget, editable) {
     return;
   }
   console.error('DeepScientist could not sync the locked Python environment with uv.');
-  console.error('If you are working from a source checkout, run `uv lock` after dependency changes and try again.');
+  for (const line of buildUvSyncFailureGuidance()) {
+    console.error(line);
+  }
   process.exit(result.status ?? 1);
 }
 
@@ -2629,6 +3048,374 @@ function removeDaemonState(home) {
   }
 }
 
+function installIndexPath() {
+  return path.join(os.homedir(), '.deepscientist', 'install-index.json');
+}
+
+function readInstallIndex() {
+  const indexPath = installIndexPath();
+  if (!fs.existsSync(indexPath)) {
+    return { installs: [] };
+  }
+  try {
+    const payload = JSON.parse(fs.readFileSync(indexPath, 'utf8'));
+    const installs = Array.isArray(payload?.installs) ? payload.installs.filter((item) => item && typeof item === 'object') : [];
+    return { installs };
+  } catch {
+    return { installs: [] };
+  }
+}
+
+function writeInstallIndex(payload) {
+  const normalized = {
+    installs: Array.isArray(payload?.installs) ? payload.installs : [],
+  };
+  const targetPath = installIndexPath();
+  ensureDir(path.dirname(targetPath));
+  fs.writeFileSync(targetPath, `${JSON.stringify(normalized, null, 2)}\n`, 'utf8');
+}
+
+function normalizeInstallRecord(record) {
+  const normalizedHome = normalizeHomePath(record?.home || '');
+  if (!normalizedHome) {
+    return null;
+  }
+  const installMode = String(record?.install_mode || '').trim() || null;
+  const installDir = record?.install_dir ? normalizeHomePath(record.install_dir) : null;
+  const packageRoot = record?.package_root ? normalizeHomePath(record.package_root) : null;
+  const launcherPath = record?.launcher_path ? path.resolve(String(record.launcher_path)) : null;
+  const wrapperPaths = Array.isArray(record?.wrapper_paths)
+    ? [...new Set(record.wrapper_paths.map((item) => String(item || '').trim()).filter(Boolean).map((item) => path.resolve(item)))]
+    : [];
+  const createdAt = String(record?.created_at || '').trim() || new Date().toISOString();
+  return {
+    home: normalizedHome,
+    install_mode: installMode,
+    install_dir: installDir,
+    package_root: packageRoot,
+    launcher_path: launcherPath,
+    wrapper_paths: wrapperPaths,
+    created_at: createdAt,
+    updated_at: new Date().toISOString(),
+  };
+}
+
+function installRecordMatches(left, right) {
+  return left.home === right.home
+    && (left.install_dir || null) === (right.install_dir || null)
+    && (left.package_root || null) === (right.package_root || null)
+    && (left.install_mode || null) === (right.install_mode || null);
+}
+
+function upsertInstallRecord(record) {
+  const normalized = normalizeInstallRecord(record);
+  if (!normalized) {
+    return null;
+  }
+  const index = readInstallIndex();
+  const installs = index.installs
+    .map((item) => normalizeInstallRecord(item))
+    .filter(Boolean);
+  const nextInstalls = installs.filter((item) => !installRecordMatches(item, normalized));
+  nextInstalls.push(normalized);
+  nextInstalls.sort((left, right) => String(left.updated_at || '').localeCompare(String(right.updated_at || '')));
+  writeInstallIndex({ installs: nextInstalls });
+  return normalized;
+}
+
+function removeInstallRecords(predicate) {
+  const index = readInstallIndex();
+  const installs = index.installs
+    .map((item) => normalizeInstallRecord(item))
+    .filter(Boolean);
+  const nextInstalls = installs.filter((item) => !predicate(item));
+  writeInstallIndex({ installs: nextInstalls });
+  return nextInstalls;
+}
+
+function parseManagedWrapperCandidate(candidatePath) {
+  let stat = null;
+  try {
+    stat = fs.lstatSync(candidatePath);
+  } catch {
+    return null;
+  }
+
+  if (!stat.isFile() && !stat.isSymbolicLink()) {
+    return null;
+  }
+
+  let text = '';
+  try {
+    text = fs.readFileSync(candidatePath, 'utf8');
+  } catch {
+    return null;
+  }
+
+  const homeMatch = text.match(/export DEEPSCIENTIST_HOME="([^"\n]+)"/);
+  const execMatch = text.match(/exec "([^"\n]+)" "\$@"/);
+  return {
+    path: path.resolve(candidatePath),
+    home: homeMatch ? normalizeHomePath(homeMatch[1]) : null,
+    execPath: execMatch ? path.resolve(execMatch[1]) : null,
+  };
+}
+
+function collectManagedWrapperPaths({ home, installDir = null, explicitWrapperPaths = [] }) {
+  const normalizedHome = normalizeHomePath(home);
+  const normalizedInstallDir = installDir ? normalizeHomePath(installDir) : null;
+  const candidates = new Set(explicitWrapperPaths.map((item) => path.resolve(String(item))));
+  for (const commandName of launcherWrapperCommands) {
+    for (const candidate of candidateWrapperPathsForCommand(commandName)) {
+      candidates.add(candidate);
+    }
+  }
+  const matched = [];
+  for (const candidate of candidates) {
+    const parsed = parseManagedWrapperCandidate(candidate);
+    if (!parsed) {
+      continue;
+    }
+    if (parsed.home && parsed.home === normalizedHome) {
+      matched.push(parsed.path);
+      continue;
+    }
+    if (normalizedInstallDir && parsed.execPath && parsed.execPath.startsWith(path.join(normalizedInstallDir, 'bin'))) {
+      matched.push(parsed.path);
+    }
+  }
+  return [...new Set(matched)].sort();
+}
+
+function buildCodeOnlyUninstallPlan({ home, installDir = null, wrapperPaths = [] }) {
+  const normalizedHome = normalizeHomePath(home);
+  const normalizedInstallDir = installDir ? normalizeHomePath(installDir) : null;
+  const removePaths = [
+    path.join(normalizedHome, 'runtime', 'python-env'),
+    path.join(normalizedHome, 'runtime', 'python'),
+    path.join(normalizedHome, 'runtime', 'tools'),
+    path.join(normalizedHome, 'runtime', 'bundle'),
+    path.join(normalizedHome, 'runtime', 'daemon.json'),
+  ];
+  if (normalizedInstallDir && normalizedInstallDir !== normalizeHomePath(repoRoot)) {
+    removePaths.push(normalizedInstallDir);
+  }
+  return {
+    remove_paths: [...new Set(removePaths.map((item) => path.resolve(item)))].sort(),
+    preserve_paths: [
+      path.join(normalizedHome, 'quests'),
+      path.join(normalizedHome, 'memory'),
+      path.join(normalizedHome, 'config'),
+      path.join(normalizedHome, 'logs'),
+      path.join(normalizedHome, 'plugins'),
+      path.join(normalizedHome, 'cache'),
+    ].sort(),
+    wrapper_paths: [...new Set(wrapperPaths.map((item) => path.resolve(item)))].sort(),
+  };
+}
+
+function removePathEntry(targetPath) {
+  if (!targetPath || !fs.existsSync(targetPath)) {
+    return false;
+  }
+  const stat = fs.lstatSync(targetPath);
+  if (stat.isDirectory() && !stat.isSymbolicLink()) {
+    fs.rmSync(targetPath, { recursive: true, force: true });
+    return true;
+  }
+  fs.rmSync(targetPath, { force: true });
+  return true;
+}
+
+function currentInstallRecord(home) {
+  const installMode = detectInstallMode(repoRoot);
+  return normalizeInstallRecord({
+    home,
+    install_mode: installMode,
+    install_dir: installMode === 'source-checkout' ? null : null,
+    package_root: normalizeHomePath(repoRoot),
+    launcher_path: resolveLauncherPath() || path.join(repoRoot, 'bin', 'ds.js'),
+    wrapper_paths: [],
+  });
+}
+
+function registerCurrentInstall(home) {
+  const record = currentInstallRecord(home);
+  if (!record) {
+    return null;
+  }
+  return upsertInstallRecord(record);
+}
+
+function dedupeUninstallRecords(records) {
+  const seen = new Set();
+  const deduped = [];
+  for (const record of records) {
+    const normalized = normalizeInstallRecord(record);
+    if (!normalized) {
+      continue;
+    }
+    const key = JSON.stringify([
+      normalized.home,
+      normalized.install_mode || null,
+      normalized.install_dir || null,
+      normalized.package_root || null,
+    ]);
+    if (seen.has(key)) {
+      continue;
+    }
+    seen.add(key);
+    deduped.push(normalized);
+  }
+  return deduped;
+}
+
+function resolveUninstallRecords({ home, origin }) {
+  const normalizedHome = normalizeHomePath(home);
+  const currentPackageRoot = normalizeHomePath(repoRoot);
+  const index = readInstallIndex();
+  const installs = index.installs.map((item) => normalizeInstallRecord(item)).filter(Boolean);
+  if (origin === 'npm') {
+    const matching = installs.filter((item) => item.package_root === currentPackageRoot);
+    if (matching.length > 0) {
+      return dedupeUninstallRecords(matching);
+    }
+    return dedupeUninstallRecords([currentInstallRecord(normalizedHome)]);
+  }
+  const matching = installs.filter((item) => item.home === normalizedHome);
+  if (matching.length > 0) {
+    return dedupeUninstallRecords(matching);
+  }
+  const inferredInstallDir = fs.existsSync(path.join(normalizedHome, 'cli')) ? path.join(normalizedHome, 'cli') : null;
+  return dedupeUninstallRecords([
+    {
+      ...currentInstallRecord(normalizedHome),
+      install_dir: inferredInstallDir,
+    },
+  ]);
+}
+
+function aggregateCodeOnlyUninstallPlan(records) {
+  const removePaths = new Set();
+  const preservePaths = new Set();
+  const wrapperPaths = new Set();
+  for (const record of records) {
+    const installDir = record.install_dir || (fs.existsSync(path.join(record.home, 'cli')) ? path.join(record.home, 'cli') : null);
+    const matchedWrappers = collectManagedWrapperPaths({
+      home: record.home,
+      installDir,
+      explicitWrapperPaths: record.wrapper_paths || [],
+    });
+    const plan = buildCodeOnlyUninstallPlan({
+      home: record.home,
+      installDir,
+      wrapperPaths: matchedWrappers,
+    });
+    for (const targetPath of plan.remove_paths) removePaths.add(targetPath);
+    for (const targetPath of plan.preserve_paths) preservePaths.add(targetPath);
+    for (const targetPath of plan.wrapper_paths) wrapperPaths.add(targetPath);
+  }
+  return {
+    remove_paths: [...removePaths].sort(),
+    preserve_paths: [...preservePaths].sort(),
+    wrapper_paths: [...wrapperPaths].sort(),
+  };
+}
+
+async function promptUninstallConfirmation({ records, plan }) {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    throw new Error('DeepScientist uninstall needs a TTY for confirmation. Re-run with `--yes` to continue non-interactively.');
+  }
+  console.log('');
+  console.log('DeepScientist uninstall');
+  console.log('');
+  console.log('This removes code and runtime directories, but preserves local data.');
+  console.log('');
+  for (const record of records) {
+    console.log(`Home: ${record.home}`);
+  }
+  console.log('');
+  console.log('Code/runtime paths to remove:');
+  for (const targetPath of plan.remove_paths) {
+    console.log(`- ${targetPath}`);
+  }
+  console.log('');
+  console.log('Preserved data paths:');
+  for (const targetPath of plan.preserve_paths) {
+    console.log(`- ${targetPath}`);
+  }
+  const answer = await new Promise((resolve) => {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    rl.question('Type UNINSTALL to continue: ', (value) => {
+      rl.close();
+      resolve(String(value || '').trim());
+    });
+  });
+  return answer === 'UNINSTALL';
+}
+
+function runGlobalNpmUninstall() {
+  const configuredPrefix = String(process.env.npm_config_prefix || process.env.NPM_CONFIG_PREFIX || '').trim();
+  let uninstallPrefix = configuredPrefix || null;
+  if (!uninstallPrefix && detectInstallMode(repoRoot) === 'npm-package') {
+    let cursor = path.resolve(repoRoot);
+    while (cursor && cursor !== path.dirname(cursor)) {
+      if (path.basename(cursor) === 'node_modules') {
+        const container = path.dirname(cursor);
+        uninstallPrefix =
+          path.basename(container) === 'lib'
+            ? path.dirname(container)
+            : container;
+        break;
+      }
+      cursor = path.dirname(cursor);
+    }
+  }
+  const npmBinary =
+    resolveExecutableOnPath(process.platform === 'win32' ? 'npm.cmd' : 'npm')
+    || resolveExecutableOnPath('npm');
+  if (!npmBinary) {
+    return {
+      ok: false,
+      message: 'Global npm package removal was skipped because `npm` is not available on PATH.',
+    };
+  }
+  const result = spawnSync(
+    npmBinary,
+    ['uninstall', '-g', UPDATE_PACKAGE_NAME, ...(uninstallPrefix ? ['--prefix', uninstallPrefix] : [])],
+    syncSpawnOptions({
+      stdio: 'inherit',
+      env: process.env,
+    })
+  );
+  if (result.error) {
+    return {
+      ok: false,
+      message: result.error.message,
+    };
+  }
+  return {
+    ok: result.status === 0,
+    message: result.status === 0 ? null : `npm uninstall exited with status ${result.status ?? 1}.`,
+  };
+}
+
+function buildDaemonStatusPayload({ home, url, state, health, launcherPath = null }) {
+  const healthy = Boolean(health && health.status === 'ok');
+  const identityMatch = state ? healthMatchesManagedState({ health, state, home }) : false;
+  return {
+    healthy,
+    identity_match: identityMatch,
+    managed: Boolean(state),
+    home,
+    url,
+    daemon_state_path: daemonStatePath(home),
+    launcher_path: launcherPath || resolveLauncherPath() || null,
+    daemon: state,
+    health,
+  };
+}
+
 function daemonSupervisorLogPath(home) {
   return path.join(home, 'logs', 'daemon-supervisor.log');
 }
@@ -2678,9 +3465,25 @@ function decodeSupervisorEnvPayload(rawValue) {
   }
 }
 
-function spawnManagedDaemonProcess({ home, runtimePython, host, port, proxy = null, envOverrides = {}, daemonId = null }) {
+function spawnManagedDaemonProcess({
+  home,
+  runtimePython,
+  host,
+  port,
+  proxy = null,
+  envOverrides = {},
+  daemonId = null,
+  authEnabled = false,
+  authToken = null,
+}) {
   const browserUrl = browserUiUrl(host, port);
   const daemonBindUrl = bindUiUrl(host, port);
+  const resolvedAuthEnabled = authEnabled !== false;
+  const resolvedAuthToken = resolvedAuthEnabled
+    ? (typeof authToken === 'string' && authToken.trim() ? authToken.trim() : generateBrowserAuthToken())
+    : null;
+  const launchUrl = browserUrl;
+  const bindLaunchUrl = daemonBindUrl;
   const logPath = path.join(home, 'logs', 'daemon.log');
   ensureDir(path.dirname(logPath));
   const out = fs.openSync(logPath, 'a');
@@ -2700,6 +3503,9 @@ function spawnManagedDaemonProcess({ home, runtimePython, host, port, proxy = nu
       host,
       '--port',
       String(port),
+      '--auth',
+      resolvedAuthEnabled ? 'true' : 'false',
+      ...(resolvedAuthEnabled && resolvedAuthToken ? ['--auth-token', resolvedAuthToken] : []),
     ],
     detachedSpawnOptions({
       cwd: repoRoot,
@@ -2712,6 +3518,8 @@ function spawnManagedDaemonProcess({ home, runtimePython, host, port, proxy = nu
         DEEPSCIENTIST_LAUNCHER_PATH: launcherPath,
         DS_DAEMON_ID: resolvedDaemonId,
         DS_DAEMON_MANAGED_BY: 'ds-launcher',
+        DS_UI_AUTH_ENABLED: resolvedAuthEnabled ? '1' : '0',
+        ...(resolvedAuthEnabled && resolvedAuthToken ? { DS_UI_AUTH_TOKEN: resolvedAuthToken } : {}),
       },
     })
   );
@@ -2722,10 +3530,14 @@ function spawnManagedDaemonProcess({ home, runtimePython, host, port, proxy = nu
     port,
     url: browserUrl,
     bind_url: daemonBindUrl,
+    launch_url: launchUrl,
+    bind_launch_url: bindLaunchUrl,
     log_path: logPath,
     started_at: new Date().toISOString(),
     home: normalizeHomePath(home),
     daemon_id: resolvedDaemonId,
+    auth_enabled: resolvedAuthEnabled,
+    auth_token: resolvedAuthToken,
   };
   writeDaemonState(home, statePayload);
   return {
@@ -2733,6 +3545,8 @@ function spawnManagedDaemonProcess({ home, runtimePython, host, port, proxy = nu
     statePayload,
     browserUrl,
     bindUrl: daemonBindUrl,
+    launchUrl,
+    bindLaunchUrl,
     logPath,
   };
 }
@@ -2787,19 +3601,54 @@ function parseDaemonSupervisorArgs(argv) {
 
   for (let index = 0; index < args.length; index += 1) {
     const arg = args[index];
-    if (arg === '--home' && args[index + 1]) home = path.resolve(args[++index]);
-    else if (arg === '--runtime-python' && args[index + 1]) runtimePython = args[++index];
-    else if (arg === '--host' && args[index + 1]) host = args[++index];
-    else if (arg === '--port' && args[index + 1]) port = Number(args[++index]);
-    else if (arg === '--proxy' && args[index + 1]) proxy = args[++index];
-    else if (arg === '--daemon-id' && args[index + 1]) daemonId = args[++index];
-    else if (arg === '--env-json' && args[index + 1]) envJson = args[++index];
+    if (arg === '--home') {
+      const next = readRequiredOptionValue(args, index, '--home');
+      if (!next.ok) return { help: false, error: next.error };
+      home = path.resolve(next.value);
+      index += 1;
+    } else if (arg === '--runtime-python') {
+      const next = readRequiredOptionValue(args, index, '--runtime-python');
+      if (!next.ok) return { help: false, error: next.error };
+      runtimePython = next.value;
+      index += 1;
+    } else if (arg === '--host') {
+      const next = readRequiredOptionValue(args, index, '--host');
+      if (!next.ok) return { help: false, error: next.error };
+      host = next.value;
+      index += 1;
+    } else if (arg === '--port') {
+      const next = readRequiredOptionValue(args, index, '--port');
+      if (!next.ok) return { help: false, error: next.error };
+      const parsed = parseStrictPortOption(next.value, '--port');
+      if (!parsed.ok) return { help: false, error: parsed.error };
+      port = parsed.value;
+      index += 1;
+    } else if (arg === '--proxy') {
+      const next = readRequiredOptionValue(args, index, '--proxy');
+      if (!next.ok) return { help: false, error: next.error };
+      proxy = next.value;
+      index += 1;
+    } else if (arg === '--daemon-id') {
+      const next = readRequiredOptionValue(args, index, '--daemon-id');
+      if (!next.ok) return { help: false, error: next.error };
+      daemonId = next.value;
+      index += 1;
+    } else if (arg === '--env-json') {
+      const next = readRequiredOptionValue(args, index, '--env-json');
+      if (!next.ok) return { help: false, error: next.error };
+      envJson = next.value;
+      index += 1;
+    }
     else if (arg === '--help' || arg === '-h') return { help: true };
-    else return null;
+    else if (arg.startsWith('--')) return { help: false, error: `Unknown daemon supervisor flag: ${arg}` };
+    else return { help: false, error: `Unexpected daemon supervisor argument: ${arg}` };
   }
 
   if (!home || !runtimePython || !daemonId || !Number.isFinite(port) || port <= 0) {
-    return null;
+    return {
+      help: false,
+      error: 'Daemon supervisor requires --home, --runtime-python, --daemon-id, and a valid --port.',
+    };
   }
 
   return {
@@ -2811,18 +3660,19 @@ function parseDaemonSupervisorArgs(argv) {
     proxy,
     daemonId,
     envOverrides: decodeSupervisorEnvPayload(envJson),
+    error: null,
   };
 }
 
 async function daemonSupervisorMain(rawArgs) {
   const options = parseDaemonSupervisorArgs(rawArgs);
-  if (!options) {
-    console.error('Invalid daemon supervisor arguments.');
-    process.exit(1);
-  }
   if (options.help) {
     process.exit(0);
   }
+  if (options.error) {
+    console.error(options.error);
+    process.exit(1);
+  }
 
   const home = options.home;
   let trackedDaemonId = String(options.daemonId || '').trim();
@@ -2849,7 +3699,8 @@ async function daemonSupervisorMain(rawArgs) {
       appendDaemonSupervisorLog(home, `daemon id changed to ${stateDaemonId}; supervisor exiting`);
       return;
     }
-    const health = await fetchHealth(state.url || browserUiUrl(options.host, options.port));
+    const authToken = typeof state.auth_token === 'string' ? state.auth_token.trim() : '';
+    const health = await fetchHealth(state.url || browserUiUrl(options.host, options.port), authToken);
     if (health && health.status === 'ok' && healthMatchesManagedState({ health, state, home })) {
       restartBackoffMs = 1000;
       await sleep(2500);
@@ -2872,6 +3723,8 @@ async function daemonSupervisorMain(rawArgs) {
         port: options.port,
         proxy: options.proxy,
         envOverrides: options.envOverrides,
+        authEnabled: state.auth_enabled !== false,
+        authToken,
       });
       trackedDaemonId = String(restarted.statePayload.daemon_id || '').trim();
       observeManagedDaemonChild(home, restarted.child, trackedDaemonId);
@@ -2896,14 +3749,19 @@ function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
-async function isHealthy(url) {
-  const payload = await fetchHealth(url);
+async function isHealthy(url, authToken = null) {
+  const payload = await fetchHealth(url, authToken);
   return Boolean(payload && payload.status === 'ok');
 }
 
-async function fetchHealth(url) {
+async function fetchHealth(url, authToken = null) {
   try {
-    const response = await fetch(`${url}/api/health`);
+    const headers = {};
+    const normalizedAuthToken = typeof authToken === 'string' ? authToken.trim() : '';
+    if (normalizedAuthToken) {
+      headers.Authorization = `Bearer ${normalizedAuthToken}`;
+    }
+    const response = await fetch(`${url}/api/health`, { headers });
     if (!response.ok) {
       return null;
     }
@@ -2953,13 +3811,18 @@ function daemonIdentityError({ url, home, health, state }) {
   ].join('\n');
 }
 
-async function requestDaemonShutdown(url, daemonId) {
+async function requestDaemonShutdown(url, daemonId, authToken = null) {
   try {
+    const headers = {
+      'Content-Type': 'application/json',
+    };
+    const normalizedAuthToken = typeof authToken === 'string' ? authToken.trim() : '';
+    if (normalizedAuthToken) {
+      headers.Authorization = `Bearer ${normalizedAuthToken}`;
+    }
     const response = await fetch(`${url}/api/admin/shutdown`, {
       method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-      },
+      headers,
       body: JSON.stringify({ source: 'ds-launcher', daemon_id: daemonId || null }),
     });
     if (!response.ok) {
@@ -2972,6 +3835,31 @@ async function requestDaemonShutdown(url, daemonId) {
   }
 }
 
+async function requestDaemonAuthRotate(url, authToken = null) {
+  try {
+    const headers = {
+      'Content-Type': 'application/json',
+    };
+    const normalizedAuthToken = typeof authToken === 'string' ? authToken.trim() : '';
+    if (normalizedAuthToken) {
+      headers.Authorization = `Bearer ${normalizedAuthToken}`;
+    }
+    const response = await fetch(`${url}/api/auth/rotate`, {
+      method: 'POST',
+      headers,
+      body: '{}',
+    });
+    if (!response.ok) {
+      return null;
+    }
+    const payload = await response.json().catch(() => ({}));
+    const token = typeof payload?.token === 'string' ? payload.token.trim() : '';
+    return token || null;
+  } catch {
+    return null;
+  }
+}
+
 function isPidAlive(pid) {
   if (!pid) return false;
   try {
@@ -3005,9 +3893,9 @@ function killManagedProcess(pid, signal) {
   }
 }
 
-async function waitForDaemonStop({ url, pid, attempts = 20, delayMs = 200 }) {
+async function waitForDaemonStop({ url, pid, authToken = null, attempts = 20, delayMs = 200 }) {
   for (let attempt = 0; attempt < attempts; attempt += 1) {
-    const healthy = url ? await isHealthy(url) : false;
+    const healthy = url ? await isHealthy(url, authToken) : false;
     const alive = pid ? isPidAlive(pid) : false;
     if (!healthy && !alive) {
       return true;
@@ -3032,7 +3920,8 @@ async function stopDaemon(home) {
   const state = readDaemonState(home);
   const configured = readConfiguredUiAddressFromFile(home);
   const url = state?.url || browserUiUrl(state?.host || configured.host, state?.port || configured.port);
-  const healthBefore = await fetchHealth(url);
+  const authToken = typeof state?.auth_token === 'string' ? state.auth_token.trim() : '';
+  const healthBefore = await fetchHealth(url, authToken);
   const healthyBefore = Boolean(healthBefore && healthBefore.status === 'ok');
   const sameHomeHealthy = healthMatchesHome({ health: healthBefore, home });
   const pid = state?.pid || (sameHomeHealthy ? healthBefore?.pid : null);
@@ -3073,21 +3962,21 @@ async function stopDaemon(home) {
   let stopped = false;
 
   if (healthyBefore) {
-    await requestDaemonShutdown(url, shutdownDaemonId || null);
-    stopped = await waitForDaemonStop({ url, pid, attempts: 20, delayMs: 200 });
+    await requestDaemonShutdown(url, shutdownDaemonId || null, authToken);
+    stopped = await waitForDaemonStop({ url, pid, authToken, attempts: 20, delayMs: 200 });
   }
 
   if (!stopped && pid && isPidAlive(pid)) {
     killManagedProcess(pid, 'SIGTERM');
-    stopped = await waitForDaemonStop({ url, pid, attempts: 30, delayMs: 200 });
+    stopped = await waitForDaemonStop({ url, pid, authToken, attempts: 30, delayMs: 200 });
   }
 
   if (!stopped && pid && isPidAlive(pid)) {
     killManagedProcess(pid, 'SIGKILL');
-    stopped = await waitForDaemonStop({ url, pid, attempts: 20, delayMs: 150 });
+    stopped = await waitForDaemonStop({ url, pid, authToken, attempts: 20, delayMs: 150 });
   }
 
-  const stillHealthy = await isHealthy(url);
+  const stillHealthy = await isHealthy(url, authToken);
   if (!stopped && (stillHealthy || (pid && isPidAlive(pid)))) {
     console.error('DeepScientist daemon is still running after shutdown attempts.');
     process.exit(1);
@@ -3097,6 +3986,86 @@ async function stopDaemon(home) {
   console.log('DeepScientist daemon stopped.');
 }
 
+async function uninstallMain(rawArgs) {
+  const options = parseUninstallArgs(rawArgs);
+  if (options.help) {
+    printUninstallHelp();
+    process.exit(0);
+  }
+  if (options.error) {
+    console.error(options.error);
+    console.error('Run `ds uninstall --help` for usage.');
+    process.exit(1);
+  }
+
+  const home = normalizeHomePath(options.home || resolveHome(rawArgs));
+  const records = resolveUninstallRecords({ home, origin: options.origin });
+  const plan = aggregateCodeOnlyUninstallPlan(records);
+
+  if (!options.yes && options.origin !== 'npm') {
+    const confirmed = await promptUninstallConfirmation({ records, plan });
+    if (!confirmed) {
+      console.log('DeepScientist uninstall cancelled.');
+      process.exit(1);
+    }
+  }
+
+  for (const record of records) {
+    try {
+      await stopDaemon(record.home);
+    } catch (error) {
+      console.warn(`DeepScientist could not fully stop the daemon for ${record.home}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+
+  const removed = [];
+  for (const targetPath of plan.remove_paths) {
+    if (removePathEntry(targetPath)) {
+      removed.push(targetPath);
+    }
+  }
+  for (const targetPath of plan.wrapper_paths) {
+    if (removePathEntry(targetPath)) {
+      removed.push(targetPath);
+    }
+  }
+
+  removeInstallRecords((record) => records.some((candidate) => installRecordMatches(candidate, record)));
+
+  let npmRemovalMessage = null;
+  if (options.origin !== 'npm' && detectInstallMode(repoRoot) === 'npm-package') {
+    const npmRemoval = runGlobalNpmUninstall();
+    if (!npmRemoval.ok) {
+      npmRemovalMessage = npmRemoval.message;
+    }
+  }
+
+  console.log('');
+  console.log('DeepScientist code uninstall completed.');
+  if (removed.length > 0) {
+    console.log('');
+    console.log('Removed:');
+    for (const targetPath of removed) {
+      console.log(`- ${targetPath}`);
+    }
+  }
+  console.log('');
+  console.log('Preserved local data:');
+  for (const targetPath of plan.preserve_paths) {
+    console.log(`- ${targetPath}`);
+  }
+  console.log('');
+  for (const record of records) {
+    console.log(`If you also want to delete local data manually: rm -rf ${record.home}`);
+  }
+  if (npmRemovalMessage) {
+    console.log('');
+    console.warn(`Global npm package removal did not complete automatically: ${npmRemovalMessage}`);
+    console.warn(`Run: npm uninstall -g ${UPDATE_PACKAGE_NAME}`);
+  }
+  process.exit(0);
+}
+
 function writeUpdateLog(home, content) {
   const logPath = path.join(home, 'logs', 'update.log');
   ensureDir(path.dirname(logPath));
@@ -3362,19 +4331,23 @@ async function performSelfUpdate(home, options = {}) {
         log_path: installResult.logPath,
       };
     }
+    const restartArgs = [
+      launcherPath,
+      '--home',
+      home,
+      '--host',
+      String(host),
+      '--port',
+      String(port),
+      '--daemon-only',
+      '--no-browser',
+      '--skip-update-check',
+    ];
+    if (daemonState && daemonState.auth_enabled === false) {
+      restartArgs.push('--auth', 'false');
+    }
     spawnDetachedNode(
-      [
-        launcherPath,
-        '--home',
-        home,
-        '--host',
-        String(host),
-        '--port',
-        String(port),
-        '--daemon-only',
-        '--no-browser',
-        '--skip-update-check',
-      ],
+      restartArgs,
       {
         cwd: repoRoot,
         env: process.env,
@@ -3569,17 +4542,88 @@ async function startBackgroundUpdateWorker(home, options = {}) {
   };
 }
 
+async function maybeHandleMiniMaxCodexVersion(home, runtimePython, options = {}) {
+  const configuredRunners = (() => {
+    try {
+      const result = runPythonCli(runtimePython, ['--home', home, 'config', 'show', 'runners'], {
+        capture: true,
+        allowFailure: true,
+      });
+      return String(result.stdout || '');
+    } catch {
+      return '';
+    }
+  })();
+  const profileFromConfig =
+    configuredRunners.match(/^\s*profile:\s*["']?([^"'\n]+)["']?\s*$/m)?.[1]?.trim() || '';
+  const binaryFromConfig =
+    configuredRunners.match(/^\s*binary:\s*["']?([^"'\n]+)["']?\s*$/m)?.[1]?.trim() || 'codex';
+  const configDirFromConfig =
+    configuredRunners.match(/^\s*config_dir:\s*["']?([^"'\n]+)["']?\s*$/m)?.[1]?.trim() || '~/.codex';
+
+  const effectiveProfile = String(options.codexProfile || profileFromConfig || '').trim();
+  if (!effectiveProfile) {
+    return false;
+  }
+  const metadata = readCodexProviderMetadata(configDirFromConfig, effectiveProfile);
+  if (String(metadata.provider || '').trim().toLowerCase() !== 'minimax') {
+    return false;
+  }
+  const version = installedCodexCliVersion(options.codexBinary || binaryFromConfig || 'codex');
+  const expected = [0, 57, 0];
+  if (!version || compareCodexCliVersion(version, expected) === 0) {
+    return false;
+  }
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    console.log(
+      `MiniMax profile \`${effectiveProfile}\` is configured, but installed Codex CLI is ${formatCodexCliVersion(version)}. MiniMax currently requires Codex CLI 0.57.0 for the documented path.`
+    );
+    console.log('Install it manually with `npm install -g @openai/codex@0.57.0` before continuing.');
+    return false;
+  }
+
+  console.log('');
+  console.log(colorize('\u001B[1;38;5;214m', 'MiniMax compatibility check'));
+  console.log(
+    `DeepScientist detected MiniMax profile \`${effectiveProfile}\`, but installed Codex CLI is ${formatCodexCliVersion(version)}.`
+  );
+  console.log('MiniMax currently requires Codex CLI 0.57.0 for the documented DeepScientist path.');
+  const confirmed = await promptYesNo('Reinstall Codex CLI to 0.57.0 now? [y/N]: ', {
+    defaultValue: false,
+  });
+  if (!confirmed) {
+    return false;
+  }
+  const npmBinary = resolveNpmBinary();
+  if (!npmBinary) {
+    console.error('`npm` is unavailable; cannot reinstall Codex CLI automatically.');
+    process.exit(1);
+  }
+  const result = spawnSync(
+    npmBinary,
+    ['install', '-g', '@openai/codex@0.57.0'],
+    syncSpawnOptions({ stdio: 'inherit' })
+  );
+  if (result.status !== 0) {
+    console.error('Failed to reinstall Codex CLI 0.57.0 automatically.');
+    process.exit(result.status ?? 1);
+  }
+  return true;
+}
+
 async function readConfiguredUiAddress(home, runtimePython, fallbackHost, fallbackPort) {
   try {
     const result = runPythonCli(runtimePython, ['--home', home, 'config', 'show', 'config'], { capture: true, allowFailure: true });
     const text = result.stdout || '';
     const hostMatch = text.match(/^\s*host:\s*["']?([^"'\n]+)["']?\s*$/m);
     const portMatch = text.match(/^\s*port:\s*(\d+)\s*$/m);
+    const authMatch = text.match(/^\s*auth_enabled:\s*([^\n]+)\s*$/m);
     const modeMatch = text.match(/^\s*default_mode:\s*["']?([^"'\n]+)["']?\s*$/m);
     const autoOpenMatch = text.match(/^\s*auto_open_browser:\s*([^\n]+)\s*$/m);
     return {
       host: fallbackHost || (hostMatch ? hostMatch[1].trim() : '0.0.0.0'),
       port: fallbackPort || (portMatch ? Number(portMatch[1]) : 20999),
+      authEnabled: parseBooleanSetting(authMatch ? authMatch[1].trim() : false, false),
       defaultMode: normalizeMode(modeMatch ? modeMatch[1].trim() : 'web'),
       autoOpenBrowser: parseBooleanSetting(autoOpenMatch ? autoOpenMatch[1].trim() : true, true),
     };
@@ -3587,6 +4631,7 @@ async function readConfiguredUiAddress(home, runtimePython, fallbackHost, fallba
     return {
       host: fallbackHost || '0.0.0.0',
       port: fallbackPort || 20999,
+      authEnabled: false,
       defaultMode: 'web',
       autoOpenBrowser: true,
     };
@@ -3599,6 +4644,7 @@ function readConfiguredUiAddressFromFile(home, fallbackHost, fallbackPort) {
     return {
       host: fallbackHost || '0.0.0.0',
       port: fallbackPort || 20999,
+      authEnabled: false,
       defaultMode: 'web',
       autoOpenBrowser: true,
     };
@@ -3607,11 +4653,13 @@ function readConfiguredUiAddressFromFile(home, fallbackHost, fallbackPort) {
     const text = fs.readFileSync(configPath, 'utf8');
     const hostMatch = text.match(/^\s*host:\s*["']?([^"'\n]+)["']?\s*$/m);
     const portMatch = text.match(/^\s*port:\s*(\d+)\s*$/m);
+    const authMatch = text.match(/^\s*auth_enabled:\s*([^\n]+)\s*$/m);
     const modeMatch = text.match(/^\s*default_mode:\s*["']?([^"'\n]+)["']?\s*$/m);
     const autoOpenMatch = text.match(/^\s*auto_open_browser:\s*([^\n]+)\s*$/m);
     return {
       host: fallbackHost || (hostMatch ? hostMatch[1].trim() : '0.0.0.0'),
       port: fallbackPort || (portMatch ? Number(portMatch[1]) : 20999),
+      authEnabled: parseBooleanSetting(authMatch ? authMatch[1].trim() : false, false),
       defaultMode: normalizeMode(modeMatch ? modeMatch[1].trim() : 'web'),
       autoOpenBrowser: parseBooleanSetting(autoOpenMatch ? autoOpenMatch[1].trim() : true, true),
     };
@@ -3619,20 +4667,51 @@ function readConfiguredUiAddressFromFile(home, fallbackHost, fallbackPort) {
     return {
       host: fallbackHost || '0.0.0.0',
       port: fallbackPort || 20999,
+      authEnabled: false,
       defaultMode: 'web',
       autoOpenBrowser: true,
     };
   }
 }
 
-async function startDaemon(home, runtimePython, host, port, proxy = null, envOverrides = {}) {
+async function startDaemon(home, runtimePython, host, port, proxy = null, envOverrides = {}, authEnabled = false) {
   const browserUrl = browserUiUrl(host, port);
   const daemonBindUrl = bindUiUrl(host, port);
   const state = readDaemonState(home);
-  const existingHealth = await fetchHealth(browserUrl);
+  const desiredAuthToken = authEnabled ? generateBrowserAuthToken() : null;
+  const launchUrl = browserUrl;
+  const bindLaunchUrl = daemonBindUrl;
+  const existingHealth = await fetchHealth(browserUrl, typeof state?.auth_token === 'string' ? state.auth_token.trim() : '');
   if (existingHealth && existingHealth.status === 'ok') {
     if (state && healthMatchesManagedState({ health: existingHealth, state, home })) {
-      return { url: browserUrl, bindUrl: daemonBindUrl, reused: true };
+      const stateAuthEnabled = state.auth_enabled !== false;
+      const stateAuthToken = typeof state.auth_token === 'string' ? state.auth_token.trim() : '';
+      let resolvedAuthToken = stateAuthToken || null;
+      if (stateAuthEnabled) {
+        const rotatedAuthToken = await requestDaemonAuthRotate(browserUrl, stateAuthToken);
+        if (!rotatedAuthToken) {
+          console.error('Managed daemon is healthy, but the browser auth token could not be rotated.');
+          console.error('Restart the daemon with `ds --restart` if this keeps happening.');
+          process.exit(1);
+        }
+        resolvedAuthToken = rotatedAuthToken;
+        writeDaemonState(home, {
+          ...state,
+          auth_enabled: true,
+          auth_token: rotatedAuthToken,
+          url: browserUrl,
+          bind_url: daemonBindUrl,
+          launch_url: launchUrl,
+          bind_launch_url: bindLaunchUrl,
+        });
+      }
+      return {
+        url: browserUrl,
+        bindUrl: daemonBindUrl,
+        reused: true,
+        authEnabled: stateAuthEnabled,
+        authToken: resolvedAuthToken,
+      };
     }
     console.error(
       state
@@ -3666,11 +4745,13 @@ async function startDaemon(home, runtimePython, host, port, proxy = null, envOve
     port,
     proxy,
     envOverrides,
+    authEnabled,
+    authToken: desiredAuthToken,
   });
   const logPath = startedProcess.logPath;
 
   for (let attempt = 0; attempt < 60; attempt += 1) {
-    const health = await fetchHealth(browserUrl);
+    const health = await fetchHealth(browserUrl, desiredAuthToken);
     if (health && health.status === 'ok') {
       const liveState = readDaemonState(home);
       if (!healthMatchesManagedState({ health, state: liveState, home })) {
@@ -3689,12 +4770,26 @@ async function startDaemon(home, runtimePython, host, port, proxy = null, envOve
       if (supervisorPid) {
         appendDaemonSupervisorLog(home, `supervisor started with pid ${supervisorPid}`);
       }
-      return { url: browserUrl, bindUrl: daemonBindUrl, reused: false };
+      return {
+        url: launchUrl,
+        bindUrl: bindLaunchUrl,
+        reused: false,
+        authEnabled,
+        authToken: desiredAuthToken,
+      };
     }
     await sleep(250);
   }
 
   console.error('DeepScientist daemon failed to become healthy.');
+  console.error(`Expected local URL: ${launchUrl}`);
+  console.error(`Daemon bind URL: ${bindLaunchUrl}`);
+  if (authEnabled && desiredAuthToken) {
+    console.error(`Auth token: ${desiredAuthToken}`);
+  }
+  if (['0.0.0.0', '::', '[::]'].includes(String(host || '').trim())) {
+    console.error(`Hint: ${String(host || '').trim() || '0.0.0.0'} is a bind address. Local browser and health probes use ${browserUrl}.`);
+  }
   const logTail = tailLog(logPath);
   if (logTail) {
     console.error(logTail);
@@ -3766,7 +4861,7 @@ function handleCodexPreflightFailure(error) {
     : [
         'In most installs, `npm install -g @researai/deepscientist` also installs the bundled Codex dependency.',
         'If `codex` is still missing, run `npm install -g @openai/codex`.',
-        'Run `codex --login` (or `codex`) and finish authentication.',
+        'Run `codex login` (or just `codex`) and finish authentication.',
         'Run `ds doctor` and confirm the Codex check passes.',
         'Run `ds` again.',
       ];
@@ -3778,12 +4873,15 @@ function handleCodexPreflightFailure(error) {
   return true;
 }
 
-function launchTui(url, questId, home, runtimePython) {
+function launchTui(url, questId, home, runtimePython, authToken = null) {
   const entry = ensureNodeBundle('src/tui', 'dist/index.js');
   const args = [entry, '--base-url', url];
   if (questId) {
     args.push('--quest-id', questId);
   }
+  if (typeof authToken === 'string' && authToken.trim()) {
+    args.push('--auth-token', authToken.trim());
+  }
   const child = spawn(process.execPath, args, {
     cwd: repoRoot,
     stdio: 'inherit',
@@ -3801,14 +4899,15 @@ function launchTui(url, questId, home, runtimePython) {
 
 async function updateMain(rawArgs) {
   const options = parseUpdateArgs(rawArgs);
-  if (!options) {
-    printUpdateHelp();
-    process.exit(1);
-  }
   if (options.help) {
     printUpdateHelp();
     process.exit(0);
   }
+  if (options.error) {
+    console.error(options.error);
+    console.error('Run `ds update --help` for update usage.');
+    process.exit(1);
+  }
 
   const home = options.home || resolveHome(rawArgs);
   applyLauncherProxy(options.proxy);
@@ -3923,14 +5022,15 @@ async function updateMain(rawArgs) {
 
 async function migrateMain(rawArgs) {
   const options = parseMigrateArgs(rawArgs);
-  if (!options) {
-    printMigrateHelp();
-    process.exit(1);
-  }
   if (options.help) {
     printMigrateHelp();
     process.exit(0);
   }
+  if (options.error) {
+    console.error(options.error);
+    console.error('Run `ds migrate --help` for migration usage.');
+    process.exit(1);
+  }
 
   const sourceHome = realpathOrSelf(options.home || resolveHome(rawArgs));
   const targetHome = path.resolve(options.target);
@@ -4051,20 +5151,27 @@ async function migrateMain(rawArgs) {
 
 async function launcherMain(rawArgs) {
   const options = parseLauncherArgs(rawArgs);
-  if (!options) {
-    return false;
-  }
   if (options.help) {
     printLauncherHelp();
     process.exit(0);
   }
+  if (options.error) {
+    console.error(options.error);
+    console.error('Run `ds --help` for launcher usage.');
+    process.exit(1);
+  }
 
   const home = options.home || resolveHome(rawArgs);
   applyLauncherProxy(options.proxy);
   ensureDir(home);
+  registerCurrentInstall(home);
+  const forceWrapperRepair =
+    detectInstallMode(repoRoot) !== 'npm-package'
+    && Boolean(options.home || process.env.DEEPSCIENTIST_HOME);
   repairLegacyPathWrappers({
     home,
     launcherPath: resolveLauncherPath(),
+    force: forceWrapperRepair,
   });
 
   if (options.stop) {
@@ -4075,26 +5182,21 @@ async function launcherMain(rawArgs) {
   if (options.status) {
     const state = readDaemonState(home);
     const configured = readConfiguredUiAddressFromFile(home, options.host, options.port);
-    const url = state?.url || browserUiUrl(configured.host, configured.port);
-    const health = await fetchHealth(url);
-    const healthy = Boolean(health && health.status === 'ok');
-    const identityMatch = state ? healthMatchesManagedState({ health, state, home }) : false;
+    const url = state?.launch_url || state?.url || browserUiUrl(configured.host, configured.port);
+    const authToken = typeof state?.auth_token === 'string' ? state.auth_token.trim() : '';
+    const probeUrl = state?.url || browserUiUrl(configured.host, configured.port);
+    const health = await fetchHealth(probeUrl, authToken);
+    const statusPayload = buildDaemonStatusPayload({
+      home,
+      url,
+      state,
+      health,
+      launcherPath: resolveLauncherPath(),
+    });
     console.log(
-      JSON.stringify(
-        {
-          healthy,
-          identity_match: identityMatch,
-          managed: Boolean(state),
-          home,
-          url,
-          daemon: state,
-          health,
-        },
-        null,
-        2
-      )
+      JSON.stringify(statusPayload, null, 2)
     );
-    process.exit(healthy && (!state || identityMatch) ? 0 : 1);
+    process.exit(statusPayload.healthy && (!state || statusPayload.identity_match) ? 0 : 1);
   }
 
   const pythonRuntime = ensurePythonRuntime(home);
@@ -4105,6 +5207,7 @@ async function launcherMain(rawArgs) {
     binary: options.codexBinary,
   });
   ensureInitialized(home, runtimePython);
+  await maybeHandleMiniMaxCodexVersion(home, runtimePython, options);
   if (await maybeHandleStartupUpdate(home, rawArgs, options)) {
     return true;
   }
@@ -4113,20 +5216,27 @@ async function launcherMain(rawArgs) {
   const configuredUi = await readConfiguredUiAddress(home, runtimePython, options.host, options.port);
   const host = configuredUi.host;
   const port = configuredUi.port;
+  const authEnabled = options.auth === null ? false : options.auth !== false;
   const mode = normalizeMode(options.mode ?? 'web');
   const shouldOpenBrowser = options.daemonOnly
     ? false
     : options.openBrowser === null
       ? configuredUi.autoOpenBrowser !== false && mode !== 'tui'
       : options.openBrowser;
-  if (options.restart) {
+  const existingState = readDaemonState(home);
+  const existingAuthEnabled = existingState ? existingState.auth_enabled !== false : null;
+  const existingAuthToken = typeof existingState?.auth_token === 'string' ? existingState.auth_token.trim() : '';
+  const authStateMismatch = existingState && (
+    existingAuthEnabled !== authEnabled || (authEnabled && !existingAuthToken)
+  );
+  if (options.restart || authStateMismatch) {
     await stopDaemon(home);
   }
 
   step(4, 4, 'Starting local daemon and UI surfaces');
   let started;
   try {
-    started = await startDaemon(home, runtimePython, host, port, options.proxy, codexOverrideEnv);
+    started = await startDaemon(home, runtimePython, host, port, options.proxy, codexOverrideEnv, authEnabled);
   } catch (error) {
     if (handleCodexPreflightFailure(error)) return true;
     throw error;
@@ -4142,6 +5252,8 @@ async function launcherMain(rawArgs) {
     home,
     pythonSelection: pythonRuntime.runtimeProbe,
     yolo: options.yolo,
+    authEnabled: started.authEnabled,
+    authToken: started.authToken,
   });
 
   if (options.daemonOnly) {
@@ -4150,12 +5262,16 @@ async function launcherMain(rawArgs) {
   if (mode === 'web') {
     process.exit(0);
   }
-  launchTui(started.url, options.questId, home, runtimePython);
+  launchTui(browserUiUrl(host, port), options.questId, home, runtimePython, started.authToken);
   return true;
 }
 
 async function main() {
-  const args = process.argv.slice(2);
+  const normalizedArgState = normalizeLegacyHostFlagArgs(process.argv.slice(2));
+  const args = normalizedArgState.args;
+  for (const warning of normalizedArgState.warnings) {
+    console.warn(warning);
+  }
   if (args[0] === '--daemon-supervisor') {
     await daemonSupervisorMain(args.slice(1));
     return;
@@ -4169,7 +5285,15 @@ async function main() {
     await migrateMain(args);
     return;
   }
-  if (args.length === 0 || args[0] === 'ui' || (!positional && args[0]?.startsWith('--'))) {
+  if (positional && positional.value === 'uninstall') {
+    await uninstallMain(args);
+    return;
+  }
+  if (
+    args.length === 0
+    || args[0] === 'ui'
+    || (args[0]?.startsWith('--') && (!positional || !pythonCommands.has(positional.value)))
+  ) {
     await launcherMain(args);
     return;
   }
@@ -4225,19 +5349,26 @@ module.exports = {
     resolveUvBinary,
     resolveHome,
     parseLauncherArgs,
+    generateBrowserAuthToken,
+    appendBrowserAuthToken,
     normalizeProxyUrl,
+    buildCodeOnlyUninstallPlan,
     parseMigrateArgs,
     parseLegacyWrapperCandidate,
     repairLegacyPathWrappers,
     useEditableProjectInstall,
     compareVersions,
     detectInstallMode,
+    buildUvSyncFailureGuidance,
     updateManualCommand,
     buildUpdateStatus,
+    buildDaemonStatusPayload,
     parseYesNoAnswer,
     normalizeLauncherRelaunchArgs,
     officialRepositoryLine,
     stripAnsi,
+    normalizeLegacyHostFlagArgs,
+    runGlobalNpmUninstall,
   },
 };