@spotpatch/vite 1.8.0 → 1.10.0

package/README.md

@@ -20,26 +20,22 @@ SpotPatch runs only with the Vite development server. Production builds contain
 ### One-command setup (recommended)
 
 ```bash
-# pnpm project
-pnpm dlx @spotpatch/vite@latest setup
-
-# npm project
 npx --yes @spotpatch/vite@latest setup
 ```
 
-`setup` detects npm or pnpm, installs or upgrades the explicit npm `latest` tag, updates a supported `vite.config.*`, and verifies the result. The initializer supports configuration objects and object-returning `defineConfig` callbacks, while ambiguous dynamic configurations fail without writing the config.
+This npm-bootstrap command supports both npm and pnpm projects. It fetches the registry's actual latest CLI, detects the project package manager, installs that CLI's exact SpotPatch version, updates a supported `vite.config.*`, and verifies the result. The exact-version handoff avoids pnpm 11's default 24-hour `minimumReleaseAge` policy silently resolving `@latest` to an older mature release.
+
+The initializer supports configuration objects and object-returning `defineConfig` callbacks, while ambiguous dynamic configurations fail without writing the config.
 
-For separate steps, use `@latest` when you intend to upgrade an existing lockfile entry:
+For npm, installation and initialization can also be kept separate:
 
 ```bash
 npm install --save-dev @spotpatch/vite@latest
 npx spotpatch-vite init
-
-# or
-pnpm add -D @spotpatch/vite@latest
-pnpm exec spotpatch-vite init
 ```
 
+With pnpm 11, use the recommended setup command, install a trusted exact version, or wait until the release is 24 hours old. SpotPatch does not globally disable the project's supply-chain quarantine.
+
 The initializer places SpotPatch before the React plugin so source markers are injected before React transforms the module:
 
 ```ts
@@ -49,11 +45,11 @@ import react from "@vitejs/plugin-react-swc";
 import { defineConfig } from "vite";
 
 export default defineConfig({
-  plugins: [spotPatch({ trustedFastMode: true }), react()],
+  plugins: [spotPatch({ dataFlow: {}, trustedFastMode: true }), react()],
 });
 ```
 
-When no safe local TypeScript check can be discovered, it generates `spotPatch()` and keeps Review mode. Unsupported dynamic configuration can still be integrated manually using the same plugin order.
+When no safe local TypeScript check can be discovered, it generates `spotPatch({ dataFlow: {} })` and keeps Review mode. Unsupported dynamic configuration can still be integrated manually using the same plugin order.
 
 Start the application normally:
 
@@ -63,6 +59,12 @@ pnpm dev
 
 Select **Select element** in the bottom-right corner or press `Mod+Shift+S`. SpotPatch can collect multiple targets across same-project pages, preserve them through navigation and workbench close/reopen cycles, keep a separate instruction for each one, open the exact source location in Cursor or VS Code, and generate a structured prompt without requiring AI configuration.
 
+### Component data flow (Beta)
+
+The current `setup/init` writes `spotPatch({ dataFlow: {} })` automatically; use the same option for manual integration. The Vite + React 18 development-only **Data flow** and **Page APIs** tabs show proven method/path, parameter keys, source-consumed response fields, data destinations, actually dispatched requests, and unassigned current-page traffic. Query values and response bodies are not collected. A relationship is reported only when stable component/source/callsite/invocation evidence agrees; ambiguous traffic remains unknown or unassigned. Data-flow AI, safe JSON response inspection, and Next.js are not included in this Beta. See the repository's [exact implementation status](https://github.com/huanglvjing/spotpatch/blob/main/docs/%E6%8A%80%E6%9C%AF%E6%96%B9%E6%A1%88/%E7%BB%84%E4%BB%B6%E6%95%B0%E6%8D%AE%E9%93%BE%E8%B7%AF/13-Beta%E5%AE%9E%E7%8E%B0%E7%8A%B6%E6%80%81%E4%B8%8E%E4%BD%BF%E7%94%A8%E6%89%8B%E5%86%8C.md).
+
+Supported adapters include direct/component-service `fetch`, Axios, React Query/TanStack Query callbacks, and experimental tRPC logical procedures. tRPC batch HTTP transport remains separate evidence and is never assigned by timing or URL similarity.
+
 ### Compatibility
 
 | Dependency           | Supported range                |
@@ -87,6 +89,8 @@ spotPatch({
   locale: "auto",
   maxTargets: 8,
   ai: false,
+  dataFlow: false,
+  externalAgent: false,
 });
 ```
 
@@ -104,10 +108,42 @@ spotPatch({
 | `locale`          | `"auto"`                                          | Resolves `en-US` or `zh-CN`.                                            |
 | `maxTargets`      | `8`                                               | Targets allowed in one change request by default.                       |
 | `ai`              | disabled or a detected complete environment       | Optional provider and Agent settings.                                   |
+| `dataFlow`        | `false`                                           | Opt-in dispatch-only component data-flow Beta.                          |
+| `externalAgent`   | `false`                                           | Opt-in development-only external Agent handoff; local-validation only.  |
 | `trustedFastMode` | `false`                                           | Exposes Review/Trusted direct and discovers TypeScript for Review.      |
 
 The package exports the option types, AI provider types, Agent limits, and immutable defaults. See the [public API specification](https://github.com/huanglvjing/spotpatch/blob/main/docs/%E6%8A%80%E6%9C%AF%E6%96%B9%E6%A1%88/03-%E5%85%AC%E5%85%B1API%E4%B8%8E%E6%95%B0%E6%8D%AE%E6%A8%A1%E5%9E%8B.md) for the complete constraints.
 
+### External Agent handoff (local validation)
+
+Enable the development-only UI explicitly:
+
+```ts
+spotPatch({ externalAgent: true });
+```
+
+Run setup and active commands from the exact canonical project root that owns the running Vite development session. Setup is a dry run without `--write`:
+
+```bash
+pnpm exec spotpatch-vite bridge setup --client claude --scope project --mode active --write
+MCP_PROTOCOL_NEGOTIATION=legacy claude --dangerously-load-development-channels server:spotpatch
+
+pnpm exec spotpatch-vite connect codex --allow-workspace-write
+
+pnpm exec spotpatch-vite bridge setup --client cursor --scope project --write
+```
+
+The active command forms support an explicit session when `bridge sessions --json` reports multiple sessions for that exact root:
+
+```text
+spotpatch-vite bridge channel claude [--session <opaque-id>]
+spotpatch-vite connect codex --allow-workspace-write [--session <opaque-id>]
+```
+
+The Claude legacy environment belongs on the Claude host process. Claude Channels are a Research Preview, work only while the Channel-enabled session is running, and provide no completion acknowledgement; completion depends on Claude calling the SpotPatch result tool. Codex active mode is zero-setup: the Connector injects the project-local SpotPatch MCP entry into its App Server thread and does not create or modify `.codex/config.toml`. Codex can still load other MCP servers already enabled by the user's normal Codex configuration. The Connector accepts exactly `codex-cli 0.149.0`. `bridge setup --client codex ...` remains available only for optional Inbox use; Cursor and all generic MCP hosts remain Inbox-only.
+
+This path is `local-validation`, not stable support. Automated fake-host and two-handoff tests exist, and a consecutive two-revision Codex flow has been manually validated on the recorded macOS/Next.js/Codex 0.149.0 environment. Real Claude Code consecutive delivery, repeatable real-host automation, and Windows process-tree cleanup remain `not-tested`; Cursor remains Inbox-only. See the [external Agent design and exact status](https://github.com/huanglvjing/spotpatch/blob/main/docs/%E6%8A%80%E6%9C%AF%E6%96%B9%E6%A1%88/%E5%A4%96%E9%83%A8Agent%E8%BF%9E%E6%8E%A5/00-%E7%B4%A2%E5%BC%95%E4%B8%8E%E5%86%B3%E7%AD%96%E6%91%98%E8%A6%81.md).
+
 ### Optional AI Agent
 
 AI remains disabled unless every required provider value is available. The smallest setup uses a Git-ignored `.env.local` file:
@@ -157,8 +193,8 @@ The page defaults to Review. Choosing Trusted direct uses the exact SpotPatch so
 
 ### Troubleshooting
 
-- **An old version remains installed:** use `@spotpatch/vite@latest`; an untagged add may preserve an existing compatible lockfile entry.
-- **Initializer rejects the config:** use a configuration object or a callback with one unambiguous object return. For conditional returns or dynamic plugin arrays, configure `spotPatch()` manually before the React plugin.
+- **pnpm 11 installs an older version for `@latest`:** its default 24-hour `minimumReleaseAge` policy selects the newest mature release. Use the recommended `npx ... setup`, specify a trusted exact version, or wait 24 hours.
+- **Initializer rejects the config:** use a configuration object or a callback with one unambiguous object return. For conditional returns or dynamic plugin arrays, configure `spotPatch({ dataFlow: {} })` manually before the React plugin.
 - **No selection button:** confirm `spotPatch()` appears before the React plugin and that the app is running through `vite`/`vite dev`, not `vite preview`.
 - **No exact source location:** confirm the component is authored in an included `.jsx` or `.tsx` file under `src`, or configure `include` explicitly.
 - **AI is unavailable:** provide all three required environment values or set `ai: false`; partial environment configuration fails closed.
@@ -182,26 +218,22 @@ SpotPatch 只在 Vite 开发服务器中运行。生产构建不包含 SpotPatch
 ### 一条命令接入（推荐）
 
 ```bash
-# pnpm 项目
-pnpm dlx @spotpatch/vite@latest setup
-
-# npm 项目
 npx --yes @spotpatch/vite@latest setup
 ```
 
-`setup` 会识别 npm 或 pnpm，显式安装或升级 npm `latest` 标签，安全更新受支持的 `vite.config.*` 并验证结果。初始化器支持配置对象和返回对象的 `defineConfig` 回调；有歧义的动态配置会在不写入配置文件的情况下失败。
+这条由 npm 引导的命令同时支持 npm 和 pnpm 项目。它先取得 registry 真正的最新 CLI，再识别项目包管理器、安装该 CLI 对应的 SpotPatch 精确版本、安全更新受支持的 `vite.config.*` 并验证结果。精确版本交接可以避免 pnpm 11 默认 24 小时 `minimumReleaseAge` 把 `@latest` 解析成较旧的成熟版本。
+
+初始化器支持配置对象和返回对象的 `defineConfig` 回调；有歧义的动态配置会在不写入配置文件的情况下失败。
 
-需要分开执行时，如果要升级锁文件里的已有版本，请显式使用 `@latest`：
+npm 项目也可以分开安装和初始化：
 
 ```bash
 npm install --save-dev @spotpatch/vite@latest
 npx spotpatch-vite init
-
-# 或
-pnpm add -D @spotpatch/vite@latest
-pnpm exec spotpatch-vite init
 ```
 
+pnpm 11 项目请使用推荐的 setup 命令、安装已确认的精确版本，或等待发布满 24 小时。SpotPatch 不会全局关闭项目的供应链隔离策略。
+
 初始化器会将 SpotPatch 放在 React 插件之前，确保源码标记在 React 转换前注入：
 
 ```ts
@@ -211,11 +243,11 @@ import react from "@vitejs/plugin-react-swc";
 import { defineConfig } from "vite";
 
 export default defineConfig({
-  plugins: [spotPatch({ trustedFastMode: true }), react()],
+  plugins: [spotPatch({ dataFlow: {}, trustedFastMode: true }), react()],
 });
 ```
 
-无法发现安全的本地 TypeScript 检查时，初始化器会生成 `spotPatch()` 并保持审阅模式。不受支持的动态配置仍可按相同插件顺序手动接入。
+无法发现安全的本地 TypeScript 检查时，初始化器会生成 `spotPatch({ dataFlow: {} })` 并保持审阅模式。不受支持的动态配置仍可按相同插件顺序手动接入。
 
 照常启动应用：
 
@@ -225,6 +257,12 @@ pnpm dev
 
 点击右下角的 **选择元素** 或按下 `Mod+Shift+S`。SpotPatch 支持跨同一项目的多个页面采集目标，在页面跳转及工作台关闭/重开后保留目标与独立修改要求，在 Cursor 或 VS Code 中打开精确位置，并且在完全不配置 AI 的情况下生成结构化 Prompt。
 
+### 组件数据链路（Beta）
+
+新版 `setup/init` 会自动写入 `spotPatch({ dataFlow: {} })`，手工接入时使用同一选项。Vite + React 18 开发期的 **数据链路** 与 **页面接口** 页签会显示有证据的 method/path、参数键、源码消费字段、数据去向、实际 dispatch 请求和当前页面未归属流量；不采集 query 值或响应体。只有稳定组件、源码、callsite 与 invocation 证据一致时才建立关联，歧义流量保持 unknown/unassigned。当前不包含 data-flow AI、安全 JSON 响应读取或 Next.js 支持。准确范围见仓库中的 [实现状态文档](https://github.com/huanglvjing/spotpatch/blob/main/docs/%E6%8A%80%E6%9C%AF%E6%96%B9%E6%A1%88/%E7%BB%84%E4%BB%B6%E6%95%B0%E6%8D%AE%E9%93%BE%E8%B7%AF/13-Beta%E5%AE%9E%E7%8E%B0%E7%8A%B6%E6%80%81%E4%B8%8E%E4%BD%BF%E7%94%A8%E6%89%8B%E5%86%8C.md)。
+
+已支持的适配器包括组件直接/Service `fetch`、Axios、React Query/TanStack Query 回调和实验性的 tRPC 逻辑 procedure。tRPC batch HTTP 传输保持为独立证据，绝不按时间或 URL 相似度强行归属。
+
 ### 兼容范围
 
 | 依赖           | 正式支持范围                   |
@@ -249,27 +287,61 @@ spotPatch({
   locale: "auto",
   maxTargets: 8,
   ai: false,
+  dataFlow: false,
+  externalAgent: false,
 });
 ```
 
-| 选项              | 默认值                       | 说明                                                   |
-| ----------------- | ---------------------------- | ------------------------------------------------------ |
-| `enabled`         | `true`                       | 启用开发期插件。                                       |
-| `include`         | `src` 下 JSX/TSX             | 允许注入源码标记的文件。                               |
-| `exclude`         | 依赖、测试、Story 与生成目录 | 不进行转换的文件。                                     |
-| `editor`          | `"auto"`                     | 自动识别 Cursor 或 VS Code，也可显式固定。             |
-| `redact`          | `true`                       | 清洗采集上下文；强制保护的秘密类型不会因关闭而暴露。   |
-| `budget`          | 有界默认值                   | 限制总量、DOM、CSS 和源码上下文大小。                  |
-| `shortcut`        | `"Mod+Shift+S"`              | 切换元素选择器。                                       |
-| `allowLan`        | `false`                      | 默认只允许 loopback Host 与 Origin。                   |
-| `debug`           | `false`                      | 输出不包含凭据的开发诊断。                             |
-| `locale`          | `"auto"`                     | 自动解析 `en-US` 或 `zh-CN`。                          |
-| `maxTargets`      | `8`                          | 一次修改任务默认允许的目标数。                         |
-| `ai`              | 关闭或检测到完整环境配置     | 可选 Provider 和 Agent 配置。                          |
-| `trustedFastMode` | `false`                      | 开放审阅/可信极速选择；TypeScript 检查供审阅模式使用。 |
+| 选项              | 默认值                       | 说明                                                       |
+| ----------------- | ---------------------------- | ---------------------------------------------------------- |
+| `enabled`         | `true`                       | 启用开发期插件。                                           |
+| `include`         | `src` 下 JSX/TSX             | 允许注入源码标记的文件。                                   |
+| `exclude`         | 依赖、测试、Story 与生成目录 | 不进行转换的文件。                                         |
+| `editor`          | `"auto"`                     | 自动识别 Cursor 或 VS Code，也可显式固定。                 |
+| `redact`          | `true`                       | 清洗采集上下文；强制保护的秘密类型不会因关闭而暴露。       |
+| `budget`          | 有界默认值                   | 限制总量、DOM、CSS 和源码上下文大小。                      |
+| `shortcut`        | `"Mod+Shift+S"`              | 切换元素选择器。                                           |
+| `allowLan`        | `false`                      | 默认只允许 loopback Host 与 Origin。                       |
+| `debug`           | `false`                      | 输出不包含凭据的开发诊断。                                 |
+| `locale`          | `"auto"`                     | 自动解析 `en-US` 或 `zh-CN`。                              |
+| `maxTargets`      | `8`                          | 一次修改任务默认允许的目标数。                             |
+| `ai`              | 关闭或检测到完整环境配置     | 可选 Provider 和 Agent 配置。                              |
+| `dataFlow`        | `false`                      | 可选 dispatch-only 组件数据链路 Beta。                     |
+| `externalAgent`   | `false`                      | 可选、仅开发期的外部 Agent 交接；当前仅 local-validation。 |
+| `trustedFastMode` | `false`                      | 开放审阅/可信极速选择；TypeScript 检查供审阅模式使用。     |
 
 本包导出选项类型、AI Provider 类型、Agent 限制和不可变默认值。完整约束见[公共 API 规范](https://github.com/huanglvjing/spotpatch/blob/main/docs/%E6%8A%80%E6%9C%AF%E6%96%B9%E6%A1%88/03-%E5%85%AC%E5%85%B1API%E4%B8%8E%E6%95%B0%E6%8D%AE%E6%A8%A1%E5%9E%8B.md)。
 
+### 外部 Agent 交接（本地验证）
+
+显式启用仅开发期的 UI：
+
+```ts
+spotPatch({ externalAgent: true });
+```
+
+必须在当前 Vite dev Session 所属的精确 canonical 项目根执行 setup 和主动命令。setup 不带 `--write` 时只是 dry-run：
+
+```bash
+pnpm exec spotpatch-vite bridge setup --client claude --scope project --mode active --write
+MCP_PROTOCOL_NEGOTIATION=legacy claude --dangerously-load-development-channels server:spotpatch
+
+pnpm exec spotpatch-vite connect codex --allow-workspace-write
+
+pnpm exec spotpatch-vite bridge setup --client cursor --scope project --write
+```
+
+若 `bridge sessions --json` 报告该精确项目根有多个 Session，主动子命令支持显式选择：
+
+```text
+spotpatch-vite bridge channel claude [--session <opaque-id>]
+spotpatch-vite connect codex --allow-workspace-write [--session <opaque-id>]
+```
+
+Claude legacy 环境变量必须设置在 Claude 宿主进程。Claude Channels 仍是 Research Preview，只在已启用 Channel 的会话运行时工作，且没有 completion ACK；完成状态依赖 Claude 调用 SpotPatch 结果 tool。Codex 主动模式为零配置：Connector 只把当前项目的 SpotPatch MCP 配置注入它拥有的 App Server thread，不创建也不修改 `.codex/config.toml`；Codex 仍可能按用户既有配置启动其他已启用 MCP server。Connector 当前只接受 `codex-cli 0.149.0`。`bridge setup --client codex ...` 仅保留为可选 Inbox 配置；Cursor 和所有普通 MCP 宿主仍为 Inbox-only。
+
+该链路当前只是 `local-validation`，不是稳定支持。仓库有假宿主和连续两 Handoff 自动化测试，并已在记录的 macOS/Next.js/Codex 0.149.0 环境人工验证连续两个 revision。真实 Claude Code 连续投递、可重复真实宿主自动化和 Windows 进程树清理仍为 `not-tested`；Cursor 保持 Inbox-only。准确边界见[外部 Agent 方案与实现状态](https://github.com/huanglvjing/spotpatch/blob/main/docs/%E6%8A%80%E6%9C%AF%E6%96%B9%E6%A1%88/%E5%A4%96%E9%83%A8Agent%E8%BF%9E%E6%8E%A5/00-%E7%B4%A2%E5%BC%95%E4%B8%8E%E5%86%B3%E7%AD%96%E6%91%98%E8%A6%81.md)。
+
 ### 可选 AI Agent
 
 只有全部必需 Provider 值可用时 AI 才会启用。最小配置放在 Git 忽略的 `.env.local` 中：
@@ -319,8 +391,8 @@ spotPatch({ trustedFastMode: true });
 
 ### 常见问题
 
-- **仍然安装了旧版本：**请使用 `@spotpatch/vite@latest`；不带标签的 add 可能继续复用锁文件中满足范围的旧版本。
-- **初始化器拒绝配置：**请使用配置对象，或只含一个明确对象返回的回调。存在条件返回或动态插件数组时，手动将 `spotPatch()` 放到 React 插件之前。
+- **pnpm 11 对 `@latest` 安装了旧版本：**默认 24 小时 `minimumReleaseAge` 会选择最新的成熟版本。请使用推荐的 `npx ... setup`、安装已确认的精确版本，或等待 24 小时。
+- **初始化器拒绝配置：**请使用配置对象，或只含一个明确对象返回的回调。存在条件返回或动态插件数组时，手动将 `spotPatch({ dataFlow: {} })` 放到 React 插件之前。
 - **没有选择元素按钮：**确认 `spotPatch()` 位于 React 插件之前，并且应用通过 `vite`/`vite dev` 而不是 `vite preview` 启动。
 - **没有精确源码位置：**确认组件来自 include 范围内的 `.jsx` 或 `.tsx` 文件，默认范围是 `src`。
 - **AI 不可用：**提供全部三个必需环境变量，或者显式设置 `ai: false`；不完整配置会安全失败。

package/dist/cli.js

@@ -4,6 +4,7 @@
 import { readFile as readFile2 } from "fs/promises";
 import { createRequire } from "module";
 import path3 from "path";
+import { runSpotPatchBridgeCli } from "@spotpatch/bridge";
 
 // src/initializer.ts
 import path from "path";
@@ -68,6 +69,16 @@ function insertStaticImport(magicString, program, statement) {
   magicString.appendRight(offset, `
 ${statement}`);
 }
+function importQuote(source, program) {
+  const firstImport = importsOf(program)[0];
+  if (firstImport !== void 0) {
+    const quote = source[firstImport.source.start];
+    if (quote === '"' || quote === "'") {
+      return quote;
+    }
+  }
+  return '"';
+}
 function collectIdentifierNames(program) {
   const names = /* @__PURE__ */ new Set();
   new Visitor({
@@ -249,8 +260,12 @@ function childIndent(source, object) {
   }
   return `${lineIndentAt(source, object.start)}  `;
 }
-function trustedFastCall(pluginName, enabled) {
-  return enabled ? `${pluginName}({ trustedFastMode: true })` : `${pluginName}()`;
+function initializedPluginCall(pluginName, trustedFastMode) {
+  const options = [
+    "dataFlow: {}",
+    ...trustedFastMode ? ["trustedFastMode: true"] : []
+  ];
+  return `${pluginName}({ ${options.join(", ")} })`;
 }
 function directPluginCalls(plugins, pluginName) {
   return plugins.elements.filter((element) => {
@@ -261,12 +276,12 @@ function directPluginCalls(plugins, pluginName) {
     return callee.type === "Identifier" && callee.name === pluginName;
   });
 }
-function enableTrustedFastMode(magicString, source, call) {
+function enableInitializedOptions(magicString, source, call, trustedFastMode) {
   if (call.arguments.length === 0) {
     magicString.overwrite(
       call.start,
       call.end,
-      `${source.slice(call.start, call.end - 1)}{ trustedFastMode: true })`
+      initializedPluginCall(source.slice(call.start, call.callee.end), trustedFastMode)
     );
     return;
   }
@@ -278,33 +293,55 @@ function enableTrustedFastMode(magicString, source, call) {
   if (value.type !== "ObjectExpression") {
     throw new Error("SpotPatch init requires spotPatch options to be an object.");
   }
-  const property = findProperty(value, "trustedFastMode");
-  if (property !== void 0) {
-    const propertyValue = unwrapExpression(property.value);
+  if (value.properties.some((property) => property.type === "SpreadElement")) {
+    throw new Error(
+      "SpotPatch init cannot prove dataFlow through spread spotPatch options."
+    );
+  }
+  const dataFlowProperty = findProperty(value, "dataFlow");
+  const trustedFastModeProperty = findProperty(value, "trustedFastMode");
+  const missingProperties = [];
+  if (dataFlowProperty === void 0) {
+    missingProperties.push("dataFlow: {}");
+  } else {
+    const dataFlowValue = unwrapExpression(dataFlowProperty.value);
+    if (dataFlowValue.type === "Literal" && dataFlowValue.value === false) {
+      magicString.overwrite(dataFlowValue.start, dataFlowValue.end, "{}");
+    } else if (dataFlowValue.type !== "ObjectExpression") {
+      throw new Error(
+        "SpotPatch init requires dataFlow to be false or an options object."
+      );
+    }
+  }
+  if (trustedFastMode && trustedFastModeProperty === void 0) {
+    missingProperties.push("trustedFastMode: true");
+  } else if (trustedFastModeProperty !== void 0) {
+    const propertyValue = unwrapExpression(trustedFastModeProperty.value);
     if (propertyValue.type !== "Literal" || typeof propertyValue.value !== "boolean") {
       throw new Error(
         "SpotPatch init requires trustedFastMode to be a boolean literal."
       );
     }
-    if (!propertyValue.value) {
+    if (trustedFastMode && !propertyValue.value) {
       magicString.overwrite(propertyValue.start, propertyValue.end, "true");
     }
-    return;
   }
+  if (missingProperties.length === 0) return;
   const indent = childIndent(source, value);
   if (value.properties.length === 0) {
-    magicString.appendLeft(value.end - 1, " trustedFastMode: true ");
+    magicString.appendLeft(value.end - 1, ` ${missingProperties.join(", ")} `);
   } else {
     magicString.appendLeft(
       value.properties[0]?.start ?? value.end - 1,
-      `trustedFastMode: true,
+      `${missingProperties.join(`,
+${indent}`)},
 ${indent}`
     );
   }
 }
 function addPluginCall(magicString, source, config, pluginName, trustedFastModeAvailable) {
   const pluginsProperty = findProperty(config, "plugins");
-  const call = trustedFastCall(pluginName, trustedFastModeAvailable);
+  const call = initializedPluginCall(pluginName, trustedFastModeAvailable);
   if (pluginsProperty === void 0) {
     const indent = childIndent(source, config);
     if (config.properties.length === 0) {
@@ -329,14 +366,19 @@ ${indent}`
     throw new Error("SpotPatch init found duplicate spotPatch plugins.");
   }
   if (existing[0] !== void 0) {
-    if (trustedFastModeAvailable) {
-      enableTrustedFastMode(magicString, source, existing[0]);
-    }
+    enableInitializedOptions(
+      magicString,
+      source,
+      existing[0],
+      trustedFastModeAvailable
+    );
     return;
   }
   const first = value.elements.find((element) => element !== null);
   if (first === void 0) {
     magicString.appendLeft(value.end - 1, call);
+  } else if (!source.slice(value.start, first.start).includes("\n")) {
+    magicString.appendLeft(first.start, `${call}, `);
   } else {
     magicString.appendLeft(
       first.start,
@@ -353,10 +395,11 @@ function transformViteConfig(absolutePath, source, trustedFastModeAvailable) {
   const magicString = new MagicString(source);
   if (existingPluginName === void 0) {
     const specifier = pluginName === "spotPatch" ? "spotPatch" : `spotPatch as ${pluginName}`;
+    const quote = importQuote(source, program);
     insertStaticImport(
       magicString,
       program,
-      `import { ${specifier} } from ${JSON.stringify(ADAPTER_PACKAGE_NAME)};`
+      `import { ${specifier} } from ${quote}${ADAPTER_PACKAGE_NAME}${quote};`
     );
   }
   addPluginCall(magicString, source, config, pluginName, trustedFastModeAvailable);
@@ -433,6 +476,7 @@ async function checkViteIntegration(directory = process.cwd()) {
 import { spawn } from "child_process";
 import { access, readFile } from "fs/promises";
 import path2 from "path";
+var VERSION_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u;
 async function pathExists(absolutePath) {
   try {
     await access(absolutePath);
@@ -481,18 +525,33 @@ async function detectPackageManager(appRoot = process.cwd(), userAgent = process
     "SpotPatch setup could not determine npm or pnpm; run installation and init separately."
   );
 }
-function createInstallCommand(packageManager, platform = process.platform) {
+function createInstallCommand(packageManager, version, platform = process.platform) {
+  if (!VERSION_PATTERN.test(version)) {
+    throw new Error("SpotPatch setup could not determine its package version.");
+  }
+  const packageSpecifier = `@spotpatch/vite@${version}`;
   return Object.freeze({
     executable: platform === "win32" ? `${packageManager}.cmd` : packageManager,
     arguments: Object.freeze(
-      packageManager === "pnpm" ? ["add", "-D", "@spotpatch/vite@latest"] : ["install", "--save-dev", "@spotpatch/vite@latest"]
+      packageManager === "pnpm" ? ["add", "-D", packageSpecifier] : ["install", "--save-dev", packageSpecifier]
     )
   });
 }
-async function installLatestAdapter(packageManager, appRoot = process.cwd()) {
-  const command = createInstallCommand(packageManager);
+async function readCurrentAdapterVersion() {
+  const manifest = JSON.parse(
+    await readFile(new URL("../package.json", import.meta.url), "utf8")
+  );
+  const version = manifest.version;
+  if (typeof version !== "string" || !VERSION_PATTERN.test(version)) {
+    throw new Error("SpotPatch setup could not determine its package version.");
+  }
+  return version;
+}
+async function installCurrentAdapter(packageManager, appRoot = process.cwd()) {
+  const version = await readCurrentAdapterVersion();
+  const command = createInstallCommand(packageManager, version);
   process.stdout.write(
-    `[spotpatch:vite] installing @spotpatch/vite@latest with ${packageManager}...
+    `[spotpatch:vite] installing @spotpatch/vite@${version} with ${packageManager}...
 `
   );
   await new Promise((resolve, reject) => {
@@ -518,10 +577,10 @@ async function installLatestAdapter(packageManager, appRoot = process.cwd()) {
 }
 
 // src/cli.ts
-var VERSION_PATTERN = /^(\d+)\.(\d+)\.(\d+)(?:-[0-9A-Za-z.-]+)?$/u;
+var VERSION_PATTERN2 = /^(\d+)\.(\d+)\.(\d+)(?:-[0-9A-Za-z.-]+)?$/u;
 function writeUsage() {
   process.stderr.write(
-    "Usage: spotpatch-vite <setup|init|check>\n  setup  Install or upgrade @spotpatch/vite@latest, then initialize it.\n  init   Preview and apply safe Vite integration changes.\n  check  Verify the Vite integration without writing files.\n"
+    "Usage: spotpatch-vite <setup|init|check|connect|bridge>\n  setup  Install this CLI's exact @spotpatch/vite version, then initialize it.\n  init   Preview and apply safe Vite integration changes.\n  check  Verify the Vite integration without writing files.\n  connect codex  Start the zero-setup Codex Agent connector.\n  bridge Run the local external-Agent MCP, CLI, or setup commands.\n"
   );
 }
 async function inspectViteProject(appRoot = process.cwd()) {
@@ -542,7 +601,7 @@ async function inspectViteProject(appRoot = process.cwd()) {
   }
   const manifest = JSON.parse(await readFile2(viteManifestPath, "utf8"));
   const version = typeof manifest === "object" && manifest !== null && "version" in manifest && typeof manifest.version === "string" ? manifest.version : void 0;
-  const match = version === void 0 ? null : VERSION_PATTERN.exec(version);
+  const match = version === void 0 ? null : VERSION_PATTERN2.exec(version);
   const major = Number(match?.[1]);
   if (version === void 0 || match === null || !Number.isSafeInteger(major) || major < 5 || major >= 8) {
     throw new Error(
@@ -589,7 +648,7 @@ async function runSetup(arguments_) {
     throw new Error("SpotPatch setup does not accept positional arguments.");
   }
   const packageManager = await detectPackageManager();
-  await installLatestAdapter(packageManager);
+  await installCurrentAdapter(packageManager);
   return runInit([]);
 }
 async function runCheck(arguments_) {
@@ -623,6 +682,12 @@ async function main(arguments_) {
   if (command === "check") {
     return runCheck(rest);
   }
+  if (command === "bridge") {
+    return runSpotPatchBridgeCli(rest, { adapter: "vite" });
+  }
+  if (command === "connect") {
+    return runSpotPatchBridgeCli(arguments_, { adapter: "vite" });
+  }
   writeUsage();
   return 1;
 }