@tday-com/mcp 0.2.0 → 0.3.1

package/README.md

@@ -1,6 +1,6 @@
 # @tday-com/mcp
 
-Official local MCP server and installer for [tday.com](https://tday.com). Connect Claude Code, Cursor, Gemini CLI, Codex, and any MCP-compatible AI agent to your tday.com account so you can generate designs, manage brands, and query your workspace directly from chat.
+Official local MCP server and installer for [tday.com](https://tday.com). Connect Claude Code, Cursor, VS Code, Gemini CLI, Codex, and any MCP-compatible AI agent to your tday.com account so you can generate designs, make launch videos, manage brands, and query your workspace directly from chat.
 
 ## Install
 
@@ -16,7 +16,14 @@ pnpm dlx @tday-com/mcp install
 curl -fsSL https://tday.com/install.sh | bash
 ```
 
-The installer opens your browser, lets you sign in or sign up on tday.com, asks you to authorize this machine, then automatically configures supported agents. Claude Code, Cursor, and Gemini CLI get MCP config entries; Codex gets a TOML block to paste. No manual key copying is needed.
+The installer opens your browser, lets you sign in or sign up on tday.com, asks you to authorize this machine, then automatically configures supported agents. Claude Code, Cursor, Gemini CLI and VS Code (stable and Insiders, user `mcp.json`) get MCP config entries; Codex gets a TOML block to paste (the Codex app reads the same file). No manual key copying is needed.
+
+One install sets up everything your account can use, with one sign-in:
+
+- `tday`: this server (your account, brands, designs, launch videos).
+- `tday-capture`: [`@tday-com/capture`](https://www.npmjs.com/package/@tday-com/capture), which captures real UI from the app running on your machine for tday. Added when your account can capture. It reads the same `~/.tday/config.json`, so it needs no token of its own.
+
+Run `install` again whenever you want to update either, or after your account gains access to something new.
 
 ## Slash commands
 
@@ -27,6 +34,7 @@ Claude Code users get:
 - `/tday-brand` - create/list/view brands
 - `/tday-credits` - check your plan and credit balance
 - `/tday-ideas` - brainstorm brand-specific design ideas
+- `/tday-launch-video` - make a launch video of a feature: the one you name, or the newest one without a launch video (when your plan includes launch videos)
 
 ## MCP tools
 
@@ -37,10 +45,21 @@ Claude Code users get:
 - `tday_generate_design` - prompt + brandId
 - `tday_poll_generation` - poll until completed/failed
 - `tday_download_image` - save a completed image locally
-- `tday_search_knowledge_entries` / `tday_create_knowledge_entry` - read and record tday codebase knowledge entries (tday staff accounts only)
+- `tday_list_features` - a brand's features, newest first, with the launch videos each already has (`without: "launch_video"` lists the ones with none)
+- `tday_create_launch_video` - make a launch video of a feature (`featureId` from `tday_list_features`) or of a new subject (brandId, title, description)
+- `tday_poll_launch_video` / `tday_get_launch_video_mp4` / `tday_revise_launch_video` - follow a film until it is ready, get its MP4, or make a new cut from notes
 
 Generating a design spends credits from your organisation's balance, at the same price as in the app, and a failed generation gives them back. When the balance cannot cover a request, tday answers with a 402 and spends nothing; `tday_whoami` shows the balance and when it refreshes.
 
+Making a launch video spends credits the same way; `tday_get_credit_prices` lists every price.
+
+## MCP prompts
+
+Clients that list MCP prompts (Claude Code as `/mcp__tday__<name>`, VS Code as `/mcp.tday.<name>`) get:
+
+- `launch-video` - a launch video of the feature you name, or of the newest feature without one, quoted before it starts
+- `features` - the newest features and which already have a launch video
+
 All tools return structured content for modern MCP clients. They also accept optional `response_format: "json" | "markdown"` for the text payload; JSON remains the default for backward compatibility.
 
 ## One-shot CLI calls
@@ -69,7 +88,7 @@ The hosted connector uses OAuth + PKCE with refresh-token rotation. Users sign i
 - **What a connection can do.** The token an MCP connection holds only reaches the routes the tools above use. It cannot delete or transfer a brand, manage members, or see payment details.
 - **Links expire.** A link made by `install` lasts 90 days; run `install` again to renew it. A hosted connector's access token lasts an hour and renews itself for as long as the connection is used; one left unused for 30 days disconnects.
 - **Disconnect** any connection from tday Settings - Integrations.
-- **Telemetry is off by default.** Set `TDAY_MCP_TELEMETRY=1` to send this server's traces, metrics and logs (tool calls and their requests to tday, never your token or file contents) to help us debug.
+- **No telemetry.** The server talks only to tday, and to tday's file storage when you ask it to download an image or video.
 
 ## Manual MCP config
 
@@ -86,11 +105,11 @@ The hosted connector uses OAuth + PKCE with refresh-token rotation. Users sign i
 
 If you add this block yourself, run `npx -y @tday-com/mcp install` once afterward so the browser sign-in flow can link the server to your tday account automatically. `install` writes the entry pinned to its own version (`@tday-com/mcp@<version>`), so an agent never picks up a new release on its own; run `install` again to update. Pin the version in a block you write by hand too.
 
-For Gemini CLI, put the same `mcpServers.tday` object in `~/.gemini/settings.json`.
+For Gemini CLI, put the same `mcpServers.tday` object in `~/.gemini/settings.json`. VS Code's user `mcp.json` keys entries by `servers` and names the transport: `{ "servers": { "tday": { "type": "stdio", "command": "npx", "args": ["-y", "@tday-com/mcp", "serve"] } } }`.
 
 ## Claude Code slash commands
 
-The installer writes user-level Claude Code slash commands to `~/.claude/commands`. After restarting Claude Code, typing `/` shows `/tday`, `/tday-design`, `/tday-brand`, `/tday-credits`, and `/tday-ideas` in the slash-command autocomplete list.
+The installer writes user-level Claude Code slash commands to `~/.claude/commands`. After restarting Claude Code, typing `/` shows `/tday`, `/tday-design`, `/tday-brand`, `/tday-credits`, `/tday-ideas` and, where your plan includes launch videos, `/tday-launch-video` in the slash-command autocomplete list. A command your account no longer has is removed the next time you run `install`.
 
 ## Security model
 

package/dist/api-client.js

@@ -1,5 +1,3 @@
-// Authenticated HTTP client for the tday API plus small request/response
-// helpers shared by the tool handlers in tools.ts.
 export async function api(config, path, init = {}) {
     if (!config.token) {
         throw new Error("Not authenticated. Run `npx -y @tday-com/mcp install` to link this MCP server to your tday account in the browser, then restart your AI agent.");
@@ -9,8 +7,6 @@ export async function api(config, path, init = {}) {
     const timeout = setTimeout(() => controller.abort(), timeoutMs);
     if (typeof timeout === "object" && "unref" in timeout)
         timeout.unref();
-    // Forward caller cancellation into the timeout controller so both signals
-    // apply (AbortSignal.any needs Node 20.3+; engines allow >=18).
     const callerSignal = init.signal;
     if (callerSignal?.aborted)
         controller.abort(callerSignal.reason);
@@ -28,8 +24,6 @@ export async function api(config, path, init = {}) {
                 ...init.headers,
             },
         });
-        // A failed body read is not an empty acknowledgement. In particular, never
-        // repeat a mutation just because its successful response was interrupted.
         const text = await res.text();
         if (!res.ok) {
             throw new Error(formatHttpError(res.status, path, text, res.statusText));
@@ -46,7 +40,7 @@ export async function api(config, path, init = {}) {
     catch (err) {
         if (err instanceof Error && err.name === "AbortError") {
             if (callerSignal?.aborted)
-                throw err; // caller cancelled — not a timeout
+                throw err;
             throw new Error(`tday request timed out after ${timeoutMs / 1000}s: ${path}`);
         }
         throw err;
@@ -56,8 +50,6 @@ export async function api(config, path, init = {}) {
     }
 }
 function formatHttpError(status, path, text, statusText) {
-    // A 5xx body is where internal detail lives, so it is never shown. A 4xx contributes only its
-    // JSON `error` string, which the tday routes write for people to read.
     if (status >= 500) {
         return `tday ${status} ${path}. tday is temporarily unable to complete the request; retry shortly. If a design or launch video was already queued, keep polling it (tday_poll_generation or tday_poll_launch_video) rather than starting another.`;
     }
@@ -80,8 +72,6 @@ function formatHttpError(status, path, text, statusText) {
         case 401:
             return `${prefix}. This MCP server's tday link is missing, expired (links last 90 days) or was disconnected. Run \`npx -y @tday-com/mcp install\` to sign in and relink this machine, then restart your AI agent and retry tday_whoami.`;
         case 402:
-            // The body's sentence already says what the request needed and what is
-            // left; this only tells the agent what to do next. Nothing was spent.
             return `${prefix}. Nothing was started and no credits were spent. Do not retry until the balance changes.${linkLine ? ` ${linkLine}` : ""} Run tday_whoami for each organisation's balance and who owns it; tday_get_credit_prices has what things cost.`;
         case 403:
             return `${prefix}. The linked tday account, or this connection, is not allowed to do that. Use tday_whoami to verify the account, then list brands/designs again.`;
@@ -93,7 +83,6 @@ function formatHttpError(status, path, text, statusText) {
             return prefix;
     }
 }
-/** Refusals a plan or more credits resolves (web/src/lib/credits/refusal-links.ts). */
 const PLAN_CODES = new Set(["insufficient_credits", "plan_locked", "brand_plan_locked", "format_locked", "brand_limit_reached"]);
 const PLAN_REFUSAL_LEADS = {
     plan_locked: "This brand is locked by the organisation's plan.",
@@ -101,10 +90,6 @@ const PLAN_REFUSAL_LEADS = {
     format_locked: "The organisation's plan does not include this size; name another or omit it.",
     brand_limit_reached: "The organisation's plan does not include another brand.",
 };
-/**
- * The usage and billing links a plan refusal carries. Only https URLs on a tday host (or local
- * development) are repeated to the assistant; anything else in the body is dropped.
- */
 function refusalLinks(text) {
     try {
         const parsed = JSON.parse(text);
@@ -127,7 +112,6 @@ function tdayUrl(value) {
         return null;
     }
 }
-/** The refusal's machine-readable code (`insufficient_credits`, `plan_locked`, ...), when the body has one. */
 function errorCode(text) {
     if (!text)
         return null;
@@ -149,7 +133,6 @@ function formatErrorBody(text) {
             return message.slice(0, 300);
     }
     catch {
-        // Not JSON: nothing from it is shown.
     }
     return "";
 }

package/dist/cli.js

@@ -1,6 +1,4 @@
 #!/usr/bin/env node
-import { startObservability } from "./observability.js";
-startObservability();
 import { packageVersion } from "./package-info.js";
 import { runServer } from "./server.js";
 import { loadConfig } from "./config.js";
@@ -13,7 +11,6 @@ async function main() {
             await runServer();
             return;
         case "install":
-            // Lazy-load installer to keep `serve` cold-start tiny.
             const { runInstaller } = await import("./installer.js");
             await runInstaller(rest);
             return;

package/dist/config.js

@@ -37,16 +37,12 @@ async function readFirstConfig(paths) {
                 return parsed;
         }
         catch {
-            // Try the next location. Missing or invalid config should not crash the server;
-            // the first tool call will return an actionable authentication error instead.
         }
     }
     return null;
 }
 function normalizeBaseUrl(raw) {
     const trimmed = raw.trim().replace(/\/+$/, "");
-    // Many users naturally set TDAY_API_URL=https://tday.com/api. The MCP tools
-    // pass full route paths like /api/billing/info, so strip a trailing /api.
     return trimmed.replace(/\/api$/i, "");
 }
 function deriveWebBaseUrl(apiBaseUrl) {

package/dist/download-safety.js

@@ -1,10 +1,8 @@
 import { lstat, mkdir, realpath } from "node:fs/promises";
 import { dirname, isAbsolute, resolve, relative, sep } from "node:path";
-// Download safety: URL allowlist + path sandboxing + size cap for
-// tday_download_image (see tools.ts).
 export const ALLOWED_IMAGE_HOSTS = new Set([
     "cdn.tday.com",
-    "video-cdn.communities.one", // pre-2026 stored URLs
+    "video-cdn.communities.one",
     "communities.one",
     "media.brand.dev",
     "asset.brandfetch.io",
@@ -13,7 +11,7 @@ export const ALLOWED_IMAGE_HOSTS = new Set([
     "www.tday.com",
     "app.tday.com",
 ]);
-export const MAX_IMAGE_BYTES = 50 * 1024 * 1024; // 50 MB
+export const MAX_IMAGE_BYTES = 50 * 1024 * 1024;
 export function validateImageUrl(raw) {
     let url;
     try {
@@ -34,7 +32,6 @@ export function sandboxFilePath(raw) {
     const cwd = process.cwd();
     const resolved = resolve(cwd, raw);
     const rel = relative(cwd, resolved);
-    // Match ".." only as a full path segment — a file literally named "..foo" is inside cwd.
     if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel) || resolve(cwd, rel) !== resolved) {
         throw new Error(`File path must be inside the working directory. "${raw}" resolves outside of ${cwd}`);
     }

package/dist/installer-agents.js

@@ -1,172 +1,146 @@
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, dirname } from "node:path";
-import { pinnedPackageSpec } from "./package-info.js";
-const SERVER_NAME = "tday";
-// Command used inside each agent's MCP config. Uses npx -y so the user
-// doesn't need the package installed globally; -y skips the prompt. The
-// version is pinned to the installer's own (see pinnedPackageSpec).
+import { pinnedCaptureSpec, pinnedPackageSpec } from "./package-info.js";
+export const SERVER_NAME = "tday";
+export const CAPTURE_SERVER_NAME = "tday-capture";
 export function mcpCommand() {
     return {
         command: "npx",
         args: ["-y", pinnedPackageSpec(), "serve"],
     };
 }
-// --------------------------------------------------------------------------
-// Claude Code — JSON at ~/.claude.json
-// --------------------------------------------------------------------------
-function patchClaudeCode() {
-    const configPath = join(homedir(), ".claude.json");
-    if (!existsSync(configPath)) {
-        return {
-            id: "claude-code",
-            name: "Claude Code",
-            action: "skipped",
-            configPath,
-            message: `No Claude Code config found at ${configPath}. Install Claude Code first, then re-run \`tday install\`.`,
-        };
-    }
-    let raw;
-    try {
-        raw = readFileSync(configPath, "utf8");
-    }
-    catch (err) {
-        return {
-            id: "claude-code",
-            name: "Claude Code",
-            action: "skipped",
-            configPath,
-            message: `Could not read ${configPath}: ${err.message}`,
-        };
-    }
-    let config;
-    try {
-        config = raw.trim() ? JSON.parse(raw) : {};
-    }
-    catch (err) {
-        return {
-            id: "claude-code",
-            name: "Claude Code",
-            action: "skipped",
-            configPath,
-            message: `Existing ${configPath} is not valid JSON (${err.message}). Fix it or patch manually.`,
-        };
-    }
-    const mcpServers = getMcpServers(config);
-    mcpServers[SERVER_NAME] = mcpCommand();
-    config.mcpServers = mcpServers;
-    writeFileAtomic(configPath, JSON.stringify(config, null, 2) + "\n");
+export function captureCommand() {
+    return {
+        command: "npx",
+        args: ["-y", pinnedCaptureSpec(), "mcp"],
+    };
+}
+export function serverEntries(servers) {
+    return {
+        [SERVER_NAME]: mcpCommand(),
+        ...(servers.capture ? { [CAPTURE_SERVER_NAME]: captureCommand() } : {}),
+    };
+}
+function serverList(servers) {
+    return servers.capture ? `"${SERVER_NAME}" and "${CAPTURE_SERVER_NAME}" MCP servers` : `"${SERVER_NAME}" MCP server`;
+}
+const plainEntry = (server) => ({ ...server });
+const vscodeEntry = (server) => ({ type: "stdio", ...server });
+function claudeCodeTarget(home) {
+    const configPath = join(home, ".claude.json");
     return {
         id: "claude-code",
         name: "Claude Code",
-        action: "patched",
         configPath,
-        message: `Added "${SERVER_NAME}" MCP server to ${configPath}.`,
+        installDir: home,
+        requireFile: true,
+        missing: `No Claude Code config found at ${configPath}. Install Claude Code first, then re-run \`tday install\`.`,
+        key: "mcpServers",
+        entry: plainEntry,
     };
 }
-// --------------------------------------------------------------------------
-// Cursor — JSON at ~/.cursor/mcp.json
-// --------------------------------------------------------------------------
-function patchCursor() {
-    const cursorDir = join(homedir(), ".cursor");
-    const configPath = join(cursorDir, "mcp.json");
-    if (!existsSync(cursorDir)) {
-        return {
-            id: "cursor",
-            name: "Cursor",
-            action: "skipped",
-            configPath,
-            message: `No Cursor install detected (${cursorDir} missing).`,
-        };
-    }
-    let config = {};
-    if (existsSync(configPath)) {
-        try {
-            const raw = readFileSync(configPath, "utf8");
-            config = raw.trim() ? JSON.parse(raw) : {};
-        }
-        catch (err) {
-            return {
-                id: "cursor",
-                name: "Cursor",
-                action: "skipped",
-                configPath,
-                message: `Existing ${configPath} is not valid JSON (${err.message}).`,
-            };
-        }
-    }
-    const mcpServers = getMcpServers(config);
-    mcpServers[SERVER_NAME] = mcpCommand();
-    config.mcpServers = mcpServers;
-    writeFileAtomic(configPath, JSON.stringify(config, null, 2) + "\n");
+function cursorTarget(home) {
+    const installDir = join(home, ".cursor");
     return {
         id: "cursor",
         name: "Cursor",
-        action: "patched",
-        configPath,
-        message: `Added "${SERVER_NAME}" MCP server to ${configPath}.`,
+        configPath: join(installDir, "mcp.json"),
+        installDir,
+        missing: `No Cursor install detected (${installDir} missing).`,
+        key: "mcpServers",
+        entry: plainEntry,
+    };
+}
+function geminiTarget(home) {
+    const installDir = join(home, ".gemini");
+    return {
+        id: "gemini-cli",
+        name: "Gemini CLI",
+        configPath: join(installDir, "settings.json"),
+        installDir,
+        missing: `No Gemini CLI config directory detected (${installDir} missing).`,
+        key: "mcpServers",
+        entry: plainEntry,
     };
 }
-// --------------------------------------------------------------------------
-// Gemini CLI — JSON at ~/.gemini/settings.json
-// Gemini CLI follows the common MCP config shape with a top-level mcpServers
-// object, matching Cursor/Claude-style entries.
-// --------------------------------------------------------------------------
-function patchGeminiCli() {
-    const geminiDir = join(homedir(), ".gemini");
-    const configPath = join(geminiDir, "settings.json");
-    if (!existsSync(geminiDir)) {
+export function vscodeTargets(home, platform = process.platform, env = process.env) {
+    const base = platform === "darwin"
+        ? join(home, "Library", "Application Support")
+        : platform === "win32"
+            ? env.APPDATA || join(home, "AppData", "Roaming")
+            : env.XDG_CONFIG_HOME || join(home, ".config");
+    return [
+        { id: "vscode", name: "VS Code", app: "Code" },
+        { id: "vscode-insiders", name: "VS Code Insiders", app: "Code - Insiders" },
+    ].map(({ id, name, app }) => {
+        const installDir = join(base, app, "User");
         return {
-            id: "gemini-cli",
-            name: "Gemini CLI",
-            action: "skipped",
-            configPath,
-            message: `No Gemini CLI config directory detected (${geminiDir} missing).`,
+            id: id,
+            name,
+            configPath: join(installDir, "mcp.json"),
+            installDir,
+            missing: `No ${name} install detected (${installDir} missing).`,
+            key: "servers",
+            entry: vscodeEntry,
         };
-    }
+    });
+}
+function jsonTargets(home, env) {
+    return [claudeCodeTarget(home), cursorTarget(home), geminiTarget(home), ...vscodeTargets(home, process.platform, env)];
+}
+function patchJson(target, servers) {
+    const { id, name, configPath } = target;
+    const skipped = (message) => ({ id, name, action: "skipped", configPath, message });
+    if (!existsSync(target.installDir) || (target.requireFile && !existsSync(configPath)))
+        return skipped(target.missing);
     let config = {};
     if (existsSync(configPath)) {
+        let raw;
+        try {
+            raw = readFileSync(configPath, "utf8");
+        }
+        catch (err) {
+            return skipped(`Could not read ${configPath}: ${err.message}`);
+        }
         try {
-            const raw = readFileSync(configPath, "utf8");
             config = raw.trim() ? JSON.parse(raw) : {};
         }
         catch (err) {
-            return {
-                id: "gemini-cli",
-                name: "Gemini CLI",
-                action: "skipped",
-                configPath,
-                message: `Existing ${configPath} is not valid JSON (${err.message}).`,
-            };
+            return skipped(`Existing ${configPath} is not valid JSON (${err.message}). Fix it or patch manually.`);
         }
+        if (!isPlainRecord(config))
+            return skipped(`Existing ${configPath} is not a JSON object. Fix it or patch manually.`);
     }
-    const mcpServers = getMcpServers(config);
-    mcpServers[SERVER_NAME] = mcpCommand();
-    config.mcpServers = mcpServers;
+    const existing = config[target.key];
+    const entries = isPlainRecord(existing) ? existing : {};
+    for (const [server, entry] of Object.entries(serverEntries(servers)))
+        entries[server] = target.entry(entry);
+    config[target.key] = entries;
     writeFileAtomic(configPath, JSON.stringify(config, null, 2) + "\n");
-    return {
-        id: "gemini-cli",
-        name: "Gemini CLI",
-        action: "patched",
-        configPath,
-        message: `Added "${SERVER_NAME}" MCP server to ${configPath}.`,
-    };
+    return { id, name, action: "patched", configPath, message: `Added ${serverList(servers)} to ${configPath}.` };
 }
-// --------------------------------------------------------------------------
-// Codex — TOML at ~/.codex/config.toml
-// We avoid parsing TOML to keep zero runtime deps; instead, print the
-// block so the user can paste it in. Safer than corrupting a user's file.
-// --------------------------------------------------------------------------
-function patchCodex() {
-    const codexDir = join(homedir(), ".codex");
-    const configPath = join(codexDir, "config.toml");
-    const block = [
-        ``,
-        `[mcp_servers."${SERVER_NAME}"]`,
-        `command = "npx"`,
-        `args = ["-y", "${pinnedPackageSpec()}", "serve"]`,
+function previewJson(target, servers) {
+    const { id, name, configPath } = target;
+    if (!existsSync(target.installDir) || (target.requireFile && !existsSync(configPath))) {
+        return { id, name, action: "skipped", configPath, message: target.missing };
+    }
+    return { id, name, action: "patched", configPath, message: `Would add ${serverList(servers)} to ${configPath}.` };
+}
+export function codexBlock(servers) {
+    return Object.entries(serverEntries(servers))
+        .map(([server, entry]) => [
         ``,
-    ].join("\n");
+        `[mcp_servers."${server}"]`,
+        `command = "${entry.command}"`,
+        `args = [${entry.args.map((arg) => `"${arg}"`).join(", ")}]`,
+    ].join("\n"))
+        .join("\n")
+        .concat("\n");
+}
+function patchCodex(home, servers) {
+    const codexDir = join(home, ".codex");
+    const configPath = join(codexDir, "config.toml");
     if (!existsSync(codexDir)) {
         return {
             id: "codex",
@@ -181,93 +155,35 @@ function patchCodex() {
         name: "Codex",
         action: "manual",
         configPath,
-        message: `Append the following block to ${configPath}:\n${block}\n` +
+        message: `Append the following block to ${configPath}:\n${codexBlock(servers)}\n` +
             `(Codex uses TOML; we don't auto-edit it to avoid corrupting your config.)`,
     };
 }
-// --------------------------------------------------------------------------
-// Runner
-// --------------------------------------------------------------------------
-export function patchAllAgents() {
-    return [patchClaudeCode(), patchCursor(), patchGeminiCli(), patchCodex()];
-}
-// Preview what patchAllAgents would do without touching the filesystem.
-// Used by `tday install --dry-run`.
-export function previewAllAgents() {
-    const home = homedir();
-    const claudePath = join(home, ".claude.json");
-    const cursorPath = join(home, ".cursor", "mcp.json");
-    const geminiPath = join(home, ".gemini", "settings.json");
+function previewCodex(home) {
     const codexPath = join(home, ".codex", "config.toml");
+    return existsSync(join(home, ".codex"))
+        ? { id: "codex", name: "Codex", action: "manual", configPath: codexPath, message: `Would print TOML block for ${codexPath} (manual append).` }
+        : { id: "codex", name: "Codex", action: "skipped", configPath: codexPath, message: `No Codex install detected.` };
+}
+export function patchAllAgents(servers = { capture: false }, home = homedir(), env = process.env) {
+    const [claude, cursor, gemini, ...vscode] = jsonTargets(home, env);
     return [
-        existsSync(claudePath)
-            ? {
-                id: "claude-code",
-                name: "Claude Code",
-                action: "patched",
-                configPath: claudePath,
-                message: `Would add "${SERVER_NAME}" MCP server to ${claudePath}.`,
-            }
-            : {
-                id: "claude-code",
-                name: "Claude Code",
-                action: "skipped",
-                configPath: claudePath,
-                message: `No Claude Code config at ${claudePath}.`,
-            },
-        existsSync(join(home, ".cursor"))
-            ? {
-                id: "cursor",
-                name: "Cursor",
-                action: "patched",
-                configPath: cursorPath,
-                message: `Would add "${SERVER_NAME}" MCP server to ${cursorPath}.`,
-            }
-            : {
-                id: "cursor",
-                name: "Cursor",
-                action: "skipped",
-                configPath: cursorPath,
-                message: `No Cursor install detected.`,
-            },
-        existsSync(join(home, ".gemini"))
-            ? {
-                id: "gemini-cli",
-                name: "Gemini CLI",
-                action: "patched",
-                configPath: geminiPath,
-                message: `Would add "${SERVER_NAME}" MCP server to ${geminiPath}.`,
-            }
-            : {
-                id: "gemini-cli",
-                name: "Gemini CLI",
-                action: "skipped",
-                configPath: geminiPath,
-                message: `No Gemini CLI config directory detected.`,
-            },
-        existsSync(join(home, ".codex"))
-            ? {
-                id: "codex",
-                name: "Codex",
-                action: "manual",
-                configPath: codexPath,
-                message: `Would print TOML block for ${codexPath} (manual append).`,
-            }
-            : {
-                id: "codex",
-                name: "Codex",
-                action: "skipped",
-                configPath: codexPath,
-                message: `No Codex install detected.`,
-            },
+        patchJson(claude, servers),
+        patchJson(cursor, servers),
+        patchJson(gemini, servers),
+        patchCodex(home, servers),
+        ...vscode.map((target) => patchJson(target, servers)),
     ];
 }
-function getMcpServers(config) {
-    const existing = config.mcpServers;
-    if (isPlainRecord(existing)) {
-        return existing;
-    }
-    return {};
+export function previewAllAgents(servers = { capture: false }, home = homedir(), env = process.env) {
+    const [claude, cursor, gemini, ...vscode] = jsonTargets(home, env);
+    return [
+        previewJson(claude, servers),
+        previewJson(cursor, servers),
+        previewJson(gemini, servers),
+        previewCodex(home),
+        ...vscode.map((target) => previewJson(target, servers)),
+    ];
 }
 function isPlainRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);

package/dist/installer-callback.js

@@ -1,8 +1,4 @@
 import http from "node:http";
-// Boots a loopback HTTP server on a random free port, resolves once the
-// /cli/auth browser page returns its authorization payload, and rejects on
-// timeout or malformed payloads. Binds 127.0.0.1 only so no remote host can
-// reach it.
 export async function startCallbackServer(options) {
     let resolve;
     let reject;
@@ -58,9 +54,6 @@ export async function startCallbackServer(options) {
             }
             const payload = parsed;
             if (payload.state !== options.expectedState) {
-                // Do not reject the whole installer on a bad local POST. A different
-                // local process can hit the loopback listener, so keep waiting for the
-                // browser page carrying the expected nonce until timeout.
                 res.statusCode = 400;
                 res.end("state mismatch");
                 return;