bridgerator 0.0.0-stage → 1.0.5

package/LICENSE

@@ -0,0 +1,24 @@
+MIT License
+
+Copyright (c) 2026 Bridgerator contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+Bundled dependency: Desktop Commander (https://github.com/wonderwhy-er/DesktopCommanderMCP),
+MIT License, Copyright (c) 2024-2025 Eduard Ruzga and Desktop Commander Contributors.

package/README.md

@@ -1,3 +1,107 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+# Bridgerator
+
+Connect your Windows PC to ChatGPT. The assistant can read and edit files, search folders and run
+PowerShell commands on **your** computer — through a bridge that only makes an **outbound**
+connection. No inbound ports, no remote-desktop software.
+
+```
+ChatGPT ──OAuth 2.1 + MCP (HTTPS)──► relay (mcp.bridgerator.recondeck.com) ──WebSocket──► bridgerator on your PC ──stdio──► bundled MCP engine
+```
+
+This repository is the part that runs on your PC. It is small on purpose so you (or an AI agent
+installing it for you) can read all of it: `src/bridge.mjs` (forwarder), `src/policy.mjs` (access
+rules), `src/dc-isolate.mjs` (separate engine config), `src/cli.mjs` (setup/autostart), `install.ps1` (installer).
+
+## What people use it for
+
+- "Sort my Downloads folder by type and month" — ChatGPT lists, plans and moves the files on your PC.
+- "Find every invoice PDF in Documents and rename it by date" — search and rename in plain words.
+- "Why is drive C almost full?" — disk usage, big folders, what is safe to delete.
+- "Check the event log for errors since yesterday" / "Read the end of this log" — diagnostics.
+- Work on code: "explain how D:\\Projects\\app is built and run its tests".
+
+Everything runs as your Windows user and only inside the folders you allow.
+
+## Plans
+
+Free: 15,000 tool calls per month per account, any number of PCs. Pro: $10/month, unlimited.
+Details: https://bridgerator.recondeck.com/pricing
+
+## Install (Windows)
+
+1. Create an account and a device key at https://bridgerator.recondeck.com.
+2. In PowerShell (no admin rights needed):
+   ```powershell
+   & ([scriptblock]::Create((irm https://bridgerator.recondeck.com/install.ps1))) -Token <device key>
+   ```
+   It downloads portable Node.js LTS if missing (checksum-verified, no admin), installs this package and runs `bridgerator setup`.
+   Update later with the same line without `-Token` (the key and folder settings are kept).
+   Prefer to read first? Download `install.ps1`, read it, run it with `-Token`.
+3. In ChatGPT: Settings → Apps & Connectors → Advanced → Developer mode → Create → URL
+   `https://mcp.bridgerator.recondeck.com/mcp`, authentication OAuth, sign in with your account.
+
+Manual install (PowerShell): `$env:PUPPETEER_SKIP_DOWNLOAD=1; npm install -g bridgerator`, then `bridgerator setup --token <key>`. The variable skips a ~700 MB Chrome download that only PDF export needs; PDF export fetches a browser itself on first use.
+
+## Access rules — what the assistant can and cannot touch
+
+Config: `%APPDATA%\Bridgerator\config.json` (written by `setup`, edit and restart to change).
+
+| Key | Meaning | Default |
+|---|---|---|
+| `allowedDirectories` | File tools work only inside these folders (enforced by the engine). Empty = whole disk. | your user folder |
+| `deniedDirectories` | Folders excluded **inside** the allowed ones (enforced by Bridgerator, see below). | `~\.ssh`, `~\AppData` |
+| `blockedCommands` | Commands the engine refuses to run. Leave it out to keep the built-in list. | built-in list (`format`, `diskpart`, `reg`, `net`, `sc`, `runas`, `netsh`, `takeown`, …) |
+| `disabledTools` | Tools never shown to the assistant, e.g. `["start_process","interact_with_process"]` to turn the terminal off. | none |
+
+Full file, search and terminal toolset, including ChatGPT widgets (file preview,
+config view). Hidden: `set_config_value` (would let the assistant change its own limits), feedback and
+usage-stats tools.
+
+How exclusions work (`src/policy.mjs`): every path argument is resolved (symlinks and junctions
+included) and refused if it lies inside an excluded folder; result lines that mention an excluded
+path (search hits, recursive listings) are removed; `set_config_value` is never exposed, so the
+assistant cannot change these limits.
+
+⚠ **The terminal is not a folder sandbox.** A shell command runs with your Windows user's rights
+and can read anything you can. Bridgerator refuses commands that literally name an excluded folder,
+but that is a courtesy, not a boundary. If folder limits must be strict, add the terminal tools to
+`disabledTools`.
+
+The bridge runs as **your** Windows user (hidden scheduled task at logon), never as SYSTEM.
+
+Bridgerator gives its bundled engine its **own** config folder (`%APPDATA%\Bridgerator\dc`, see `src/dc-isolate.mjs`): if you already run the same open-source MCP server for Claude or another app, its settings and folder limits are not touched. The engine keeps a local log of recent tool calls in that folder; it never leaves your PC.
+
+## Commands
+
+```
+bridgerator setup --token <key> [--allow <dir>]... [--deny <dir>]...   # config + autostart + start
+bridgerator run                                                       # foreground (what autostart runs)
+bridgerator status                                                    # config (token masked) + log tail
+bridgerator uninstall                                                 # stop + remove autostart
+```
+Log: `%APPDATA%\Bridgerator\bridge.log`. Stopping the bridge cuts access immediately.
+
+## Privacy
+
+File contents and command output go to ChatGPT (OpenAI) as tool results; the relay forwards them
+in memory and does not store them. Engine telemetry, remote feature flags and any browser pop-ups are turned off by the bridge.
+Policy: https://bridgerator.recondeck.com/privacy
+
+## Development
+
+`npm test` — policy unit tests plus an end-to-end run against the real bundled engine
+(throw-away folders; asserts that an existing config of the same engine stays byte-identical).
+
+## License
+
+MIT. The bundled open-source MCP engine is MIT-licensed as well; its copyright notice is kept in
+`LICENSE` and the dependency is listed in `package.json`.
+
+---
+
+### По-русски коротко
+Bridgerator подключает ваш ПК к ChatGPT: файлы, поиск, терминал. Мост только исходящий, входящих
+портов нет. Установка — одна строка PowerShell с ключом устройства из кабинета (см. выше).
+Разрешённые папки — `allowedDirectories`, исключения внутри них — `deniedDirectories`
+(исключения обеспечивает сам Bridgerator). Терминал папками не
+ограничивается — для строгих границ выключите его через `disabledTools`.

package/install.ps1

@@ -0,0 +1,81 @@
+# Bridgerator installer for Windows (PowerShell 5.1+). Source: npm package "bridgerator" (https://www.npmjs.com/package/bridgerator)
+# Usage (one line, from your Bridgerator account page):
+#   & ([scriptblock]::Create((irm https://bridgerator.recondeck.com/install.ps1))) -Token <device key>
+# Update an installed bridge (keeps its key and folders): the same line without -Token.
+# What it does: installs Node.js LTS if missing (portable zip, no admin), installs the bridgerator npm package,
+# then runs `bridgerator setup` (config + hidden autostart at logon for THIS user, no admin rights),
+# then opens the welcome page in the default browser (skip with -NoBrowser).
+param(
+  [string]$Token,
+  [string]$Package = 'https://bridgerator.recondeck.com/bridgerator.tgz',
+  [string[]]$Allow,
+  [string[]]$Deny,
+  [switch]$NoBrowser
+)
+$ErrorActionPreference = 'Stop'
+if (-not $Token -and -not (Test-Path (Join-Path $env:APPDATA 'Bridgerator\config.json'))) { throw 'Add -Token <device key> from your Bridgerator account page (https://bridgerator.recondeck.com/app).' }
+
+function Refresh-Path {
+  $env:Path = [Environment]::GetEnvironmentVariable('Path', 'Machine') + ';' + [Environment]::GetEnvironmentVariable('Path', 'User')
+}
+
+[Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
+$ProgressPreference = 'SilentlyContinue'
+
+# No winget on many clean Windows installs: take the official Node.js LTS zip into the user's
+# profile (no admin rights), checked against nodejs.org SHASUMS256, and put it on the user PATH.
+function Install-PortableNode {
+  $dir = Join-Path $env:LOCALAPPDATA 'Bridgerator\node'
+  $arch = if ($env:PROCESSOR_ARCHITECTURE -eq 'ARM64') { 'arm64' } else { 'x64' }
+  $rel = (Invoke-RestMethod 'https://nodejs.org/dist/index.json') | Where-Object { $_.lts -and ($_.files -contains "win-$arch-zip") } | Select-Object -First 1
+  if (-not $rel) { throw 'Could not find a Node.js LTS build. Install Node.js 20+ from https://nodejs.org and run this again.' }
+  $name = "node-$($rel.version)-win-$arch"
+  Write-Host "Node.js not found - downloading Node.js $($rel.version) into $dir ..."
+  $tmp = Join-Path $env:TEMP "bridgerator-$([guid]::NewGuid().ToString('N'))"
+  New-Item -ItemType Directory -Path $tmp | Out-Null
+  try {
+    $zip = Join-Path $tmp "$name.zip"
+    Invoke-WebRequest "https://nodejs.org/dist/$($rel.version)/$name.zip" -OutFile $zip -UseBasicParsing
+    $sums = (Invoke-WebRequest "https://nodejs.org/dist/$($rel.version)/SHASUMS256.txt" -UseBasicParsing).Content
+    $want = ($sums -split "`n" | Where-Object { $_ -match "\s$name\.zip$" }) -replace '\s.*$', ''
+    $got = (Get-FileHash $zip -Algorithm SHA256).Hash
+    if (-not $want -or $got -ne $want.Trim().ToUpper()) { throw 'Node.js download failed the checksum check.' }
+    Write-Host 'Node.js checksum OK (SHA256, nodejs.org)'
+    Expand-Archive $zip -DestinationPath $tmp -Force
+    if (Test-Path $dir) { Remove-Item $dir -Recurse -Force }
+    New-Item -ItemType Directory -Path (Split-Path $dir) -Force | Out-Null
+    Move-Item (Join-Path $tmp $name) $dir
+  } finally { Remove-Item $tmp -Recurse -Force -ErrorAction SilentlyContinue }
+  $userPath = [Environment]::GetEnvironmentVariable('Path', 'User')
+  if (($userPath -split ';') -notcontains $dir) { [Environment]::SetEnvironmentVariable('Path', (@($dir, $userPath) | Where-Object { $_ }) -join ';', 'User') }
+  Refresh-Path
+}
+
+if (-not (Get-Command node -ErrorAction SilentlyContinue)) { Install-PortableNode }
+$major = [int]((& node -v).TrimStart('v').Split('.')[0])
+if ($major -lt 20) { throw "Node.js 20+ required, found $(& node -v). Update from https://nodejs.org" }
+
+# The engine's PDF export brings puppeteer, whose postinstall downloads Chrome (~700 MB);
+# skipped here, PDF export fetches a browser itself the first time it is used.
+$env:PUPPETEER_SKIP_DOWNLOAD = '1'
+Write-Host "Installing bridgerator from $Package ..."
+& npm install -g $Package --no-audit --no-fund --loglevel=error
+if ($LASTEXITCODE -ne 0) { throw 'npm install failed' }
+Refresh-Path
+
+$setupArgs = @('setup')
+if ($Token) { $setupArgs += @('--token', $Token) }
+foreach ($a in $Allow) { $setupArgs += @('--allow', $a) }
+foreach ($d in $Deny) { $setupArgs += @('--deny', $d) }
+& bridgerator @setupArgs
+if ($LASTEXITCODE -ne 0) { throw 'bridgerator setup failed' }
+Write-Host 'Done. Check with: bridgerator status'
+
+# Next steps (connect ChatGPT, example prompts) on the welcome page; skipped for -NoBrowser and
+# non-interactive sessions (scheduled tasks, remote shells). Never fails the install.
+$welcome = 'https://bridgerator.recondeck.com/welcome/'
+if (-not $NoBrowser -and [Environment]::UserInteractive) {
+  try { Start-Process $welcome } catch { Write-Host "Next steps: $welcome" }
+} else {
+  Write-Host "Next steps: $welcome"
+}

package/package.json

@@ -1,6 +1,49 @@
-{
-  "name": "bridgerator",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+{
+  "name": "bridgerator",
+  "version": "1.0.5",
+  "description": "Connect ChatGPT to your Windows PC: files, search and terminal through an outbound-only bridge with folder limits. No inbound ports, no admin rights.",
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "bridgerator": "src/cli.mjs"
+  },
+  "files": [
+    "src",
+    "install.ps1",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "start": "node src/cli.mjs run",
+    "test": "node --test"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@wonderwhy-er/desktop-commander": "0.2.52",
+    "ws": "^8.20.0"
+  },
+  "homepage": "https://bridgerator.recondeck.com",
+  "keywords": [
+    "chatgpt",
+    "mcp",
+    "mcp-server",
+    "model-context-protocol",
+    "windows",
+    "chatgpt-connector",
+    "ai-assistant",
+    "remote-files",
+    "powershell",
+    "openai",
+    "apps-sdk",
+    "desktop-automation",
+    "local-files",
+    "bridge"
+  ],
+  "bugs": {
+    "url": "https://bridgerator.recondeck.com/support"
+  },
+  "author": "Bridgerator <info@recondeck.com>"
+}

package/src/bridge.mjs

@@ -0,0 +1,96 @@
+// Bridgerator bridge: runs on the user's PC.
+//   - starts the bundled open-source Desktop Commander MCP server as a child over stdio;
+//   - pushes this PC's limits (allowedDirectories, blockedCommands) into it at startup;
+//   - opens ONE outbound WebSocket to the relay (no inbound port is opened on this PC);
+//   - forwards each relay `call` through the policy (excluded folders, disabled tools) to Desktop
+//     Commander and sends the filtered result back.
+import { createRequire } from 'node:module';
+import WebSocket from 'ws';
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
+import { createPolicy, debrand } from './policy.mjs';
+import { showNotice } from './notice.mjs';
+
+const RECONNECT_MS = 5000;
+const DC_ENTRY = createRequire(import.meta.url).resolve('@wonderwhy-er/desktop-commander/dist/index.js');
+const ISOLATE = new URL('./dc-isolate.mjs', import.meta.url).href;
+
+export async function startDesktopCommander(cfg, log = console.log) {
+  if (!cfg.dcConfigDir) throw new Error('dcConfigDir missing');
+  const transport = new StdioClientTransport({
+    command: process.execPath,
+    // Own Desktop Commander config (dc-isolate.mjs): a DC the user runs elsewhere keeps its limits.
+    args: ['--import', ISOLATE, DC_ENTRY],
+    // No calls home: telemetry kill-switch, and remote feature flags (onboarding page, promo text
+    // injected into tool results, A/B tests) replaced by an empty local set.
+    env: { ...process.env, DC_TELEMETRY_ENABLED: 'false', DESKTOP_COMMANDER_DISABLE_TELEMETRY: '1', DC_FLAG_URL: 'data:application/json,{"flags":{}}', BRIDGERATOR_DC_CONFIG_DIR: cfg.dcConfigDir },
+    stderr: 'ignore',
+  });
+  const client = new Client({ name: 'bridgerator', version: '1.0.0' }, { capabilities: {} });
+  await client.connect(transport);
+  // The PC owner's limits go into Desktop Commander's own config; the model can't change them
+  // (set_config_value is never exposed to the relay, see policy.ALWAYS_HIDDEN).
+  const set = (key, value) => client.callTool({ name: 'set_config_value', arguments: { key, value } });
+  await set('allowedDirectories', cfg.allowedDirectories || []);
+  if (Array.isArray(cfg.blockedCommands)) await set('blockedCommands', cfg.blockedCommands);
+  await set('telemetryEnabled', false);
+  const policy = createPolicy(cfg);
+  const { tools } = await client.listTools();
+  const visible = tools.filter(policy.visible).map(debrand);
+  // MCP Apps widgets (file preview, config view) — served to ChatGPT through the relay as-is.
+  const resources = ((await client.listResources().catch(() => ({ resources: [] }))).resources || []).map(debrand);
+  const resourceUris = new Set(resources.map((r) => r.uri));
+  log(`[bridgerator] engine up: ${visible.length} tools; allowed=${JSON.stringify(cfg.allowedDirectories || [])} excluded=${JSON.stringify(cfg.deniedDirectories || [])}`);
+  if (!(cfg.allowedDirectories || []).length) log('[bridgerator] WARNING: allowedDirectories is empty — file tools can reach the whole disk');
+
+  async function call(name, args) {
+    const refusal = policy.check(name, args);
+    if (refusal) return { content: [{ type: 'text', text: refusal }], isError: true };
+    try {
+      // Results are NOT debranded: they carry the user's own file contents verbatim.
+      return policy.filter(await client.callTool({ name, arguments: args || {} }), name, args);
+    } catch (e) {
+      return { content: [{ type: 'text', text: `bridge error: ${e?.message || e}` }], isError: true };
+    }
+  }
+  async function readResource(uri) {
+    if (!resourceUris.has(uri)) return { error: 'unknown resource' };
+    try { return { result: debrand(await client.readResource({ uri })) }; } catch (e) { return { error: String(e?.message || e) }; }
+  }
+  return { client, tools: visible, resources, call, readResource, close: () => client.close() };
+}
+
+export function connect(cfg, dc, log = console.log) {
+  const ws = new WebSocket(cfg.relay, { handshakeTimeout: 15000 });
+  let alive = false;
+  ws.on('open', () => {
+    alive = true;
+    ws.send(JSON.stringify({ type: 'hello', token: cfg.token, tools: dc.tools, resources: dc.resources }));
+    log('[bridgerator] linked to relay, waiting for calls');
+  });
+  ws.on('message', async (raw) => {
+    let msg; try { msg = JSON.parse(raw); } catch { return; }
+    if (msg.type === 'welcome') { log(`[bridgerator] registered as "${msg.device}"`); return; }
+    if (msg.type === 'notice') { showNotice(msg, log); return; }
+    if (msg.type === 'read_resource' && msg.callId) {
+      const r = await dc.readResource(msg.uri);
+      if (ws.readyState === ws.OPEN) ws.send(JSON.stringify({ type: 'result', callId: msg.callId, ...r }));
+      return;
+    }
+    if (msg.type !== 'call' || !msg.callId) return;
+    const result = await dc.call(msg.name, msg.args || {});
+    if (ws.readyState === ws.OPEN) ws.send(JSON.stringify({ type: 'result', callId: msg.callId, result }));
+  });
+  const die = (why) => {
+    if (ws._down) return;
+    ws._down = true;
+    log(`[bridgerator] disconnected (${why}); reconnecting in ${RECONNECT_MS / 1000}s`);
+    setTimeout(() => connect(cfg, dc, log), RECONNECT_MS);
+  };
+  ws.on('close', (code) => {
+    if (code === 4003) { log('[bridgerator] relay rejected the device token — run `bridgerator setup --token <new token>`'); process.exit(2); }
+    die(`close ${code}`);
+  });
+  ws.on('error', (e) => { if (!alive) die(`connect: ${e.message}`); });
+  return ws;
+}

package/src/cli.mjs

@@ -0,0 +1,131 @@
+#!/usr/bin/env node
+// bridgerator setup --token <t> [--relay <wss url>] [--allow <dir>]... [--deny <dir>]...  → config + autostart + start
+// bridgerator run | status | uninstall
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawn, execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { startDesktopCommander, connect } from './bridge.mjs';
+
+const DEFAULT_RELAY = 'wss://mcp.bridgerator.recondeck.com/link';
+const TASK = 'Bridgerator';
+const home = os.homedir();
+const DIR = process.env.BRIDGERATOR_HOME || path.join(process.env.APPDATA || path.join(home, '.config'), 'Bridgerator');
+const CONFIG = path.join(DIR, 'config.json');
+const LOG = path.join(DIR, 'bridge.log');
+const SELF = fileURLToPath(import.meta.url);
+
+function parse(argv) {
+  const o = { _: [] };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (!a.startsWith('--')) { o._.push(a); continue; }
+    const k = a.slice(2), v = argv[i + 1];
+    if (v === undefined || v.startsWith('--')) { o[k] = true; continue; }
+    i++;
+    if (k === 'allow' || k === 'deny') (o[k] ||= []).push(v); else o[k] = v;
+  }
+  return o;
+}
+
+function readConfig() {
+  try { return JSON.parse(fs.readFileSync(CONFIG, 'utf8')); } catch { return null; }
+}
+
+function log(line) {
+  const s = `${new Date().toISOString()} ${line}`;
+  console.log(s);
+  try {
+    if (fs.existsSync(LOG) && fs.statSync(LOG).size > 5e6) fs.renameSync(LOG, `${LOG}.1`);
+    fs.appendFileSync(LOG, s + '\n');
+  } catch { /* log dir not writable — console only */ }
+}
+
+// Hidden autostart at logon of THIS user (not SYSTEM): the assistant gets the user's rights only.
+function installAutostart() {
+  if (process.platform !== 'win32') return 'autostart: not Windows — start `bridgerator run` yourself';
+  const vbs = path.join(DIR, 'run-hidden.vbs');
+  const cmd = `"${process.execPath}" "${SELF}" run`;
+  fs.writeFileSync(vbs, `CreateObject("WScript.Shell").Run "${cmd.replace(/"/g, '""')}", 0, False\r\n`);
+  // Registered through PowerShell's ScheduledTasks module: `schtasks /Create … wscript.exe …` spawned
+  // from node is refused (EPERM) on clean Windows 11. No 72 h execution limit (the task default
+  // would silently stop the bridge after three days); restart on failure.
+  const q = (s) => `'${String(s).replace(/'/g, "''")}'`;
+  const ps = [
+    `$a = New-ScheduledTaskAction -Execute 'wscript.exe' -Argument ${q(`"${vbs}"`)}`,
+    '$t = New-ScheduledTaskTrigger -AtLogOn -User "$env:USERDOMAIN\\$env:USERNAME"',
+    '$s = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit ([TimeSpan]::Zero) -RestartCount 5 -RestartInterval (New-TimeSpan -Minutes 1) -MultipleInstances IgnoreNew',
+    '$p = New-ScheduledTaskPrincipal -UserId "$env:USERDOMAIN\\$env:USERNAME" -LogonType Interactive -RunLevel Limited',
+    `Register-ScheduledTask -TaskName ${q(TASK)} -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null`,
+  ].join('; ');
+  execFileSync('powershell', ['-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(ps, 'utf16le').toString('base64')], { stdio: 'pipe' });
+  return vbs;
+}
+
+function stopRunning() {
+  if (process.platform !== 'win32') return;
+  // Only our own bridge processes: node.exe whose command line runs this cli with `run`.
+  const ps = `Get-CimInstance Win32_Process -Filter "Name='node.exe'" | Where-Object { $_.CommandLine -like '*bridgerator*cli.mjs*run*' -and $_.ProcessId -ne ${process.pid} } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force }`;
+  try { execFileSync('powershell', ['-NoProfile', '-Command', ps], { stdio: 'pipe' }); } catch { /* none running */ }
+}
+
+// Start through the scheduled task itself — same as at logon, and not a child of this console
+// (closing the installer window or a job object around it must not kill the bridge).
+function startHidden() {
+  if (process.platform === 'win32') execFileSync('schtasks', ['/Run', '/TN', TASK], { stdio: 'pipe' });
+  else spawn(process.execPath, [SELF, 'run'], { detached: true, stdio: 'ignore' }).unref();
+}
+
+async function main() {
+  const o = parse(process.argv.slice(2));
+  const cmd = o._[0];
+  if (cmd === 'setup') {
+    const prev = readConfig() || {};
+    const token = o.token || prev.token;
+    if (!token || token === true) throw new Error('setup needs --token <device key from your Bridgerator account>');
+    const cfg = {
+      relay: o.relay || prev.relay || DEFAULT_RELAY,
+      token,
+      allowedDirectories: o.allow || prev.allowedDirectories || [home],
+      deniedDirectories: o.deny || prev.deniedDirectories || [path.join(home, '.ssh'), path.join(home, 'AppData')],
+      // blockedCommands: absent = Desktop Commander's own default list (format, diskpart, reg, net, sc, runas, …).
+      ...(prev.blockedCommands ? { blockedCommands: prev.blockedCommands } : {}),
+      disabledTools: prev.disabledTools || [],
+    };
+    fs.mkdirSync(DIR, { recursive: true });
+    fs.writeFileSync(CONFIG, JSON.stringify(cfg, null, 2));
+    console.log(`config: ${CONFIG}`);
+    console.log(`allowed:  ${cfg.allowedDirectories.join(', ')}`);
+    console.log(`excluded: ${cfg.deniedDirectories.join(', ') || '-'}`);
+    console.log(installAutostart() ? `autostart: scheduled task "${TASK}" (at logon, hidden)` : '');
+    stopRunning();
+    startHidden();
+    console.log(`started in background — log: ${LOG}`);
+    console.log('Next: in ChatGPT add the connector https://mcp.bridgerator.recondeck.com/mcp and sign in.');
+    return;
+  }
+  if (cmd === 'run') {
+    const cfg = readConfig();
+    if (!cfg) throw new Error(`no config at ${CONFIG} — run: bridgerator setup --token <device key>`);
+    const dc = await startDesktopCommander({ ...cfg, dcConfigDir: path.join(DIR, 'dc') }, log);
+    connect(cfg, dc, log);
+    return;
+  }
+  if (cmd === 'status') {
+    const cfg = readConfig();
+    if (!cfg) { console.log(`not configured (${CONFIG})`); return; }
+    console.log(JSON.stringify({ ...cfg, token: `${String(cfg.token).slice(0, 4)}…` }, null, 2));
+    try { console.log('--- log tail ---\n' + fs.readFileSync(LOG, 'utf8').split('\n').slice(-8).join('\n')); } catch { console.log('no log yet'); }
+    return;
+  }
+  if (cmd === 'uninstall') {
+    stopRunning();
+    try { execFileSync('schtasks', ['/Delete', '/F', '/TN', TASK], { stdio: 'pipe' }); } catch { /* not installed */ }
+    console.log(`stopped and autostart removed. Config kept at ${CONFIG}. Remove the package: npm rm -g bridgerator`);
+    return;
+  }
+  console.log('usage: bridgerator setup --token <key> [--allow <dir>]... [--deny <dir>]... | run | status | uninstall');
+}
+
+main().catch((e) => { console.error(`[bridgerator] ${e?.message || e}`); process.exit(1); });

package/src/dc-config-hooks.mjs

@@ -0,0 +1,32 @@
+// Module-loader hooks (loaded into the bundled engine child via `node --import ./dc-isolate.mjs`).
+// The engine is pinned (package.json); each patch replaces one exact snippet and FAILS CLOSED —
+// if the snippet is missing (engine changed), the child refuses to start instead of silently
+// sharing the user's own config, opening a browser or downloading a browser.
+//   config.js         — config folder → BRIDGERATOR_DC_CONFIG_DIR (an engine the user runs for other
+//                       apps keeps its limits; home-folder expansion and the shell env stay real).
+//   toolHistory.js    — the local tool-call history goes to the same folder, not ~\.claude-server-commander.
+//   open-browser.js   — no-ops: the bridge runs hidden and never opens a browser (the engine opens
+//                       its vendor's welcome page on first run).
+//   index.js          — no Chrome pre-download at start (~400 MB); PDF export still fetches it on demand.
+//   terminal-manager  — PowerShell (the default shell) writes UTF-8: the engine decodes output as UTF-8,
+//                       so on Russian & co. Windows (console code page 866/1251) text came out as garbage.
+const DIR_EXPR = "(process.env.BRIDGERATOR_DC_CONFIG_DIR || path.join(USER_HOME, '.claude-server-commander'))";
+const PATCHES = [
+  { file: /[\\/]dist[\\/]config\.js$/, from: "const CONFIG_DIR = path.join(USER_HOME, '.claude-server-commander');", to: `const CONFIG_DIR = ${DIR_EXPR};` },
+  { file: /[\\/]dist[\\/]utils[\\/]toolHistory\.js$/, from: "const historyDir = path.join(os.homedir(), '.claude-server-commander');", to: "const historyDir = process.env.BRIDGERATOR_DC_CONFIG_DIR || path.join(os.homedir(), '.claude-server-commander');" },
+  { file: /[\\/]dist[\\/]utils[\\/]open-browser\.js$/, from: 'export async function openWelcomePage', replaceAll: 'export async function openBrowser() {}\nexport async function openWelcomePage() {}\n' },
+  { file: /[\\/]dist[\\/]terminal-manager\.js$/, from: "args: ['-Command', command],", to: "args: ['-Command', '[Console]::OutputEncoding=[Text.Encoding]::UTF8;' + command]," },
+  { file: /[\\/]dist[\\/]index\.js$/, from: '            ensureChromeAvailable();\n', to: '            // bridgerator: no Chrome pre-download\n' },
+];
+const ENGINE = /[\\/]@wonderwhy-er[\\/]desktop-commander[\\/]dist[\\/]/;
+
+export async function load(url, context, nextLoad) {
+  const r = await nextLoad(url, context);
+  const p = url.startsWith('file:') ? decodeURIComponent(new URL(url).pathname) : '';
+  if (!ENGINE.test(p)) return r;
+  const patch = PATCHES.find((x) => x.file.test(p));
+  if (!patch) return r;
+  const src = String(r.source).replace(/\r\n/g, '\n');
+  if (!src.includes(patch.from)) throw new Error(`bridgerator: unexpected engine file ${p.split(/[\\/]/).slice(-2).join('/')} — refusing to start`);
+  return { ...r, source: patch.replaceAll ?? src.replace(patch.from, patch.to) };
+}

package/src/dc-isolate.mjs

@@ -0,0 +1,5 @@
+// Preload for the Desktop Commander child: registers dc-config-hooks.mjs (see there).
+import { register } from 'node:module';
+
+if (!process.env.BRIDGERATOR_DC_CONFIG_DIR) throw new Error('bridgerator: BRIDGERATOR_DC_CONFIG_DIR not set');
+register('./dc-config-hooks.mjs', import.meta.url);

package/src/notice.mjs

@@ -0,0 +1,39 @@
+// Plan notices from the relay (limit reached, Pro ending/ended) shown as a Windows notification with
+// an "Open account" button. They never go into the ChatGPT chat (app rules: no upgrade links there).
+// The link is fixed here — the relay only says which notice, not where to send the user.
+import { execFile } from 'node:child_process';
+
+export const ACCOUNT_URL = 'https://bridgerator.recondeck.com/app';
+const day = (iso) => String(iso || '').slice(0, 10);
+const xml = (s) => String(s).replace(/[<>&"']/g, (c) => ({ '<': '&lt;', '>': '&gt;', '&': '&amp;', '"': '&quot;', "'": '&apos;' }[c]));
+
+// ponytail: English only for now (owner, 20.10); other languages later.
+export function noticeText(n) {
+  const t = {
+    limit: ['Bridgerator: monthly limit reached', `${n.calls} of ${n.limit} tool calls used. ChatGPT can't use this PC until the 1st. Turn on Pro in your account.`],
+    expired: ['Bridgerator Pro has ended', "You're on Free now (15,000 tool calls a month). Renew Pro in your account."],
+    expiring: [`Bridgerator Pro ends on ${day(n.until)}`, 'Pay for 30 more days in your account to keep unlimited calls.'],
+  }[n.kind];
+  return t && { title: t[0], body: t[1], button: 'Open account' };
+}
+
+export function toastXml({ title, body, button }) {
+  return `<toast activationType="protocol" launch="${ACCOUNT_URL}"><visual><binding template="ToastGeneric"><text>${xml(title)}</text><text>${xml(body)}</text></binding></visual>`
+    + `<actions><action content="${xml(button)}" activationType="protocol" arguments="${ACCOUNT_URL}"/></actions></toast>`;
+}
+
+export function showNotice(n, log = console.log) {
+  const t = noticeText(n);
+  if (!t) return;
+  log(`[bridgerator] notice: ${t.title} — ${t.body} ${ACCOUNT_URL}`);
+  if (process.platform !== 'win32') return;
+  // Own app id under HKCU (no admin): the notification header reads "Bridgerator", not "Windows PowerShell".
+  const ps = `$k = 'HKCU:\\Software\\Classes\\AppUserModelId\\Bridgerator'
+if (-not (Test-Path $k)) { New-Item $k -Force | Out-Null; New-ItemProperty $k -Name DisplayName -Value 'Bridgerator' -Force | Out-Null }
+[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null
+[Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] > $null
+$x = New-Object Windows.Data.Xml.Dom.XmlDocument
+$x.LoadXml('${toastXml(t).replace(/'/g, "''")}')
+[Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier('Bridgerator').Show([Windows.UI.Notifications.ToastNotification]::new($x))`;
+  execFile('powershell', ['-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(ps, 'utf16le').toString('base64')], { windowsHide: true }, (e) => { if (e) log(`[bridgerator] notification failed: ${e.message}`); });
+}

package/src/policy.mjs

@@ -0,0 +1,109 @@
+// Bridge-side access policy, applied BEFORE a call reaches Desktop Commander and to its results.
+// Desktop Commander itself only knows allowedDirectories; it has no "except these folders" rule,
+// so deniedDirectories is enforced here: input paths are resolved (symlinks/junctions included)
+// and refused when they fall inside a denied folder; result lines that mention a denied path are
+// dropped (search hits, recursive listings).
+// The terminal is NOT covered by folder rules (a shell can read anything the user can); commands
+// that name a denied folder are refused as a courtesy, the real control is disabledTools.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+// Tools the model must never get: they would let it rewrite its own limits or leak telemetry.
+export const ALWAYS_HIDDEN = ['set_config_value', 'give_feedback_to_desktop_commander', 'get_usage_stats'];
+// Argument names that carry filesystem paths in Desktop Commander's tools.
+const PATH_KEYS = /^(path|paths|file_path|source|destination|inputPath|outputPath|directory)$/i;
+
+const expandHome = (p) => (p === '~' || p.startsWith('~/') || p.startsWith('~\\') ? path.join(os.homedir(), p.slice(1)) : p);
+export const norm = (p) => path.resolve(expandHome(String(p))).replace(/[\\/]+$/, '').toLowerCase();
+
+// Resolve symlinks/junctions on the deepest existing ancestor, like Desktop Commander does.
+export function realish(p) {
+  let cur = path.resolve(expandHome(String(p)));
+  const rest = [];
+  for (;;) {
+    try { return path.join(fs.realpathSync.native(cur), ...rest); } catch { /* walk up */ }
+    const up = path.dirname(cur);
+    if (up === cur) return path.resolve(expandHome(String(p)));
+    rest.unshift(path.basename(cur));
+    cur = up;
+  }
+}
+
+const esc = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+// "c:\secret" mentioned as a path (not as the prefix of "c:\secretive"), any slash style / JSON escaping.
+const flat = (s) => String(s).toLowerCase().replace(/[\\/]+/g, '\\');
+const mentionRe = (d) => new RegExp(`${esc(d)}(?![a-z0-9_.\\-])`);
+
+export function createPolicy(cfg = {}) {
+  const denied = (cfg.deniedDirectories || []).map((d) => norm(realish(d)));
+  const res = denied.map(mentionRe);
+  const mentionsDenied = (s) => { const f = flat(s); return res.some((r) => r.test(f)); };
+  const hidden = new Set([...ALWAYS_HIDDEN, ...(cfg.disabledTools || [])]);
+  const inDenied = (p) => {
+    const n = norm(p);
+    return denied.find((d) => n === d || n.startsWith(d + path.sep)) || null;
+  };
+  const deniedFor = (p) => inDenied(p) || inDenied(realish(p));
+
+  function pathsIn(args) {
+    const out = [];
+    for (const [k, v] of Object.entries(args || {})) {
+      if (!PATH_KEYS.test(k)) continue;
+      for (const x of Array.isArray(v) ? v : [v]) if (typeof x === 'string' && x) out.push(x);
+    }
+    return out;
+  }
+
+  return {
+    denied,
+    visible: (tool) => !hidden.has(tool.name),
+    // → null when allowed, otherwise the refusal text returned to the model.
+    check(name, args) {
+      if (hidden.has(name)) return `Tool "${name}" is disabled on this computer.`;
+      for (const p of pathsIn(args)) {
+        if (deniedFor(p)) return `Access denied by Bridgerator: "${p}" is inside an excluded folder.`;
+      }
+      for (const k of ['command', 'input']) {
+        if (typeof args?.[k] === 'string' && mentionsDenied(args[k])) return `Access denied by Bridgerator: the ${k} refers to an excluded folder.`;
+      }
+      return null;
+    },
+    // Drop result lines that reveal anything inside a denied folder. `args` lets a listing of a
+    // parent folder hide the excluded child, whose entries are printed relative to that parent.
+    filter(result, name, args) {
+      if (!denied.length || !result || !Array.isArray(result.content)) return result;
+      const rel = [];
+      if (name === 'list_directory' && typeof args?.path === 'string') {
+        const base = norm(realish(args.path));
+        for (const d of denied) if (d.startsWith(base + path.sep)) rel.push(new RegExp(`^${esc(d.slice(base.length + 1))}(?![a-z0-9_.\\-])`));
+      }
+      const leaks = (line) => mentionsDenied(line) || rel.some((r) => r.test(flat(line).trim().replace(/^\[(dir|file)\]\s*/, '')));
+      let dropped = 0;
+      const content = result.content.map((c) => {
+        if (c?.type !== 'text' || typeof c.text !== 'string') return c;
+        const lines = c.text.split(/\r?\n/);
+        const kept = lines.filter((ln) => !leaks(ln));
+        dropped += lines.length - kept.length;
+        return { ...c, text: kept.join('\n') };
+      });
+      if (dropped) content.push({ type: 'text', text: `[Bridgerator: ${dropped} line(s) hidden — excluded folder]` });
+      return { ...result, content };
+    },
+  };
+}
+
+// The bundled engine's own name and links are not shown to the user: tool titles/descriptions and
+// widget HTML say Bridgerator. Tool RESULTS are never rewritten (they are the user's own data).
+const BRAND = [[/"DC: \.\.\." or /g, ''], [/Desktop ?Commander/g, 'Bridgerator'], [/https?:\/\/(www\.)?desktopcommander\.app[^\s"'\)<]*/g, 'https://bridgerator.recondeck.com']];
+export function debrand(v) {
+  if (typeof v === 'string') return BRAND.reduce((s, [re, to]) => s.replace(re, to), v);
+  if (Array.isArray(v)) return v.map(debrand);
+  if (v && typeof v === 'object') {
+    const o = {};
+    // _meta keys (ui:// template URIs) are identifiers, not user-facing text — keep them as is.
+    for (const [k, x] of Object.entries(v)) o[k] = k === '_meta' || k === 'uri' ? x : debrand(x);
+    return o;
+  }
+  return v;
+}