bridgerator 1.0.0 → 1.0.6

package/README.md

@@ -10,26 +10,39 @@ ChatGPT ──OAuth 2.1 + MCP (HTTPS)──► relay (mcp.bridgerator.recondeck.
 
 This repository is the part that runs on your PC. It is small on purpose so you (or an AI agent
 installing it for you) can read all of it: `src/bridge.mjs` (forwarder), `src/policy.mjs` (access
-rules), `src/dc-isolate.mjs` (separate engine config), `src/cli.mjs` (setup/autostart), `install.ps1` (installer).
+rules), `src/dc-isolate.mjs` (separate engine config), `src/cli.mjs` (setup/autostart), `src/pair.mjs` (browser pairing), `install.ps1` (installer).
+
+## What people use it for
+
+- "Sort my Downloads folder by type and month" — ChatGPT lists, plans and moves the files on your PC.
+- "Find every invoice PDF in Documents and rename it by date" — search and rename in plain words.
+- "Why is drive C almost full?" — disk usage, big folders, what is safe to delete.
+- "Check the event log for errors since yesterday" / "Read the end of this log" — diagnostics.
+- Work on code: "explain how D:\\Projects\\app is built and run its tests".
+
+Everything runs as your Windows user and only inside the folders you allow.
 
 ## Plans
 
-Free: 15,000 tool calls per month per account, any number of PCs. Pro: $15/month, unlimited.
+Free: 10,000 tool calls per month per account, any number of PCs. Pro: $10/month, unlimited.
 Details: https://bridgerator.recondeck.com/pricing
 
 ## Install (Windows)
 
-1. Create an account and a device key at https://bridgerator.recondeck.com.
-2. In PowerShell (no admin rights needed):
+1. In ChatGPT, add the Bridgerator app and sign in with Google (an account is created for you), or sign up at https://bridgerator.recondeck.com.
+2. On the PC, in PowerShell (no admin rights needed):
    ```powershell
-   & ([scriptblock]::Create((irm https://bridgerator.recondeck.com/install.ps1))) -Token <device key>
+   & ([scriptblock]::Create((irm https://bridgerator.recondeck.com/install.ps1)))
    ```
-   It installs Node.js LTS if missing (winget), installs this package and runs `bridgerator setup`.
-   Prefer to read first? Download `install.ps1`, read it, run it with `-Token`.
-3. In ChatGPT: Settings → Apps & Connectors → Advanced → Developer mode → Create → URL
-   `https://mcp.bridgerator.recondeck.com/mcp`, authentication OAuth, sign in with your account.
+   It downloads portable Node.js LTS if missing (checksum-verified, no admin), installs this package and runs `bridgerator setup`.
+3. A browser tab opens with a code: check that it matches the one in PowerShell and click **Connect this computer**. Done — no key to copy.
+
+Update later with the same line (the key and folder settings are kept). Prefer to read first? Download `install.ps1`, read it, then run it.
+Servers or PCs without a browser: create a device key in your account (Add a computer → Advanced) and add `-Token <device key>` to the line.
+
+Manual install (PowerShell): `$env:PUPPETEER_SKIP_DOWNLOAD=1; npm install -g bridgerator`, then `bridgerator setup` (or `bridgerator setup --token <key>`). The variable skips a ~700 MB Chrome download that only PDF export needs; PDF export fetches a browser itself on first use.
 
-Manual install: `npm install -g github:s-lexer/bridgerator` then `bridgerator setup --token <key>`.
+Other MCP clients: server URL `https://mcp.bridgerator.recondeck.com/mcp`, OAuth sign-in.
 
 ## Access rules — what the assistant can and cannot touch
 
@@ -63,7 +76,7 @@ Bridgerator gives its bundled engine its **own** config folder (`%APPDATA%\Bridg
 ## Commands
 
 ```
-bridgerator setup --token <key> [--allow <dir>]... [--deny <dir>]...   # config + autostart + start
+bridgerator setup [--token <key> | --pair] [--allow <dir>]... [--deny <dir>]...  # pair in the browser (no key yet / --pair) + config + autostart + start
 bridgerator run                                                       # foreground (what autostart runs)
 bridgerator status                                                    # config (token masked) + log tail
 bridgerator uninstall                                                 # stop + remove autostart
@@ -90,7 +103,7 @@ MIT. The bundled open-source MCP engine is MIT-licensed as well; its copyright n
 
 ### По-русски коротко
 Bridgerator подключает ваш ПК к ChatGPT: файлы, поиск, терминал. Мост только исходящий, входящих
-портов нет. Установка — одна строка PowerShell с ключом устройства из кабинета (см. выше).
+портов нет. Установка — одна строка PowerShell, затем подтверждение компьютера во вкладке браузера (см. выше).
 Разрешённые папки — `allowedDirectories`, исключения внутри них — `deniedDirectories`
 (исключения обеспечивает сам Bridgerator). Терминал папками не
 ограничивается — для строгих границ выключите его через `disabledTools`.

package/install.ps1

@@ -1,17 +1,21 @@
-# Bridgerator installer for Windows (PowerShell 5.1+). Source: https://github.com/s-lexer/bridgerator
+# Bridgerator installer for Windows (PowerShell 5.1+). Source: npm package "bridgerator" (https://www.npmjs.com/package/bridgerator)
 # Usage (one line, from your Bridgerator account page):
-#   & ([scriptblock]::Create((irm https://bridgerator.recondeck.com/install.ps1))) -Token <device key>
+#   & ([scriptblock]::Create((irm https://bridgerator.recondeck.com/install.ps1)))
+# A browser tab opens: sign in and confirm this computer — no key to paste. Run again to update
+# (keeps the key and folders). Servers / headless PCs: add -Token <device key> from the account page.
 # What it does: installs Node.js LTS if missing (portable zip, no admin), installs the bridgerator npm package,
-# then runs `bridgerator setup` (config + hidden autostart at logon for THIS user, no admin rights),
+# then runs `bridgerator setup` (pairing in the browser if there is no key yet, config + hidden autostart
+# at logon for THIS user, no admin rights),
 # then opens the welcome page in the default browser (skip with -NoBrowser).
 param(
-  [Parameter(Mandatory = $true)][string]$Token,
+  [string]$Token,
   [string]$Package = 'https://bridgerator.recondeck.com/bridgerator.tgz',
   [string[]]$Allow,
   [string[]]$Deny,
   [switch]$NoBrowser
 )
 $ErrorActionPreference = 'Stop'
+$paired = $Token -or (Test-Path (Join-Path $env:APPDATA 'Bridgerator\config.json'))
 
 function Refresh-Path {
   $env:Path = [Environment]::GetEnvironmentVariable('Path', 'Machine') + ';' + [Environment]::GetEnvironmentVariable('Path', 'User')
@@ -61,12 +65,14 @@ Write-Host "Installing bridgerator from $Package ..."
 if ($LASTEXITCODE -ne 0) { throw 'npm install failed' }
 Refresh-Path
 
-$setupArgs = @('setup', '--token', $Token)
+$setupArgs = @('setup')
+if ($Token) { $setupArgs += @('--token', $Token) }
 foreach ($a in $Allow) { $setupArgs += @('--allow', $a) }
 foreach ($d in $Deny) { $setupArgs += @('--deny', $d) }
+if (-not $paired) { Write-Host 'Next: a browser tab opens - sign in to Bridgerator and confirm this computer.' }
 & bridgerator @setupArgs
 if ($LASTEXITCODE -ne 0) { throw 'bridgerator setup failed' }
-Write-Host 'Done. Check with: bridgerator status'
+Write-Host 'Done. This computer is connected. Check with: bridgerator status'
 
 # Next steps (connect ChatGPT, example prompts) on the welcome page; skipped for -NoBrowser and
 # non-interactive sessions (scheduled tasks, remote shells). Never fails the install.

package/package.json

@@ -1,33 +1,49 @@
-{
-  "name": "bridgerator",
-  "version": "1.0.0",
-  "description": "Connect your Windows PC to ChatGPT: files, search and terminal through an outbound-only bridge. Bundles Desktop Commander and adds folder exclusions.",
-  "license": "MIT",
-  "type": "module",
-  "bin": {
-    "bridgerator": "src/cli.mjs"
-  },
-  "files": [
-    "src",
-    "install.ps1",
-    "README.md",
-    "LICENSE"
-  ],
-  "engines": {
-    "node": ">=20"
-  },
-  "scripts": {
-    "start": "node src/cli.mjs run",
-    "test": "node --test"
-  },
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
-    "@wonderwhy-er/desktop-commander": "0.2.52",
-    "ws": "^8.20.0"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/s-lexer/bridgerator.git"
-  },
-  "homepage": "https://bridgerator.recondeck.com"
-}
+{
+  "name": "bridgerator",
+  "version": "1.0.6",
+  "description": "Connect ChatGPT to your Windows PC: files, search and terminal through an outbound-only bridge with folder limits. No inbound ports, no admin rights.",
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "bridgerator": "src/cli.mjs"
+  },
+  "files": [
+    "src",
+    "install.ps1",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "start": "node src/cli.mjs run",
+    "test": "node --test"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@wonderwhy-er/desktop-commander": "0.2.52",
+    "ws": "^8.20.0"
+  },
+  "homepage": "https://bridgerator.recondeck.com",
+  "keywords": [
+    "chatgpt",
+    "mcp",
+    "mcp-server",
+    "model-context-protocol",
+    "windows",
+    "chatgpt-connector",
+    "ai-assistant",
+    "remote-files",
+    "powershell",
+    "openai",
+    "apps-sdk",
+    "desktop-automation",
+    "local-files",
+    "bridge"
+  ],
+  "bugs": {
+    "url": "https://bridgerator.recondeck.com/support"
+  },
+  "author": "Bridgerator <info@recondeck.com>"
+}

package/src/bridge.mjs

@@ -9,6 +9,7 @@ import WebSocket from 'ws';
 import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
 import { createPolicy, debrand } from './policy.mjs';
+import { showNotice } from './notice.mjs';
 
 const RECONNECT_MS = 5000;
 const DC_ENTRY = createRequire(import.meta.url).resolve('@wonderwhy-er/desktop-commander/dist/index.js');
@@ -70,6 +71,7 @@ export function connect(cfg, dc, log = console.log) {
   ws.on('message', async (raw) => {
     let msg; try { msg = JSON.parse(raw); } catch { return; }
     if (msg.type === 'welcome') { log(`[bridgerator] registered as "${msg.device}"`); return; }
+    if (msg.type === 'notice') { showNotice(msg, log); return; }
     if (msg.type === 'read_resource' && msg.callId) {
       const r = await dc.readResource(msg.uri);
       if (ws.readyState === ws.OPEN) ws.send(JSON.stringify({ type: 'result', callId: msg.callId, ...r }));

package/src/cli.mjs

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
-// bridgerator setup --token <t> [--relay <wss url>] [--allow <dir>]... [--deny <dir>]...  → config + autostart + start
+// bridgerator setup [--token <t> | --pair] [--relay <wss url>] [--allow <dir>]... [--deny <dir>]...  → config + autostart + start
+//   (no key yet: pairs this PC through the browser — the signed-in owner confirms a code)
 // bridgerator run | status | uninstall
 import fs from 'node:fs';
 import os from 'node:os';
@@ -7,6 +8,7 @@ import path from 'node:path';
 import { spawn, execFileSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { startDesktopCommander, connect } from './bridge.mjs';
+import { pair, siteOf } from './pair.mjs';
 
 const DEFAULT_RELAY = 'wss://mcp.bridgerator.recondeck.com/link';
 const TASK = 'Bridgerator';
@@ -82,10 +84,14 @@ async function main() {
   const cmd = o._[0];
   if (cmd === 'setup') {
     const prev = readConfig() || {};
-    const token = o.token || prev.token;
-    if (!token || token === true) throw new Error('setup needs --token <device key from your Bridgerator account>');
+    if (o.token === true) throw new Error('--token needs the device key from your Bridgerator account');
+    const relay = o.relay || prev.relay || DEFAULT_RELAY;
+    // --pair: get a new key through the browser even if one is configured (computer removed in the account).
+    const paired = !o.token && (o.pair || !prev.token);
+    const token = o.token || (paired ? (await pair(siteOf(relay), os.hostname())).token : prev.token);
+    if (paired) console.log('Confirmed — this computer is linked to your account.');
     const cfg = {
-      relay: o.relay || prev.relay || DEFAULT_RELAY,
+      relay,
       token,
       allowedDirectories: o.allow || prev.allowedDirectories || [home],
       deniedDirectories: o.deny || prev.deniedDirectories || [path.join(home, '.ssh'), path.join(home, 'AppData')],
@@ -102,12 +108,12 @@ async function main() {
     stopRunning();
     startHidden();
     console.log(`started in background — log: ${LOG}`);
-    console.log('Next: in ChatGPT add the connector https://mcp.bridgerator.recondeck.com/mcp and sign in.');
+    console.log('Next: in ChatGPT add the Bridgerator app and sign in with the same account.');
     return;
   }
   if (cmd === 'run') {
     const cfg = readConfig();
-    if (!cfg) throw new Error(`no config at ${CONFIG} — run: bridgerator setup --token <device key>`);
+    if (!cfg) throw new Error(`no config at ${CONFIG} — run: bridgerator setup`);
     const dc = await startDesktopCommander({ ...cfg, dcConfigDir: path.join(DIR, 'dc') }, log);
     connect(cfg, dc, log);
     return;
@@ -125,7 +131,7 @@ async function main() {
     console.log(`stopped and autostart removed. Config kept at ${CONFIG}. Remove the package: npm rm -g bridgerator`);
     return;
   }
-  console.log('usage: bridgerator setup --token <key> [--allow <dir>]... [--deny <dir>]... | run | status | uninstall');
+  console.log('usage: bridgerator setup [--token <key> | --pair] [--allow <dir>]... [--deny <dir>]... | run | status | uninstall');
 }
 
 main().catch((e) => { console.error(`[bridgerator] ${e?.message || e}`); process.exit(1); });

package/src/dc-config-hooks.mjs

@@ -8,11 +8,14 @@
 //   open-browser.js   — no-ops: the bridge runs hidden and never opens a browser (the engine opens
 //                       its vendor's welcome page on first run).
 //   index.js          — no Chrome pre-download at start (~400 MB); PDF export still fetches it on demand.
+//   terminal-manager  — PowerShell (the default shell) writes UTF-8: the engine decodes output as UTF-8,
+//                       so on Russian & co. Windows (console code page 866/1251) text came out as garbage.
 const DIR_EXPR = "(process.env.BRIDGERATOR_DC_CONFIG_DIR || path.join(USER_HOME, '.claude-server-commander'))";
 const PATCHES = [
   { file: /[\\/]dist[\\/]config\.js$/, from: "const CONFIG_DIR = path.join(USER_HOME, '.claude-server-commander');", to: `const CONFIG_DIR = ${DIR_EXPR};` },
   { file: /[\\/]dist[\\/]utils[\\/]toolHistory\.js$/, from: "const historyDir = path.join(os.homedir(), '.claude-server-commander');", to: "const historyDir = process.env.BRIDGERATOR_DC_CONFIG_DIR || path.join(os.homedir(), '.claude-server-commander');" },
   { file: /[\\/]dist[\\/]utils[\\/]open-browser\.js$/, from: 'export async function openWelcomePage', replaceAll: 'export async function openBrowser() {}\nexport async function openWelcomePage() {}\n' },
+  { file: /[\\/]dist[\\/]terminal-manager\.js$/, from: "args: ['-Command', command],", to: "args: ['-Command', '[Console]::OutputEncoding=[Text.Encoding]::UTF8;' + command]," },
   { file: /[\\/]dist[\\/]index\.js$/, from: '            ensureChromeAvailable();\n', to: '            // bridgerator: no Chrome pre-download\n' },
 ];
 const ENGINE = /[\\/]@wonderwhy-er[\\/]desktop-commander[\\/]dist[\\/]/;

package/src/notice.mjs

@@ -0,0 +1,39 @@
+// Plan notices from the relay (limit reached, Pro ending/ended) shown as a Windows notification with
+// an "Open account" button. They never go into the ChatGPT chat (app rules: no upgrade links there).
+// The link is fixed here — the relay only says which notice, not where to send the user.
+import { execFile } from 'node:child_process';
+
+export const ACCOUNT_URL = 'https://bridgerator.recondeck.com/app';
+const day = (iso) => String(iso || '').slice(0, 10);
+const xml = (s) => String(s).replace(/[<>&"']/g, (c) => ({ '<': '&lt;', '>': '&gt;', '&': '&amp;', '"': '&quot;', "'": '&apos;' }[c]));
+
+// ponytail: English only for now (owner, 20.10); other languages later.
+export function noticeText(n) {
+  const t = {
+    limit: ['Bridgerator: monthly limit reached', `${n.calls} of ${n.limit} tool calls used. ChatGPT can't use this PC until the 1st. Turn on Pro in your account.`],
+    expired: ['Bridgerator Pro has ended', "You're on Free now (10,000 tool calls a month). Renew Pro in your account."],
+    expiring: [`Bridgerator Pro ends on ${day(n.until)}`, 'Pay for 30 more days in your account to keep unlimited calls.'],
+  }[n.kind];
+  return t && { title: t[0], body: t[1], button: 'Open account' };
+}
+
+export function toastXml({ title, body, button }) {
+  return `<toast activationType="protocol" launch="${ACCOUNT_URL}"><visual><binding template="ToastGeneric"><text>${xml(title)}</text><text>${xml(body)}</text></binding></visual>`
+    + `<actions><action content="${xml(button)}" activationType="protocol" arguments="${ACCOUNT_URL}"/></actions></toast>`;
+}
+
+export function showNotice(n, log = console.log) {
+  const t = noticeText(n);
+  if (!t) return;
+  log(`[bridgerator] notice: ${t.title} — ${t.body} ${ACCOUNT_URL}`);
+  if (process.platform !== 'win32') return;
+  // Own app id under HKCU (no admin): the notification header reads "Bridgerator", not "Windows PowerShell".
+  const ps = `$k = 'HKCU:\\Software\\Classes\\AppUserModelId\\Bridgerator'
+if (-not (Test-Path $k)) { New-Item $k -Force | Out-Null; New-ItemProperty $k -Name DisplayName -Value 'Bridgerator' -Force | Out-Null }
+[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null
+[Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] > $null
+$x = New-Object Windows.Data.Xml.Dom.XmlDocument
+$x.LoadXml('${toastXml(t).replace(/'/g, "''")}')
+[Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier('Bridgerator').Show([Windows.UI.Notifications.ToastNotification]::new($x))`;
+  execFile('powershell', ['-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(ps, 'utf16le').toString('base64')], { windowsHide: true }, (e) => { if (e) log(`[bridgerator] notification failed: ${e.message}`); });
+}

package/src/pair.mjs

@@ -0,0 +1,43 @@
+// Key-less setup: ask the relay for a pairing code, open the confirmation page in the browser, wait
+// until the signed-in owner confirms this computer there, and get this PC's device key back.
+import { spawn } from 'node:child_process';
+
+// wss://mcp.bridgerator.recondeck.com/link → https://bridgerator.recondeck.com (the site host, where the account pages live).
+export const siteOf = (relay) => { const u = new URL(relay); return `${u.protocol === 'ws:' ? 'http' : 'https'}://${u.host.replace(/^mcp\./, '')}`; };
+
+// Opens the URL in the default browser. Only a URL we checked ourselves reaches cmd's `start`.
+export function openBrowser(url) {
+  if (!/^https?:\/\/[A-Za-z0-9.:-]+\/pair\?code=[A-Z0-9]{4}-[A-Z0-9]{4}$/.test(url)) return;
+  try {
+    const p = process.platform === 'win32'
+      ? spawn('cmd', ['/c', `start "" "${url}"`], { windowsHide: true, windowsVerbatimArguments: true, stdio: 'ignore', detached: true })
+      : spawn(process.platform === 'darwin' ? 'open' : 'xdg-open', [url], { stdio: 'ignore', detached: true });
+    p.on('error', () => {});
+    p.unref();
+  } catch { /* no browser: the URL is printed */ }
+}
+
+/** → { token, name } once the owner confirmed; throws when the code expires. */
+export async function pair(site, name, { fetch: f = globalThis.fetch, open = openBrowser, log = console.log, sleep = (ms) => new Promise((r) => setTimeout(r, ms)), everyMs = 3000 } = {}) {
+  const post = (path, body) => f(`${site}${path}`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body), signal: AbortSignal.timeout(20000) });
+  const r = await post('/pair/start', { name });
+  if (!r.ok) throw new Error(`could not start pairing (HTTP ${r.status}) — try again in a minute`);
+  const s = await r.json();
+  const url = `${site}/pair?code=${s.code}`;
+  if (!/^[A-Z0-9]{4}-[A-Z0-9]{4}$/.test(String(s.code)) || typeof s.poll !== 'string') throw new Error('unexpected answer from the relay');
+  log('');
+  log(`  Confirm this computer in your browser:  ${url}`);
+  log(`  Code: ${s.code}   (check that the page shows the same code)`);
+  log('');
+  open(url);
+  log('Waiting for the confirmation (up to 15 minutes)...');
+  const until = Date.now() + (Number(s.expiresIn) || 900) * 1000;
+  while (Date.now() < until) {
+    await sleep(everyMs);
+    let p;
+    try { p = await post('/pair/poll', { poll: s.poll }); } catch { continue; } // network blip: try again
+    if (p.status === 200) { const j = await p.json(); if (j.token) return { token: j.token, name: j.name || name }; }
+    if (p.status === 410) break;
+  }
+  throw new Error('the code expired before it was confirmed — run the command again');
+}