dsh-windows-mcp 0.1.0 → 0.2.1

package/lib/dependency.js

@@ -80,10 +80,15 @@ export function windowsMcpExecutable() {
   return null;
 }
 
-/** Version of the installed tool, read from its dist-info directory. */
-export function windowsMcpVersion(executable = windowsMcpExecutable()) {
-  if (executable === null) return null;
-  const directory = windowsMcpToolDirectory();
+/**
+ * Version of a `uv tool` installation, read from the dist-info directory inside
+ * the tool's environment. Works for the global tool root and for the managed
+ * per-version directories this plugin keeps (see `installs.js`).
+ * @param toolDirectory - the directory that contains `Scripts/` and `Lib/`,
+ *   i.e. `…/tools/windows-mcp` or `…/tools/<version>/windows-mcp`.
+ */
+export function toolVersionIn(toolDirectory) {
+  if (typeof toolDirectory !== "string" || toolDirectory === "") return null;
   const packages = [];
   const collect = (sitePackages) => {
     try {
@@ -94,10 +99,10 @@ export function windowsMcpVersion(executable = windowsMcpExecutable()) {
       /* layout absent */
     }
   };
-  collect(join(directory, "Lib", "site-packages"));
+  collect(join(toolDirectory, "Lib", "site-packages"));
   try {
-    for (const entry of readdirSync(join(directory, "lib"), { withFileTypes: true })) {
-      if (entry.isDirectory() && /^python\d/u.test(entry.name)) collect(join(directory, "lib", entry.name, "site-packages"));
+    for (const entry of readdirSync(join(toolDirectory, "lib"), { withFileTypes: true })) {
+      if (entry.isDirectory() && /^python\d/u.test(entry.name)) collect(join(toolDirectory, "lib", entry.name, "site-packages"));
     }
   } catch {
     /* POSIX layout absent */
@@ -109,9 +114,17 @@ export function windowsMcpVersion(executable = windowsMcpExecutable()) {
   return null;
 }
 
+/** Version of the globally installed tool, read from its dist-info directory. */
+export function windowsMcpVersion(executable = windowsMcpExecutable()) {
+  if (executable === null) return null;
+  return toolVersionIn(windowsMcpToolDirectory());
+}
+
 /** The pinned upstream version our patch mounts, e.g. `0.8.8`, or null. */
 export function windowsMcpVersionPin(patchText) {
-  const match = /windows-mcp@([0-9][^\s,'"\]]*)/u.exec(String(patchText ?? ""));
+  // Stop at anything that ends a version in YAML or prose: whitespace, quotes,
+  // commas, closing brackets, and the backtick/paren used in comments.
+  const match = /windows-mcp@([0-9][^\s,'"\]`);]*)/u.exec(String(patchText ?? ""));
   return match === null ? null : match[1];
 }
 
@@ -143,11 +156,67 @@ export function dependencySnapshot(resolver, pinned, env = process.env) {
  * install
  * ------------------------------------------------------------------ */
 
+/**
+ * Environment for `uv tool install`.
+ *
+ * `UV_CONCURRENT_DOWNLOADS` is deliberately below uv's default of 8: the
+ * mainland mirrors rate-limit aggressive parallelism (measured: USTC answered
+ * HTTP 429 while unzipping a dependency when uv fetched 8 files at once), and a
+ * slow-but-successful install beats a fast-but-failing one.
+ *
+ * @param toolDirectory - when set, the install is redirected into that tool
+ *   root (`UV_TOOL_DIR`) instead of the global one, which is how this plugin
+ *   keeps several upstream versions side by side.
+ */
+export function uvInstallEnvironment(toolDirectory = null) {
+  const environment = {
+    ...process.env,
+    UV_HTTP_TIMEOUT: "600",
+    UV_CONCURRENT_DOWNLOADS: "4",
+    UV_HTTP_RETRIES: "3",
+  };
+  if (typeof toolDirectory === "string" && toolDirectory !== "") environment.UV_TOOL_DIR = toolDirectory;
+  return environment;
+}
+
+/**
+ * Start one `uv tool install` and stream its output to `onLine`.
+ * @returns `{ child, args }` — the caller owns the child's lifecycle.
+ */
+export function spawnUvInstall(options = {}) {
+  const uv = options.uv;
+  const spec = options.spec;
+  const indexUrl = typeof options.indexUrl === "string" && options.indexUrl !== "" ? options.indexUrl : null;
+  const toolDirectory = typeof options.toolDirectory === "string" && options.toolDirectory !== "" ? options.toolDirectory : null;
+  const onLine = typeof options.onLine === "function" ? options.onLine : () => {};
+  const args = ["tool", "install", "--force"];
+  if (indexUrl !== null) args.push("--default-index", indexUrl);
+  args.push(spec);
+  const child = spawn(uv, args, {
+    cwd: typeof options.cwd === "string" ? options.cwd : homedir(),
+    env: { ...uvInstallEnvironment(toolDirectory), ...(options.env ?? {}) },
+    windowsHide: true,
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  try {
+    child.stdout?.on("data", onLine);
+    child.stderr?.on("data", onLine);
+  } catch {
+    /* a child without pipes still closes */
+  }
+  return { child, args };
+}
+
 /**
  * One `uv tool install` at a time, with a bounded log the page can follow.
  * @param options.warn - warning sink.
  * @param options.resolver - PATH lookup used to find `uv`.
  * @param options.pinned - upstream version pin.
+ * @param options.indexUrl - PyPI index to install from (a mirror), or null.
+ * @param options.toolDirectory - `UV_TOOL_DIR` for an isolated install, or null
+ *   for the global tool root.
+ * @param options.resolveExecutable - where to look for the installed executable
+ *   afterwards; defaults to the global `uv tool` installation.
  * @param options.afterInstall - called with the installed executable, returns
  *   the bridge-write outcome that `snapshot()` then reports.
  */
@@ -202,22 +271,19 @@ export function createPrepare(options = {}) {
         return { started: false, reason: state.error, state: this.snapshot() };
       }
       const spec = options.pinned === null || options.pinned === undefined ? WINDOWS_MCP_TOOL : `${WINDOWS_MCP_TOOL}@${options.pinned}`;
+      const indexUrl = typeof options.indexUrl === "string" && options.indexUrl !== "" ? options.indexUrl : null;
+      const toolDirectory = typeof options.toolDirectory === "string" && options.toolDirectory !== "" ? options.toolDirectory : null;
+      const resolveExecutable = typeof options.resolveExecutable === "function" ? options.resolveExecutable : windowsMcpExecutable;
       state.phase = "running";
       state.startedAt = new Date().toISOString();
       state.finishedAt = null;
       state.error = null;
       state.bridge = null;
-      state.log = [`$ ${uv} tool install --force ${spec}`];
+      const command = [uv, "tool", "install", "--force", ...(indexUrl === null ? [] : ["--default-index", indexUrl]), spec].join(" ");
+      state.log = [`$ ${command}${toolDirectory === null ? "" : `  (UV_TOOL_DIR=${toolDirectory})`}`];
       try {
-        const running = spawn(uv, ["tool", "install", "--force", spec], {
-          cwd: homedir(),
-          env: { ...process.env, UV_HTTP_TIMEOUT: "600", UV_CONCURRENT_DOWNLOADS: "8" },
-          windowsHide: true,
-          stdio: ["ignore", "pipe", "pipe"],
-        });
+        const { child: running } = spawnUvInstall({ uv, spec, indexUrl, toolDirectory, onLine: append });
         child = running;
-        running.stdout?.on("data", append);
-        running.stderr?.on("data", append);
         running.on("error", (error) => settle("failed", String(error)));
         running.on("close", (code) => {
           if (state.phase === "cancelled") return;
@@ -225,7 +291,7 @@ export function createPrepare(options = {}) {
             settle("failed", `uv exited with code ${code}`);
             return;
           }
-          const executable = windowsMcpExecutable();
+          const executable = resolveExecutable();
           if (executable === null) {
             settle("failed", "uv reported success, but no windows-mcp executable appeared in the tool directory.");
             return;
@@ -289,10 +355,63 @@ export function yamlScalar(value) {
   return `'${String(value).replace(/'/gu, "''")}'`;
 }
 
-/** The complete bridge row, pointing at an installed executable. */
+/**
+ * The bridge row values this package ships. The settings page may change them;
+ * `lib/settings.js` normalises user input against these same defaults.
+ */
+export const BRIDGE_DEFAULTS = Object.freeze({
+  toolCallTimeoutMs: 120000,
+  excludeTools: Object.freeze(["App", "PowerShell", "FileSystem"]),
+  screenshotScale: 0.75,
+  screenshotBackend: "auto",
+  disableFlash: true,
+});
+
+/** Render `args:` — `--exclude-tools` takes one comma-separated argv. */
+function bridgeArgsLine(excludeTools) {
+  const names = Array.from(excludeTools, (name) => String(name).trim()).filter((name) => name !== "");
+  if (names.length === 0) return "    args: [serve]";
+  return `    args: [serve, --exclude-tools, ${JSON.stringify(names.join(","))}]`;
+}
+
+/** Render `env:` — only the keys that are set, in a stable order. */
+function bridgeEnvLine(settings) {
+  const pairs = ['ANONYMIZED_TELEMETRY: "false"'];
+  if (settings.disableFlash !== false) pairs.push('WINDOWS_MCP_DISABLE_FLASH: "1"');
+  pairs.push(`WINDOWS_MCP_SCREENSHOT_SCALE: ${JSON.stringify(String(settings.screenshotScale))}`);
+  if (typeof settings.screenshotBackend === "string" && settings.screenshotBackend !== "auto") {
+    pairs.push(`WINDOWS_MCP_SCREENSHOT_BACKEND: ${JSON.stringify(settings.screenshotBackend)}`);
+  }
+  return `    env: { ${pairs.join(", ")} }`;
+}
+
+/** Fold user settings (or their absence) into one complete bridge value set. */
+function bridgeValues(meta) {
+  const source = meta.settings !== null && typeof meta.settings === "object" ? meta.settings : null;
+  const merged = { ...BRIDGE_DEFAULTS };
+  if (source === null) return merged;
+  if (typeof source.toolCallTimeoutMs === "number" && Number.isFinite(source.toolCallTimeoutMs)) {
+    merged.toolCallTimeoutMs = Math.round(source.toolCallTimeoutMs);
+  }
+  if (Array.isArray(source.excludeTools)) merged.excludeTools = source.excludeTools.slice();
+  if (typeof source.screenshotScale === "number" && Number.isFinite(source.screenshotScale)) {
+    merged.screenshotScale = source.screenshotScale;
+  }
+  if (typeof source.screenshotBackend === "string" && source.screenshotBackend !== "") {
+    merged.screenshotBackend = source.screenshotBackend;
+  }
+  if (typeof source.disableFlash === "boolean") merged.disableFlash = source.disableFlash;
+  return merged;
+}
+
+/**
+ * The complete bridge row, pointing at an installed executable.
+ * `meta.settings` is the optional `bridge` half of the user settings.
+ */
 export function bridgeOverrideBlock(executable, meta = {}) {
   const stamp = typeof meta.stamp === "string" ? meta.stamp : new Date().toISOString();
   const version = typeof meta.version === "string" ? meta.version : "unknown";
+  const values = bridgeValues(meta);
   return [
     PROFILE_BLOCK_BEGIN,
     `# Written by ${PACKAGE_ID} ${version} at ${stamp}.`,
@@ -302,11 +421,11 @@ export function bridgeOverrideBlock(executable, meta = {}) {
     "    serverName: windows",
     "    transport: stdio",
     `    command: ${yamlScalar(executable)}`,
-    '    args: [serve, --exclude-tools, "App,PowerShell,FileSystem"]',
-    "    toolCallTimeoutMs: 120000",
+    bridgeArgsLine(values.excludeTools),
+    `    toolCallTimeoutMs: ${values.toolCallTimeoutMs}`,
     "    failOnStartupError: false",
     "    reconnect: { enabled: true, initialDelayMs: 500, maxDelayMs: 30000, maxAttempts: 10 }",
-    '    env: { ANONYMIZED_TELEMETRY: "false", WINDOWS_MCP_DISABLE_FLASH: "1", WINDOWS_MCP_SCREENSHOT_SCALE: "0.75" }',
+    bridgeEnvLine(values),
     PROFILE_BLOCK_END,
   ].join("\n");
 }
@@ -460,7 +579,15 @@ export function writeBridgeOverride(executable, options = {}) {
         backup = null;
       }
     }
-    writeFileSync(file, withBridgeOverride(current, bridgeOverrideBlock(executable, { stamp: new Date().toISOString(), version }), eol), "utf8");
+    writeFileSync(
+      file,
+      withBridgeOverride(
+        current,
+        bridgeOverrideBlock(executable, { stamp: new Date().toISOString(), version, settings: options.settings }),
+        eol,
+      ),
+      "utf8",
+    );
     return { ok: true, path: file, backup, executable, restartRequired: true };
   } catch (error) {
     warn(`could not point the bridge at the installed Windows-MCP: ${String(error)}`);

package/lib/index.js

@@ -33,12 +33,21 @@ import {
   BRIDGE_ROUTE,
   PREPARE_CANCEL_ROUTE,
   PREPARE_ROUTE,
-  createPrepare,
   dependencySnapshot,
   windowsMcpExecutable,
   windowsMcpVersionPin,
   writeBridgeOverride,
 } from "./dependency.js";
+import { UPDATE_ACTIONS, UPDATE_ROUTE, createUpdater } from "./updater.js";
+import {
+  SETTINGS_ROUTE,
+  bridgeSettingsMatch,
+  bridgeSettingsOf,
+  normalizeSettings,
+  readBridgeSettings,
+  readSettings,
+  writeSettings,
+} from "./settings.js";
 
 const PACKAGE_ID = "dsh-windows-mcp";
 const BRIDGE_ROW_ID = "windows-mcp-bridge";
@@ -62,13 +71,17 @@ const stateDirectory = (() => {
 const statePath = join(stateDirectory, "dsh-windows-mcp.state.json");
 const STATE_ROUTE = "/dsh-windows-mcp/state";
 const MAX_STATE_BODY_BYTES = 1024;
+const MAX_SETTINGS_BODY_BYTES = 8192;
 
 /** Mirrors the persisted flag; read once at boot, updated by the state route.
  *  Desktop control is opt-in: a fresh install starts OFF. */
 const computerUse = { enabled: false };
 
-/** The `uv tool install` driver, created in apply() once the logger exists. */
-let dependencyManager = null;
+/** User settings; read once at boot, replaced by the settings route. */
+let settings = null;
+
+/** The Windows-MCP version manager, created in apply() once the logger exists. */
+let updater = null;
 
 /* ------------------------------------------------------------------ *
  * small, throw-proof helpers
@@ -311,6 +324,25 @@ function buildReport(tools) {
     }`,
   );
 
+  const update = updater === null ? null : updater.view();
+  if (update !== null) {
+    const managed = update.versions;
+    lines.push(
+      `managed install : ${
+        managed.active === null
+          ? "none yet — the global `uv tool` installation is used (installing or updating creates one)"
+          : `v${managed.active} under ${managed.toolchainRoot}`
+      }`,
+    );
+    if (managed.previous !== null) lines.push(`  rollback to  : v${managed.previous}`);
+    if (managed.available.length > 0) lines.push(`  installed    : ${managed.available.map((version) => `v${version}`).join(", ")}`);
+    if (update.check.latest === null) {
+      lines.push("  latest       : not checked yet — press Check for updates in Settings → Plugins");
+    } else {
+      lines.push(`  latest       : v${update.check.latest}${managed.updateAvailable ? " — an update is available" : " — up to date"}`);
+    }
+  }
+
   if (uv === null && uvx === null) {
     advice.push(
       "Install uv (https://docs.astral.sh/uv/) and make sure `uvx` is on the PATH of the process that runs DSH — without it the bridge cannot start Windows-MCP.",
@@ -490,13 +522,52 @@ function registerStateRoute(ctx, warn) {
           }
         };
 
-        const snapshot = () => ({
-          enabled: computerUse.enabled,
-          bridged: bridgedToolCount(scoped.get?.("tools")),
-          serverName: "windows",
-          dependency: dependencySnapshot(which, windowsMcpVersionPin(readText(patchPath))),
-          prepare: dependencyManager === null ? null : dependencyManager.snapshot(),
-        });
+        /** Map the version manager's install progress onto the prepare shape the page polls. */
+        const prepareSnapshot = () => {
+          if (updater === null) return null;
+          const install = updater.view().install;
+          return {
+            phase: install.phase === "installing" ? "running" : install.phase,
+            startedAt: install.startedAt,
+            finishedAt: install.finishedAt,
+            error: install.error,
+            log: install.log,
+            bridge: install.bridge,
+            version: install.version,
+            mirror: install.mirror,
+          };
+        };
+
+        /**
+         * Settings plus what the profile patch actually says: the two only
+         * match after a restart, because the MCP client reads its row at boot.
+         */
+        const settingsView = () => {
+          const current = settings === null ? normalizeSettings(null).settings : settings;
+          const patchText = readText(patchPath);
+          const applied = bridgeSettingsMatch(current, patchText);
+          return {
+            settings: current,
+            bridge: readBridgeSettings(patchText),
+            applied,
+            restartRequired: !applied,
+            pluginVersion: selfVersion(),
+          };
+        };
+
+        const snapshot = () => {
+          const legacy = dependencySnapshot(which, windowsMcpVersionPin(readText(patchPath)));
+          const update = updater === null ? null : updater.view();
+          return {
+            enabled: computerUse.enabled,
+            bridged: bridgedToolCount(scoped.get?.("tools")),
+            serverName: "windows",
+            dependency: updater === null ? legacy : updater.dependencyView(legacy),
+            prepare: prepareSnapshot(),
+            update,
+            settings: settingsView(),
+          };
+        };
 
         const handler = (request, response) => {
           if (request.method === "GET") {
@@ -536,7 +607,7 @@ function registerStateRoute(ctx, warn) {
           request.on("error", () => respond(response, 400, { error: "request failed" }));
         };
 
-        /** Start the dependency install the Plugins page shows a button for. */
+        /** Start installing the pinned (or newest known) Windows-MCP into its own tool root. */
         const prepareHandler = (request, response) => {
           if (request.method === "GET") {
             respond(response, 200, snapshot());
@@ -546,17 +617,22 @@ function registerStateRoute(ctx, warn) {
             respond(response, 405, { error: "method not allowed" });
             return;
           }
-          if (dependencyManager === null) {
-            respond(response, 503, { error: "the dependency manager is not ready" });
+          if (updater === null) {
+            respond(response, 503, { error: "the version manager is not ready" });
             return;
           }
-          const started = dependencyManager.start();
-          respond(response, started.started ? 202 : 409, {
-            started: started.started,
-            reason: started.reason ?? null,
-            spec: started.spec ?? null,
-            prepare: dependencyManager.snapshot(),
-          });
+          const view = updater.view();
+          const target = view.versions.pinned ?? view.check.latest;
+          if (target === null) {
+            respond(response, 409, { started: false, reason: "no Windows-MCP version is known yet", prepare: prepareSnapshot() });
+            return;
+          }
+          if (view.install.phase === "installing") {
+            respond(response, 409, { started: false, reason: "an install is already running", prepare: prepareSnapshot() });
+            return;
+          }
+          void updater.installVersion(target);
+          respond(response, 202, { started: true, spec: `windows-mcp@${target}`, prepare: prepareSnapshot() });
         };
 
         /** Stop a running install. */
@@ -565,31 +641,177 @@ function registerStateRoute(ctx, warn) {
             respond(response, 405, { error: "method not allowed" });
             return;
           }
-          const cancelled = dependencyManager !== null && dependencyManager.cancel();
-          respond(response, 200, { cancelled, prepare: dependencyManager === null ? null : dependencyManager.snapshot() });
+          const result = updater === null ? { cancelled: false } : updater.cancel();
+          respond(response, 200, { cancelled: result.cancelled === true, prepare: prepareSnapshot() });
         };
 
-        /** Point the bridge at the installed executable (also done after install). */
+        /** Point the bridge at the active executable (managed install first). */
         const bridgeHandler = (request, response) => {
           if (request.method !== "POST") {
             respond(response, 405, { error: "method not allowed" });
             return;
           }
-          const executable = windowsMcpExecutable();
+          const view = updater === null ? null : updater.view();
+          const executable = view?.versions?.activeExecutable ?? windowsMcpExecutable();
           if (executable === null) {
             respond(response, 409, {
               ok: false,
-              error: "Windows-MCP is not installed through `uv tool` yet, so there is nothing to point the bridge at.",
+              error: "Windows-MCP is not installed yet, so there is nothing to point the bridge at.",
             });
             return;
           }
           respond(response, 200, writeBridgeOverride(executable, { warn, version: selfVersion() }));
         };
 
+        /** Check for, install, activate and roll back Windows-MCP versions. */
+        const updateHandler = (request, response) => {
+          if (request.method === "GET") {
+            respond(response, 200, updater === null ? { error: "the version manager is not ready" } : updater.view());
+            return;
+          }
+          if (request.method !== "POST") {
+            respond(response, 405, { error: "method not allowed" });
+            return;
+          }
+          if (updater === null) {
+            respond(response, 503, { error: "the version manager is not ready" });
+            return;
+          }
+          const chunks = [];
+          let size = 0;
+          request.on("data", (chunk) => {
+            size += chunk.length;
+            if (size > MAX_STATE_BODY_BYTES) {
+              request.destroy();
+              return;
+            }
+            chunks.push(chunk);
+          });
+          request.on("end", () => {
+            let body;
+            try {
+              body = JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
+            } catch {
+              respond(response, 400, { error: "invalid JSON body" });
+              return;
+            }
+            const action = typeof body?.action === "string" ? body.action : "";
+            const version = typeof body?.version === "string" && body.version !== "" ? body.version : null;
+            const allowed = [...UPDATE_ACTIONS, "cancel"];
+            if (!allowed.includes(action)) {
+              respond(response, 400, { error: `expected { action } in ${allowed.join(", ")}` });
+              return;
+            }
+            if (action === "check") {
+              void updater.check({ force: true });
+              respond(response, 202, { started: true, action });
+              return;
+            }
+            if (action === "install") {
+              const view = updater.view();
+              const target = version ?? view.check.latest ?? view.versions.pinned;
+              if (target === null) {
+                respond(response, 409, { ok: false, error: "no Windows-MCP version is known yet — check for updates first" });
+                return;
+              }
+              void updater.installVersion(target);
+              respond(response, 202, { started: true, action, version: target });
+              return;
+            }
+            if (action === "cancel") {
+              respond(response, 200, updater.cancel());
+              return;
+            }
+            if (action === "activate") {
+              if (version === null) {
+                respond(response, 400, { error: "activate needs { version }" });
+                return;
+              }
+              respond(response, 200, updater.activateInstalled(version));
+              return;
+            }
+            respond(response, 200, updater.rollback());
+          });
+          request.on("error", () => respond(response, 400, { error: "request failed" }));
+        };
+
+        /**
+         * Read and update the user settings. Plugin settings apply at once;
+         * bridge settings are written into the profile patch row and only take
+         * effect after DSH restarts.
+         */
+        const settingsHandler = (request, response) => {
+          if (request.method === "GET") {
+            respond(response, 200, settingsView());
+            return;
+          }
+          if (request.method !== "POST") {
+            respond(response, 405, { error: "method not allowed" });
+            return;
+          }
+          const chunks = [];
+          let size = 0;
+          request.on("data", (chunk) => {
+            size += chunk.length;
+            if (size > MAX_SETTINGS_BODY_BYTES) {
+              request.destroy();
+              return;
+            }
+            chunks.push(chunk);
+          });
+          request.on("end", () => {
+            let body;
+            try {
+              body = JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
+            } catch {
+              respond(response, 400, { error: "invalid JSON body" });
+              return;
+            }
+            const incoming = body !== null && typeof body === "object" && body.settings !== null && typeof body.settings === "object" ? body.settings : body;
+            const normalized = normalizeSettings(incoming);
+            const stored = writeSettings(normalized.settings, stateDirectory);
+            settings = stored.settings;
+            const wanted = bridgeSettingsOf(settings);
+            if (bridgeSettingsMatch(settings, readText(patchPath))) {
+              respond(response, 200, {
+                ok: true,
+                saved: stored.written,
+                problems: normalized.problems,
+                write: null,
+                ...settingsView(),
+              });
+              return;
+            }
+            const view = updater === null ? null : updater.view();
+            const executable = view?.versions?.activeExecutable ?? windowsMcpExecutable();
+            if (executable === null) {
+              respond(response, 200, {
+                ok: true,
+                saved: stored.written,
+                problems: normalized.problems,
+                write: { ok: false, error: "Windows-MCP is not installed yet, so the bridge row was left untouched" },
+                ...settingsView(),
+              });
+              return;
+            }
+            const written = writeBridgeOverride(executable, { warn, version: selfVersion(), settings: wanted });
+            respond(response, 200, {
+              ok: written.ok === true,
+              saved: stored.written,
+              problems: normalized.problems,
+              write: written,
+              ...settingsView(),
+            });
+          });
+          request.on("error", () => respond(response, 400, { error: "request failed" }));
+        };
+
         scoped.webServer.register({ kind: "exact", path: STATE_ROUTE, handler });
         scoped.webServer.register({ kind: "exact", path: PREPARE_ROUTE, handler: prepareHandler });
         scoped.webServer.register({ kind: "exact", path: PREPARE_CANCEL_ROUTE, handler: cancelHandler });
         scoped.webServer.register({ kind: "exact", path: BRIDGE_ROUTE, handler: bridgeHandler });
+        scoped.webServer.register({ kind: "exact", path: UPDATE_ROUTE, handler: updateHandler });
+        scoped.webServer.register({ kind: "exact", path: SETTINGS_ROUTE, handler: settingsHandler });
       } catch (error) {
         warn(`could not register the Computer Use state route: ${String(error)}`);
       }
@@ -607,16 +829,34 @@ export function apply(ctx) {
   try {
     const warn = makeLogger(ctx);
     computerUse.enabled = readComputerUse().enabled;
-    dependencyManager = createPrepare({
+    settings = readSettings(stateDirectory);
+    updater = createUpdater({
       warn,
       resolver: which,
       pinned: windowsMcpVersionPin(readText(patchPath)),
-      afterInstall: (executable) => writeBridgeOverride(executable, { warn, version: selfVersion() }),
+      preferredMirror: () => (settings === null ? "auto" : settings.plugin.preferredMirror),
+      writeBridge: (executable) =>
+        writeBridgeOverride(executable, {
+          warn,
+          version: selfVersion(),
+          settings: settings === null ? null : bridgeSettingsOf(settings),
+        }),
     });
     auditStartup(warn);
     registerDoctor(ctx, warn);
     registerStateRoute(ctx, warn);
     registerToolGate(ctx, warn);
+    // Check for a newer Windows-MCP build in the background (cheap: a ranged
+    // read per mirror, cached for hours). The page shows the result; the boot
+    // never waits for it, and a failure only costs the last known answer. The
+    // settings page can turn this off.
+    if (settings === null || settings.plugin.autoCheckUpdates === true) {
+      try {
+        void updater.check({ force: false }).catch(() => {});
+      } catch {
+        /* a failed check is not a boot problem */
+      }
+    }
   } catch {
     /* apply() must not throw, whatever happens */
   }