gazesight 0.5.0 → 0.5.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md CHANGED
@@ -1,112 +1,183 @@
1
1
  # GazeSight
2
2
 
3
- **GazeSight — Browser vision for coding agents.**
3
+ **Browser vision for coding agents.**
4
4
 
5
5
  **Let your coding agent see what you see.**
6
6
 
7
- GazeSight lets coding agents inspect the browser tab you're already using, without launching another browser session. Firefox is fully supported and publicly available from Mozilla Add-ons (0.4.0). Chrome is supported via manual installation while it awaits Chrome Web Store publication. Node.js 20+ and an MCP coding agent with image support are required. Technical decisions and measured results live in `GAZESIGHT_MASTER_SPEC.md` in the source repository.
7
+ GazeSight connects Claude Code and OpenAI Codex to the browser you already use. Through MCP, agents can capture the page, inspect the DOM, interact with elements, read diagnostics, and verify visual changes against a reference.
8
8
 
9
- ## Install and first capture
9
+ - Website: [gazesight.dev](https://www.gazesight.dev/)
10
+ - npm: [gazesight](https://www.npmjs.com/package/gazesight)
11
+ - Browsers: Firefox and Chrome
12
+ - Public MCP tools: exactly 25
13
+ - Architecture: local-first, with no GazeSight cloud capture backend
14
+
15
+ ## Choose your setup
16
+
17
+ ### GazeSight Desktop — recommended direction
18
+
19
+ GazeSight Desktop provides the simplest onboarding model: it embeds its own runtime, so GazeSight itself does not require a system Node.js installation. It detects Claude Code and Codex, configures lightweight MCP adapters, and owns one shared browser bridge.
20
+
21
+ Desktop `0.6.0-beta.1` is currently in release-candidate preparation and is **not yet publicly downloadable**. No public Desktop download link is provided until signed artifacts and the required platform validation are complete.
22
+
23
+ ### npm / CLI — advanced, available now
24
+
25
+ The npm package is the currently available installation path. It requires Node.js 20 or newer.
26
+
27
+ Run without a global installation:
10
28
 
11
29
  ```sh
12
30
  npx gazesight setup
13
31
  ```
14
32
 
15
- Published on the public npm registry: https://www.npmjs.com/package/gazesight. `npx gazesight setup` and `npm install -g gazesight && gazesight setup` are equivalent entrypoints.
33
+ Or install the CLI globally:
16
34
 
17
- To configure a specific coding agent non-interactively (`setup` otherwise prompts when run in a real terminal):
35
+ ```sh
36
+ npm install -g gazesight
37
+ gazesight setup
38
+ ```
39
+
40
+ Configure a specific coding agent when needed:
18
41
 
19
42
  ```sh
20
- npx gazesight setup --client claude
21
- npx gazesight setup --client codex
22
- npx gazesight setup --client both
43
+ gazesight setup --client claude
44
+ gazesight setup --client codex
45
+ gazesight setup --client both
23
46
  ```
24
47
 
48
+ Useful commands:
49
+
25
50
  ```sh
26
- npx gazesight doctor
51
+ gazesight --help
52
+ gazesight doctor
53
+ gazesight pair
27
54
  ```
28
55
 
29
- 1. Run `gazesight setup` in a real terminal. It configures Claude Code, Codex, or both, then keeps a temporary loopback pairing listener open. Re-running setup is safe and leaves existing client registrations unchanged.
30
- 2. Install a compatible extension: **Firefox 0.4.0+** from Mozilla Add-ons or **Chrome 0.2.0+** by loading the packaged extension manually while Chrome Web Store publication remains pending.
31
- 3. Open GazeSight and click **Connect to GazeSight**. Confirm that the six-digit verification code matches the terminal, then explicitly approve it there. The code expires and is not the permanent credential.
32
- 4. Open your local project in your browser, keep its tab active, and click **Use this tab**. Pairing never selects or authorizes a tab automatically.
33
- 5. Restart your coding agent to load MCP, then run `gazesight doctor` while its GazeSight connection is active.
34
- 6. Ask your agent: "Use GazeSight visual_capture to inspect my active preview tab." The image arrives directly as MCP image content.
56
+ `setup` uses the official agent CLI when it is available and does not overwrite unrelated MCP server entries. `doctor` is read-only. `pair` can connect another browser or revoke an existing browser pairing.
35
57
 
36
- Compatibility: npm/MCP 0.4.x pairs with Firefox 0.4.x and Chrome 0.2.x. The prepared 0.5.x runtime/Firefox and 0.3.x Chrome candidates remain unpublished until their release gates are approved. The published npm 0.3.5 runtime remains compatible with Firefox 0.3.4 through Advanced manual configuration; zero-friction pairing is not available in those older builds. New and legacy browser credentials are scoped independently, and importing a legacy JSON configuration remains a recovery fallback rather than a pairing prerequisite.
58
+ ## Install a browser extension
37
59
 
38
- Claude Code and Codex can both be configured, but the current local architecture allows only one GazeSight MCP process to own a configured bridge port at a time. A second process exits explicitly with `GS_PORT_IN_USE`; close the first client session before starting the other, or use a separate config and port. GazeSight does not terminate or silently take over another process.
60
+ Use an official public listing:
39
61
 
40
- Claude Code stores user-scope servers in `~/.claude.json`; Codex uses `~/.codex/config.toml` with `[mcp_servers.gazesight]`. Setup generates installation-specific Node/CLI paths; it never relies on a developer's source checkout. See [Claude Code MCP docs](https://code.claude.com/docs/en/mcp-quickstart) and [Codex MCP docs](https://developers.openai.com/codex/mcp/).
62
+ - [Firefox — Mozilla Add-ons](https://addons.mozilla.org/firefox/addon/6a2319d4fa544731884d/) (`0.5.0`)
63
+ - [Chrome — Chrome Web Store](https://chromewebstore.google.com/detail/gazesight/hikhblabkhbaoilcffenldphdkjdmphc) (`0.3.0`)
41
64
 
42
- ## Capture and permissions
65
+ Developer builds and unpacked extensions are separate development workflows. They are not required for normal installation.
43
66
 
44
- FAST is the default (`waitForStable: false`). STABLE (`waitForStable: true`) observes local DOM/resources/layout activity with a 100ms quiet window, two frames, and a 2000ms deadline. It means **render appears stable**, not "HMR finished." A future delayed update can still arrive later. Continuous animation or unfinished resources can cause an explicit timeout.
67
+ ## First run
45
68
 
46
- HMR ordinarily preserves application state. Explicit reload/navigation replaces the document and can reset it. After a new document, the REAUTH badge and `GS_REAUTHORIZE_TARGET` ask you to click the icon again. GazeSight never grants permission or chooses a replacement tab automatically.
69
+ 1. Install or configure GazeSight.
70
+ 2. Install the Firefox or Chrome extension from its official listing.
71
+ 3. Open the extension and choose **Connect to GazeSight**.
72
+ 4. Open the page you want to share.
73
+ 5. Click **Use this tab** in that tab.
74
+ 6. Use GazeSight from Claude Code or Codex.
47
75
 
48
- ## Doctor and troubleshooting
76
+ Pairing a browser does **not** authorize a tab. The active target changes only after an explicit **Use this tab** action. Reloads or navigations that invalidate the authorization require another explicit selection.
49
77
 
50
- ```sh
51
- gazesight doctor
52
- gazesight --help
78
+ ## Desktop architecture
79
+
80
+ ```text
81
+ Claude Code / Codex
82
+ ↓
83
+ MCP stdio adapters
84
+ ↓
85
+ authenticated local IPC
86
+ ↓
87
+ GazeSight Desktop Runtime
88
+ ↓
89
+ 127.0.0.1:32147
90
+ ↓
91
+ Firefox / Chrome
53
92
  ```
54
93
 
55
- Doctor is read-only and reports corrective actions for Node/build, MCP/port, connection/pairing, target and capture permission. **Run it while your coding agent's MCP session is active** — the MCP server's own health-check endpoint only stays reachable while a real MCP client holds its stdio connection open (this is intentional: the same signal that tells GazeSight a session ended). Only one GazeSight server can own a port; stop a competing agent or configure a different port with `gazesight setup --config PATH --port PORT` and import that config into the extension. Existing config is reused without overwriting its token or port. `GS_NO_TARGET_TAB`: select a local preview with the icon. `GS_NOT_CONNECTED`: check extension options and agent MCP startup. An inactive target is refused; return to that tab. Nothing launches a browser for you.
94
+ Desktop owns one long-lived Runtime and one browser bridge. Claude Code and Codex can connect through independent lightweight adapters at the same time. They share the same explicitly authorized browser target, and closing one adapter does not stop the other.
56
95
 
57
- Use `gazesight pair` to pair a second browser or recover after reinstalling an extension. Use `gazesight pair --revoke ID` (or `--revoke all`) to revoke stored extension credentials. Manual JSON import remains available under **Advanced manual configuration** for legacy recovery only.
96
+ Desktop detects Firefox Release and Firefox Developer Edition separately without selecting either one automatically. Browser target selection still happens only through the extension.
58
97
 
59
- ## Local configuration
98
+ The advanced standalone CLI mode is different: each MCP process owns its configured browser bridge. Two standalone processes cannot own the same port; the second exits with `GS_PORT_IN_USE`. Use Desktop shared-runtime mode for concurrent Claude Code and Codex sessions.
60
99
 
61
- Windows: `%APPDATA%/GazeSight/config.json`. macOS: `~/Library/Application Support/GazeSight/config.json`. Linux: `$XDG_CONFIG_HOME/gazesight/config.json`, or `~/.config/gazesight/config.json`. Override with `--config PATH` or `GAZESIGHT_CONFIG_FILE`. Run GazeSight setup to create a fresh pairing configuration. No previous configuration or token is copied or deleted. Files are created exclusively with mode 0600 where supported; Windows uses inherited directory ACLs. Keep the private config in your own user directory.
100
+ ## MCP capabilities
62
101
 
63
- ## Privacy and security
102
+ GazeSight exposes exactly 25 public MCP tools, grouped around:
64
103
 
65
- The bridge binds only 127.0.0.1 and requires a random 256-bit pairing token. No GazeSight backend, telemetry, startup task or persistent service is installed. Images are not written to disk by default. Captures, selected URLs, runtime errors and browser status travel to your local coding agent; that agent may send image/content to its model provider according to its own settings — GazeSight does not claim that no data ever leaves your device once your agent is in the loop. Select only tabs you intend to share. No arbitrary page JavaScript execution is exposed. External website origins are disabled unless explicitly configured in both extension and server. Full policy: https://www.gazesight.dev/privacy/
104
+ - viewport, region, element, full-page, FAST, and STABLE capture;
105
+ - DOM and element inspection;
106
+ - viewport measurement and responsive preview sizing;
107
+ - bounded click, type, key, hover, scroll, select, and focus interactions;
108
+ - console, network-failure, page-status, and error diagnostics;
109
+ - navigation and reload;
110
+ - temporary element highlighting;
111
+ - changed-region detection and visual diff.
66
112
 
67
- ## Uninstall
113
+ Interactions use fixed, validated operations. GazeSight does not expose arbitrary page JavaScript evaluation.
68
114
 
69
- ```sh
70
- npm uninstall -g gazesight
115
+ ## Visual Convergence — Beta
116
+
117
+ Visual Convergence helps an agent refine an implementation against a visual reference:
118
+
119
+ ```text
120
+ Reference → Implement → Capture → Compare → Refine → Verify
71
121
  ```
72
122
 
73
- Remove the MCP entry from your agent (`claude mcp remove gazesight -s user`, or `codex mcp remove gazesight`, or delete the manual `.mcp.json`/`config.toml` entry) and the extension from your browser, then stop/restart that agent to close its MCP process and release the port. Uninstall retains the private config. Delete it manually if desired; no user data is automatically removed.
123
+ The existing capture and `visual_diff` capabilities can compare equal-sized PNG images, localize differences, and maintain a local best-so-far checkpoint with an objective regression signal. The connected coding agent interprets the images and makes the code changes.
74
124
 
75
- ## Closed preview and TTFC
125
+ Visual Convergence does not guarantee pixel-perfect output, autonomous perfection, universal convergence, or regression-free implementation. Review the returned images and measurements as part of the development workflow.
76
126
 
77
- Signed XPI installation in normal Firefox and the complete first-run flow must pass before Closed Developer Preview GO. Five future testers can manually fill `docs/preview-matrix.csv`; no results are uploaded automatically. Time To First Capture (TTFC) starts **before installation/setup** and ends when the coding agent first receives a successful image. Record start/end locally with a stopwatch or timestamps, including manual steps; target under 3 minutes is indicative, not a build gate. A developer's already-paired capture latency is not a new-user TTFC measurement.
127
+ ## Privacy and security
128
+
129
+ - The browser bridge binds to loopback only.
130
+ - GazeSight does not operate a cloud capture backend.
131
+ - Screenshots and DOM content are not uploaded to a GazeSight server by default.
132
+ - Data returned through MCP may be processed by the connected coding agent or model provider according to that provider's settings.
133
+ - Only explicitly selected tabs are authorized.
134
+ - Pairing alone never authorizes a browser tab.
135
+ - No arbitrary page JavaScript execution is exposed.
136
+ - Credentials and pairing secrets should never be placed in commands, examples, or source control.
137
+
138
+ Read the full [GazeSight Privacy Policy](https://www.gazesight.dev/privacy/).
78
139
 
79
- ## Release maintainers
140
+ ## Troubleshooting
80
141
 
81
- Build validated on Windows x64 with Node 24.15.0. Real npm-package installation validated end to end on Windows (clean `npm pack` tarball installed into an isolated directory outside the monorepo, then CLI/`setup`/`doctor`/`mcp` all exercised against real client connections). macOS and Linux are not code-path-specific (cross-platform config paths, standard `#!/usr/bin/env node` shebang, no Windows-only APIs) but have not been independently installed and tested on those OSes — treat that as not-yet-validated, not as validated by inference. Use Node 22+ for Mozilla release tooling (runtime package remains Node 20+). Install the exact dependencies through package-lock.json.
142
+ ### Desktop mode
143
+
144
+ - Open Desktop and check that Runtime is running.
145
+ - Check the Firefox/Chrome connection and active-target status.
146
+ - Use **Configure** or **Repair** for the Claude Code or Codex entry.
147
+ - If an adapter reports `GS_DESKTOP_RUNTIME_NOT_FOUND`, open GazeSight Desktop and retry.
148
+ - If the extension is connected but no target is authorized, open the intended tab and click **Use this tab**.
149
+
150
+ ### Standalone CLI mode
82
151
 
83
152
  ```sh
84
- npm ci
85
- npm run build
86
- npm run lint
87
- npm run typecheck
88
- npm test
89
- npm run extension:lint
90
- npm run release
153
+ gazesight doctor
91
154
  ```
92
155
 
93
- Root `package.json` is the canonical version; `npm run build` synchronizes internal packages, manifest and generated runtime version. `npm run release` creates a tarball, a clearly unsigned Firefox XPI and SHA-256 checksums in `release/`. `npm pack` produces the actual npm publication tarball (52 files as of this writing: CLI, MCP server, worker, Firefox and Chrome extension builds, README, LICENSE, `docs/preview-matrix.csv` — never the monorepo's TypeScript source, tests, or experiments). `npm run extension:sign` requires `WEB_EXT_API_KEY` (AMO JWT issuer) and `WEB_EXT_API_SECRET` (AMO JWT secret) in the environment. It uses Mozilla's unlisted channel; credentials never enter source or command arguments. Build/lint first, then sign; no signed filename is generated without a successful Mozilla response and signature entries. Re-run release for checksums after signing. Provide reproducible TypeScript source/build instructions to AMO reviewers if requested; never include credentials or private config. See [Mozilla signing guide](https://extensionworkshop.com/documentation/develop/getting-started-with-web-ext/).
156
+ - `GS_PORT_IN_USE`: another standalone GazeSight MCP process owns that port. Stop it or use a separate configuration and port.
157
+ - `GS_NOT_CONNECTED`: check the extension connection and the configured loopback port.
158
+ - `GS_NO_TARGET_TAB`: select the intended browser tab with **Use this tab**.
159
+ - Use `gazesight pair` to pair another browser or recover after reinstalling an extension.
94
160
 
95
- ### npm publication
96
-
97
- Published: https://www.npmjs.com/package/gazesight — first public release, `gazesight@0.3.5`, `latest` dist-tag. Published from a trusted local machine using a granular npm access token (bypass-2FA, revoked immediately after use; the account's normal interactive OTP/2FA prompt did not trigger reliably from the CLI in this environment). Root `package.json`'s `"private": true` guard was removed as the one deliberate, explicit step immediately preceding the real publish — never something a build/release script does automatically. Verified independently after publishing: `npm view gazesight@0.3.5` against the live registry, the published tarball downloaded and compared byte-for-byte (SHA-256) against the locally-built one, and a real `@modelcontextprotocol/client` connection through a fresh `npx --yes gazesight@0.3.5 mcp` confirming all 25 tools. For future releases, prefer npm's Trusted Publishing (OIDC from a GitHub Actions workflow, no long-lived token stored anywhere) if CI is set up for this project; otherwise a local publish with a short-lived granular token remains the fallback. Never commit an npm token to this repository. Verify any future publish from a clean environment:
161
+ ## Uninstall the npm package
98
162
 
99
163
  ```sh
100
- npx --yes gazesight@latest setup
101
- npx --yes gazesight@latest doctor
164
+ npm uninstall -g gazesight
102
165
  ```
103
166
 
104
- ## Before distribution
167
+ Remove the `gazesight` MCP entry from the relevant coding agent if it is no longer needed. Do not remove unrelated MCP entries.
168
+
169
+ ## Maintainers
105
170
 
106
- The permanent Firefox add-on identity is **extension@gazesight.dev**, using the domain confirmed as controlled by the owner. GazeSight has its own unlisted AMO submission and a genuinely Mozilla-returned signed 0.3.4 XPI. The signed payload matches the submitted build. Normal Firefox installation, pairing and native capture validation must complete before external distribution. Chrome Web Store submission materials (listing copy, screenshots, promotional assets, reviewer instructions) are prepared under `release/gazesight-chrome-cws-*`; submission itself awaits explicit owner approval. Previous project evidence is archived separately in the source repository; it does not validate this build.
171
+ ```sh
172
+ npm ci
173
+ npm run build
174
+ npm run lint
175
+ npm run typecheck
176
+ npm test
177
+ ```
107
178
 
108
- The project license is proprietary, all rights reserved (see LICENSE).
179
+ Before an npm release, inspect the exact `npm pack` tarball and test it from a clean directory. Never commit npm tokens, browser-store credentials, signing certificates, or private configuration.
109
180
 
110
- ## Environment
181
+ ## License
111
182
 
112
- `GAZESIGHT_CONFIG_FILE` selects the private config. Explicit environment settings take priority: `GAZESIGHT_PAIR_TOKEN` (64 hexadecimal characters), `GAZESIGHT_PORT` (32147), `GAZESIGHT_TIMEOUT_MS` (10000), `GAZESIGHT_ALLOWED_ORIGINS` (comma-separated exact origins), `GAZESIGHT_DEBUG_DIR` (image disk output, disabled by default). MCP status is `gazesight://status`; doctor uses authenticated loopback `/gazesight/status`.
183
+ GazeSight is proprietary software. All rights reserved. See [LICENSE](LICENSE).