gazesight 0.5.0 → 0.5.2

package/dist/cli/index.js

@@ -3,13 +3,13 @@
 // apps/cli/src/index.ts
 import { existsSync as existsSync2 } from "node:fs";
 import { createInterface as createInterface2 } from "node:readline/promises";
-import { resolve as resolve2, dirname as dirname2, join as join2, delimiter } from "node:path";
+import { resolve as resolve2, dirname as dirname2, join as join2 } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
 // apps/cli/src/config.ts
 import { randomBytes } from "node:crypto";
 import { readFileSync, writeFileSync, mkdirSync, renameSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { dirname, posix, win32 } from "node:path";
 import { homedir } from "node:os";
 
 // apps/cli/src/config-browser.ts
@@ -41,22 +41,23 @@ var localConfigSchema = z.strictObject({
 
 // apps/cli/src/config.ts
 function configPathFor(platform, home, env) {
+  const pathJoin = platform === "win32" ? win32.join : posix.join;
   if (platform === "win32")
-    return join(
-      env.APPDATA ?? join(home, "AppData", "Roaming"),
+    return pathJoin(
+      env.APPDATA ?? pathJoin(home, "AppData", "Roaming"),
       "GazeSight",
       "config.json"
     );
   if (platform === "darwin")
-    return join(
+    return pathJoin(
       home,
       "Library",
       "Application Support",
       "GazeSight",
       "config.json"
     );
-  return join(
-    env.XDG_CONFIG_HOME ?? join(home, ".config"),
+  return pathJoin(
+    env.XDG_CONFIG_HOME ?? pathJoin(home, ".config"),
     "gazesight",
     "config.json"
   );
@@ -101,7 +102,7 @@ function writeLocalConfig(path, value) {
 }
 
 // packages/protocol/src/release.ts
-var VERSION = "0.5.0";
+var VERSION = "0.5.2";
 
 // apps/cli/src/doctor.ts
 import { z as z2 } from "zod";
@@ -119,18 +120,20 @@ function diagnosticRows(status, reachable = false, authenticated = false) {
     },
     {
       name: "extension connected",
-      pass: !!status?.connected,
+      pass: !!status?.connected || Object.values(status?.connectedBrowsers ?? {}).some(Boolean),
       action: status?.authorizedPairings ? "An extension is paired but disconnected. Start it and verify the configured bridge port." : "Open Firefox or Chrome, then click Connect to GazeSight in the extension."
     },
     {
       name: "pairing",
-      pass: authenticated && !!status?.paired,
+      // Pairing is durable authorization, while `paired` means a live
+      // WebSocket connection. An approved extension can be offline.
+      pass: authenticated && (status?.paired === true || (status?.authorizedPairings ?? 0) > 0),
       action: "Run gazesight pair, click Connect to GazeSight, and approve the matching code."
     },
     {
       name: "target selected",
       pass: !!status && status.targetState !== "none",
-      action: "Open your local preview in Firefox and click the GazeSight icon."
+      action: `Open your local preview in ${status?.activeTarget?.browser === "chrome" ? "Chrome" : "Firefox or Chrome"} and click the GazeSight icon.`
     },
     {
       name: "capture permission",
@@ -164,7 +167,9 @@ var statusSchema = z2.object({
   paired: z2.boolean(),
   targetState: z2.enum(["none", "authorized", "reauthorization_required"]),
   backgroundCapture: z2.object({ enabled: z2.boolean(), permissionGranted: z2.boolean() }).optional(),
-  authorizedPairings: z2.number().int().nonnegative().optional()
+  authorizedPairings: z2.number().int().nonnegative().optional(),
+  connectedBrowsers: z2.object({ firefox: z2.boolean().optional(), chrome: z2.boolean().optional() }).optional(),
+  activeTarget: z2.object({ browser: z2.enum(["firefox", "chrome"]).optional() }).nullable().optional()
 });
 
 // apps/cli/src/pair.ts
@@ -951,7 +956,7 @@ var PairingService = class {
   }
   listPending() {
     this.expire();
-    return [...this.pending.values()].filter((item) => item.state === "pending").map(({ id, browser, extensionId, code, createdAt, expiresAt }) => ({ id, browser, extensionId, code, createdAt, expiresAt }));
+    return [...this.pending.values()].filter((item) => item.state === "pending").map(({ id, browser, extensionId, code, createdAt, expiresAt }) => ({ id, browser, extensionId, code, createdAt, expiresAt })).sort((a, b) => b.createdAt - a.createdAt);
   }
   listPairings() {
     return this.pairings.map(({ id, browser, extensionId, origin, createdAt, revokedAt }) => ({ id, browser, extensionId, origin, createdAt, ...revokedAt ? { revokedAt } : {} }));
@@ -1247,6 +1252,9 @@ var Bridge = class {
   server;
   http;
   listenError;
+  closePromise;
+  mcpClientCount = 0;
+  desktopIpcReady = false;
   pairing;
   // Resolves the connection currently backing the global active target, or
   // undefined if no browser is active (nothing selected yet, or the
@@ -1309,6 +1317,8 @@ var Bridge = class {
       })
     );
     return {
+      mcpClients: this.mcpClientCount,
+      desktopIpcReady: this.desktopIpcReady,
       connected: this.connected,
       paired: this.connected,
       authorizedPairings: this.pairing.listPairings().filter((item) => !item.revokedAt).length,
@@ -1321,22 +1331,47 @@ var Bridge = class {
       activeTarget: active ? { browser: active.browser, url: active.state.url } : null
     };
   }
+  setMcpClientCount(count) {
+    this.mcpClientCount = Math.max(0, Math.min(32, Math.floor(count)));
+  }
+  setDesktopIpcReady(ready) {
+    this.desktopIpcReady = ready;
+  }
   async ready() {
     if (this.listenError) throw this.listenError;
     if (this.server.address()) return;
     await new Promise((resolve3, reject) => {
-      this.server.once("listening", resolve3);
-      const onError = () => reject(this.listenError);
+      const cleanup = () => {
+        this.server.off("listening", onListening);
+        this.server.off("error", onError);
+        this.http.off("error", onError);
+      };
+      const onListening = () => {
+        cleanup();
+        resolve3();
+      };
+      const onError = () => {
+        cleanup();
+        reject(this.listenError);
+      };
+      this.server.once("listening", onListening);
       this.server.once("error", onError);
       this.http.once("error", onError);
     });
   }
   async close() {
-    clearInterval(this.heartbeat);
-    for (const wiring of this.wiring.values()) wiring.router.disconnect();
-    for (const client of this.server.clients) client.terminate();
-    await new Promise((resolve3) => this.server.close(() => resolve3()));
-    await new Promise((resolve3) => this.http.close(() => resolve3()));
+    if (this.closePromise) return this.closePromise;
+    this.closePromise = (async () => {
+      clearInterval(this.heartbeat);
+      for (const wiring of this.wiring.values()) wiring.router.disconnect();
+      this.wiring.clear();
+      for (const client of this.server.clients) client.terminate();
+      if (this.http.listening)
+        await new Promise((resolve3) => this.http.close(() => resolve3()));
+      else if (this.server.address())
+        await new Promise((resolve3) => this.server.close(() => resolve3()));
+    })();
+    return this.closePromise;
   }
 };
 
@@ -1389,7 +1424,10 @@ async function pairingFlow(config, configPath, revoke) {
         const answer = (await rl.question("Approve this matching request? [y/N] ")).trim().toLowerCase();
         const approved = answer === "y" || answer === "yes";
         const result = await admin(config.port, config.token, approved ? "approve" : "reject", "POST", { id: request.id, code: request.code });
-        if (!result.ok) throw new Error("The pairing request expired or was already used.");
+        if (!result.ok) {
+          console.log("That request expired or was replaced. Checking for the latest request\u2026");
+          continue;
+        }
         if (approved) {
           const deadline = Date.now() + 5e3;
           let delivered = false;
@@ -1402,8 +1440,32 @@ async function pairingFlow(config, configPath, revoke) {
             await new Promise((resolve3) => setTimeout(resolve3, 100));
           }
           if (!delivered) throw new Error("The approved credential was not delivered; keep the extension open and retry pairing.");
-          console.log("Pairing approved and delivered. The extension can now reconnect securely.");
-        } else console.log("Pairing rejected.");
+          console.log("Pairing approved and delivered.");
+          console.log("Waiting for the extension to connect to this GazeSight bridge (up to 15 seconds)\u2026");
+          const connectionDeadline = Date.now() + 15e3;
+          let connected = false;
+          while (Date.now() < connectionDeadline) {
+            const status = await fetch(`http://127.0.0.1:${config.port}/gazesight/status`, {
+              headers: headers(config.token),
+              signal: AbortSignal.timeout(1500)
+            }).catch(() => void 0);
+            if (status?.ok) {
+              const value = await status.json();
+              if (value.connectedBrowsers?.[request.browser] === true) {
+                connected = true;
+                break;
+              }
+            }
+            await new Promise((resolve3) => setTimeout(resolve3, 250));
+          }
+          if (connected)
+            console.log("Extension connected. Pairing is ready.");
+          else
+            console.log(`Credential delivered, but ${request.browser} did not connect. Keep the extension installed and enabled, open its popup, verify its configured bridge port is ${config.port}, then click Connect to GazeSight again.`);
+        } else {
+          console.log("Pairing rejected. Waiting for another request\u2026");
+          continue;
+        }
         return;
       }
     } finally {
@@ -1414,159 +1476,309 @@ async function pairingFlow(config, configPath, revoke) {
   }
 }
 
-// apps/cli/src/agent-config.ts
-import { existsSync, readFileSync as readFileSync2 } from "node:fs";
-import { basename, resolve } from "node:path";
-import { spawnSync } from "node:child_process";
-function parseKnownGazeSightArgs(command, argsText) {
-  const cli = argsText.match(/^(.*?[\\/]dist[\\/]cli[\\/]index\.js)\s+mcp(?:\s+--config\s+(.+))?$/i);
-  if (cli) return [cli[1], "mcp", ...cli[2] ? ["--config", cli[2]] : []];
-  if (/^npx(?:\.cmd|\.exe)?$/i.test(basename(command))) {
-    const npx = argsText.match(/^(.*?)\b(gazesight(?:@\d+\.\d+\.\d+)?)\s+mcp(?:\s+--config\s+(.+))?$/i);
-    if (npx) {
-      const prefix = npx[1].trim().split(/\s+/).filter(Boolean);
-      return [...prefix, npx[2], "mcp", ...npx[3] ? ["--config", npx[3]] : []];
-    }
-  }
-  if (/^gazesight(?:-mcp)?(?:\.cmd|\.exe)?$/i.test(basename(command))) {
-    const direct = argsText.match(/^mcp(?:\s+--config\s+(.+))?$/i);
-    if (direct) return ["mcp", ...direct[1] ? ["--config", direct[1]] : []];
-  }
-  return void 0;
+// apps/agent-integration/src/index.ts
+import { spawn as nodeSpawn } from "node:child_process";
+import { constants as fsConstants, existsSync, readFileSync as readFileSync2 } from "node:fs";
+import { access, realpath, stat } from "node:fs/promises";
+import { delimiter, join, posix as posix2, resolve, win32 as win322 } from "node:path";
+var PROCESS_TIMEOUT_MS = 12e3;
+var PROCESS_OUTPUT_BYTES = 16 * 1024;
+function createBoundedRunner(spawnProcess = nodeSpawn) {
+  return (command, args2, options = {}) => runBounded(command, args2, options, spawnProcess);
 }
-function normalize(value) {
-  const normalized = value.trim().replace(/^['"]|['"]$/g, "").replaceAll("\\", "/");
-  return process.platform === "win32" ? normalized.toLowerCase() : normalized;
+var DEFAULT_SPAWN = createBoundedRunner();
+var runAgentCommand = DEFAULT_SPAWN;
+function runBounded(command, args2, options = {}, spawnProcess = nodeSpawn) {
+  return new Promise((resolveResult) => {
+    let child;
+    try {
+      child = spawnProcess(command, [...args2], {
+        shell: false,
+        windowsHide: true,
+        cwd: options.cwd,
+        env: options.env ?? process.env,
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+    } catch {
+      resolveResult({ code: null, stdout: "", stderr: "", timedOut: false });
+      return;
+    }
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    const append = (current, chunk) => {
+      const value = current + String(chunk);
+      return Buffer.byteLength(value) <= PROCESS_OUTPUT_BYTES ? value : Buffer.from(value).subarray(0, PROCESS_OUTPUT_BYTES).toString();
+    };
+    child.stdout?.on("data", (chunk) => {
+      stdout = append(stdout, chunk);
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr = append(stderr, chunk);
+    });
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill();
+    }, options.timeoutMs ?? PROCESS_TIMEOUT_MS);
+    child.once("error", () => {
+      clearTimeout(timer);
+      resolveResult({ code: null, stdout, stderr, timedOut });
+    });
+    child.once("close", (code) => {
+      clearTimeout(timer);
+      resolveResult({ code, stdout, stderr, timedOut });
+    });
+  });
 }
-function parseScope(output) {
-  const value = output.match(/^\s*Scope:\s*(.+)$/im)?.[1]?.toLowerCase() ?? "user";
-  if (value.includes("project")) return "project";
-  if (value.includes("local")) return "local";
-  return "user";
+function pathCandidates(agent, platform, env, home) {
+  const name = agent === "claude" ? "claude" : "codex";
+  const pathJoin = (platform === "win32" ? win322 : posix2).join;
+  const native = [];
+  const packageScripts = [];
+  if (platform === "win32") {
+    const packageManagerBins = [env.PNPM_HOME, env.NPM_CONFIG_PREFIX].filter((value) => Boolean(value)).flatMap((root2) => [pathJoin(root2, `${name}.exe`), pathJoin(root2, `${name}.cmd`)]);
+    if (agent === "claude") {
+      native.push(
+        pathJoin(home, ".local", "bin", "claude.exe"),
+        pathJoin(env.LOCALAPPDATA ?? pathJoin(home, "AppData", "Local"), "Programs", "Claude", "claude.exe"),
+        pathJoin(env.ProgramFiles ?? "C:\\Program Files", "Claude", "claude.exe")
+      );
+    } else {
+      native.push(
+        pathJoin(env.LOCALAPPDATA ?? pathJoin(home, "AppData", "Local"), "Programs", "OpenAI", "Codex", "bin", "codex.exe")
+      );
+    }
+    const npm = pathJoin(env.APPDATA ?? pathJoin(home, "AppData", "Roaming"), "npm", `${name}.cmd`);
+    const modules = [
+      pathJoin(env.APPDATA ?? pathJoin(home, "AppData", "Roaming"), "npm", "node_modules"),
+      ...env.NPM_CONFIG_PREFIX ? [pathJoin(env.NPM_CONFIG_PREFIX, "node_modules")] : [],
+      ...env.PNPM_HOME ? [pathJoin(env.PNPM_HOME, "global", "5", "node_modules"), pathJoin(env.PNPM_HOME, "node_modules")] : [],
+      pathJoin(home, "AppData", "Local", "pnpm", "global", "5", "node_modules")
+    ];
+    const packageName = agent === "claude" ? "@anthropic-ai/claude-code" : "@openai/codex";
+    const nodeCandidates = [
+      env.ProgramFiles ? pathJoin(env.ProgramFiles, "nodejs", "node.exe") : "C:\\Program Files\\nodejs\\node.exe",
+      ...env.LOCALAPPDATA ? [pathJoin(env.LOCALAPPDATA, "Programs", "nodejs", "node.exe")] : [],
+      ...(env.PATH ?? env.Path ?? "").split(delimiter).filter(Boolean).map((directory) => pathJoin(directory, "node.exe"))
+    ];
+    for (const modulesRoot of modules) {
+      const root2 = pathJoin(modulesRoot, packageName);
+      try {
+        const metadata = JSON.parse(readFileSync2(pathJoin(root2, "package.json"), "utf8"));
+        const bin = typeof metadata.bin === "string" ? metadata.bin : metadata.bin && typeof metadata.bin === "object" ? metadata.bin[name] : void 0;
+        if (typeof bin !== "string" || bin.startsWith("/") || bin.split(/[\\/]/).includes("..")) continue;
+        const script = pathJoin(root2, bin);
+        for (const node of nodeCandidates)
+          packageScripts.push({ command: node, prefixArgs: [script], source: "verified npm package" });
+      } catch {
+      }
+    }
+    native.push(npm, ...packageManagerBins);
+  } else {
+    native.push(
+      pathJoin(home, ".local", "bin", name),
+      pathJoin(home, ".npm-global", "bin", name),
+      pathJoin(home, ".local", "share", "pnpm", name),
+      ...env.PNPM_HOME ? [pathJoin(env.PNPM_HOME, name)] : [],
+      ...env.NPM_CONFIG_PREFIX ? [pathJoin(env.NPM_CONFIG_PREFIX, "bin", name)] : []
+    );
+    if (platform === "darwin")
+      native.push(
+        pathJoin(home, "Library", "pnpm", name),
+        "/opt/homebrew/bin/" + name,
+        "/usr/local/bin/" + name
+      );
+    else if (platform === "linux")
+      native.push("/usr/bin/" + name, "/usr/local/bin/" + name);
+  }
+  const fromPath = (env.PATH ?? env.Path ?? "").split(delimiter).filter(Boolean).flatMap(
+    (directory) => platform === "win32" ? [pathJoin(directory, `${name}.exe`), pathJoin(directory, `${name}.cmd`)] : [pathJoin(directory, name)]
+  );
+  const seen = /* @__PURE__ */ new Set();
+  const direct = [...native, ...fromPath].filter((path) => {
+    const key = platform === "win32" ? path.toLowerCase() : path;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  }).map((command) => ({ command, prefixArgs: [], source: "candidate" }));
+  return [...packageScripts, ...direct];
 }
-function versionFromPackageRoot(argsText) {
-  const normalized = argsText.replaceAll("\\", "/");
-  const marker = "/dist/cli/index.js";
-  const markerIndex = normalized.toLowerCase().indexOf(marker);
-  if (markerIndex < 0) return void 0;
-  const root2 = argsText.slice(0, markerIndex);
-  const packagePath = resolve(root2, "package.json");
-  if (!existsSync(packagePath)) return void 0;
+async function verifyCandidate(candidate, platform) {
   try {
-    const parsed = JSON.parse(readFileSync2(packagePath, "utf8"));
-    return typeof parsed.version === "string" ? parsed.version : void 0;
+    const canonical = await realpath(candidate.command);
+    if (canonical.includes("..")) return void 0;
+    const info = await stat(canonical);
+    if (!info.isFile()) return void 0;
+    for (const argument of candidate.prefixArgs) {
+      if (!argument.toLowerCase().endsWith(".js")) continue;
+      const script = await realpath(argument);
+      if (!(await stat(script)).isFile()) return void 0;
+      if (platform === "win32" && !script.toLowerCase().endsWith(".js")) return void 0;
+    }
+    if (platform !== "win32") {
+      await access(canonical, fsConstants.X_OK);
+      if ((info.mode & 73) === 0) return void 0;
+    } else if (!/\.(exe|cmd)$/i.test(canonical)) return void 0;
+    return { ...candidate, command: canonical };
   } catch {
     return void 0;
   }
 }
-function parseRegisteredConfig(agent, output) {
-  const command = output.match(/^\s*(?:Command|command):\s*(.+)$/im)?.[1]?.trim();
-  const argsText = output.match(/^\s*(?:Args|args):\s*(.*)$/im)?.[1]?.trim();
-  if (!command || argsText === void 0) return void 0;
-  const combined = `${command} ${argsText}`;
-  const explicitVersion = combined.match(/(?:^|\s)gazesight@(\d+\.\d+\.\d+)(?:\s|$)/i)?.[1];
-  const commandName = basename(normalize(command));
-  const relatedToGazeSight = /(?:^|[\\/])gazesight(?:-mcp)?(?:\.cmd|\.exe)?$/i.test(command) || /(?:^|[\\/])dist[\\/]cli[\\/]index\.js(?:\s|$)/i.test(argsText) || /(?:^|\s)gazesight(?:@\d+\.\d+\.\d+)?(?:\s|$)/i.test(argsText) || ["npx", "npx.cmd", "npx.exe"].includes(commandName) && /gazesight/i.test(argsText);
+function parseVersion(agent, output) {
+  const value = output.match(/\b(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)\b/)?.[1];
+  if (!value) return void 0;
+  if (agent === "claude" && Number(value.split(".")[0]) < 2) return void 0;
+  return value;
+}
+async function findAgentBinary(id, options = {}) {
+  const platform = options.platform ?? process.platform;
+  const env = options.env ?? process.env;
+  const home = options.home ?? env.USERPROFILE ?? env.HOME ?? "";
+  const run = options.spawn ?? DEFAULT_SPAWN;
+  let sawCandidate = false;
+  let sawDiscoveryError = false;
+  for (const pathCandidate of pathCandidates(id, platform, env, home)) {
+    const candidate = await verifyCandidate(pathCandidate, platform);
+    if (!candidate) continue;
+    sawCandidate = true;
+    const versionResult = await run(candidate.command, [...candidate.prefixArgs, "--version"], { timeoutMs: PROCESS_TIMEOUT_MS, cwd: home });
+    const version = versionResult.code === 0 ? parseVersion(id, `${versionResult.stdout}
+${versionResult.stderr}`) : void 0;
+    const help = await run(candidate.command, [...candidate.prefixArgs, "mcp", "--help"], { timeoutMs: PROCESS_TIMEOUT_MS, cwd: home });
+    if (help.code === 0 && /\badd\b/i.test(help.stdout + help.stderr) && /\bremove\b/i.test(help.stdout + help.stderr))
+      return { candidate, installation: version ? "INSTALLED" : "INSTALLED_VERSION_UNKNOWN", ...version ? { version } : {} };
+    if (!version || help.timedOut || versionResult.timedOut) sawDiscoveryError = true;
+  }
   return {
-    command,
-    argsText,
-    args: parseKnownGazeSightArgs(command, argsText),
-    scope: agent === "claude" ? parseScope(output) : "user",
-    version: explicitVersion ?? versionFromPackageRoot(argsText),
-    obsoleteNpxCache: /(?:^|[\\/])_npx(?:[\\/]|$)/i.test(combined),
-    relatedToGazeSight
+    installation: sawDiscoveryError ? "DISCOVERY_ERROR" : sawCandidate ? "UNSUPPORTED_VERSION" : "NOT_INSTALLED"
   };
 }
-function configurationsMatch(existing, proposed) {
-  return !existing.obsoleteNpxCache && normalize(existing.command) === normalize(proposed.command) && normalize(existing.argsText) === normalize(proposed.args.join(" ")) && (!existing.version || existing.version === proposed.version);
+function parseMcpEntry(agent, output) {
+  const command = output.match(/^\s*(?:Command|command):\s*(.+)$/im)?.[1]?.trim();
+  const args2 = output.match(/^\s*(?:Args|args):\s*(.*)$/im)?.[1]?.trim();
+  if (!command || args2 === void 0) return void 0;
+  const scopeText = output.match(/^\s*Scope:\s*(.+)$/im)?.[1]?.trim().toLowerCase() ?? "user";
+  const scope = scopeText.match(/^(user|project|local)\b/)?.[1] ?? "user";
+  const legacyNpm = /(?:^|\s)(?:npx(?:\.cmd)?\s+(?:(?:--yes|-y)\s+)?(?:gazesight|@gazesight\/mcp-server)|gazesight(?:@\d+\.\d+\.\d+)?\s+mcp)(?:\s|$)/i.test(`${command} ${args2}`) || /[\\/]_npx[\\/]/i.test(`${command} ${args2}`);
+  const knownOwner = legacyNpm || /(?:^|[\\/])dist[\\/]cli[\\/]index\.js(?:\s|$)/i.test(args2) && /\bmcp\b/i.test(args2);
+  const oldCli = args2.match(/^(.*?[\\/]dist[\\/]cli[\\/]index\.js)\s+mcp(?:\s+--config\s+(.+?))?(?:\s+(--desktop-adapter))?$/i);
+  const oldNpm = args2.match(/^(--yes\s+)?(gazesight(?:@\d+\.\d+\.\d+)?|@gazesight\/mcp-server)(?:\s+--yes)?\s+mcp(?:\s+--config\s+(.+))?$/i);
+  const argsVector = oldCli ? [oldCli[1], "mcp", ...oldCli[2] ? ["--config", oldCli[2]] : [], ...oldCli[3] ? [oldCli[3]] : []] : oldNpm ? [...oldNpm[1] ? ["--yes"] : [], oldNpm[2], "mcp", ...oldNpm[3] ? ["--config", oldNpm[3]] : []] : /(?:^|[\\/])gazesight(?:-mcp)?(?:\.cmd|\.exe)?$/i.test(command) && /^mcp\b/i.test(args2) ? ["mcp", ...args2.match(/^mcp\s+--config\s+(.+)$/i)?.[1] ? ["--config", args2.match(/^mcp\s+--config\s+(.+)$/i)[1]] : []] : args2.split(/\s+/).filter(Boolean);
+  return { command, args: args2, argsVector, scope: agent === "claude" ? scope : "user", legacyNpm, knownOwner };
 }
-function display(config) {
-  if ("argsText" in config)
-    return `command=${JSON.stringify(config.command)} args=${JSON.stringify(config.argsText)}${config.version ? ` version=${config.version}` : " version=unknown"} scope=${config.scope}`;
-  return `command=${JSON.stringify(config.command)} args=${JSON.stringify(config.args.join(" "))} version=${config.version}`;
+async function getEntry(agent, binary, run) {
+  const result = await run(binary.command, [...binary.prefixArgs, "mcp", "get", "gazesight"], { timeoutMs: PROCESS_TIMEOUT_MS });
+  const output = `${result.stdout}
+${result.stderr}`;
+  const headers2 = output.match(/(?:^|\n)\s*gazesight\s*:?\s*(?=\r?\n|$)/gi) ?? [];
+  const entry = result.code === 0 && headers2.length <= 1 ? parseMcpEntry(agent, output) : void 0;
+  const named = headers2.length > 0;
+  return { entry, named, code: result.code, output };
 }
-function failure(result) {
-  return (result.stderr || result.stdout || "unknown error").trim().split(/\r?\n/)[0];
+function cliArgs(agent, operation, launch, scope) {
+  if (operation === "remove") return agent === "claude" ? ["mcp", "remove", "gazesight", "-s", scope ?? "user"] : ["mcp", "remove", "gazesight"];
+  const spec = launch;
+  return agent === "claude" ? ["mcp", "add", "--transport", "stdio", "-s", scope ?? "user", "gazesight", "--", spec.command, ...spec.args] : ["mcp", "add", "gazesight", "--", spec.command, ...spec.args];
 }
-function configureAgent(agent, binaryPath, proposed, allowUpdate, spawn = (command, commandArgs) => spawnSync(command, commandArgs, { encoding: "utf8", windowsHide: true })) {
-  const get = spawn(binaryPath, ["mcp", "get", "gazesight"]);
-  const existing = get.status === 0 ? parseRegisteredConfig(agent, get.stdout) : void 0;
-  if (!existing) {
-    const addArgs2 = [
-      "mcp",
-      "add",
-      "gazesight",
-      ...agent === "claude" ? ["--scope", "user"] : [],
-      "--",
-      proposed.command,
-      ...proposed.args
-    ];
-    const add2 = spawn(binaryPath, addArgs2);
-    return add2.status === 0 ? { ok: true, state: "configured", message: "Configured." } : { ok: false, state: "failed", message: `Failed: ${failure(add2)}` };
+function sameLaunch(entry, launch) {
+  const norm = (value) => {
+    return value.trim().replace(/^['"]|['"]$/g, "").replaceAll("\\", "/").toLowerCase();
+  };
+  return norm(entry.command) === norm(launch.command) && norm(entry.args) === norm(launch.args.join(" "));
+}
+async function verifyCurrent(agent, binary, launch, run) {
+  const result = await getEntry(agent, binary, run);
+  return result.entry && result.entry.knownOwner && sameLaunch(result.entry, launch);
+}
+function safeCliFailure(result) {
+  if (result.timedOut) return "TIMEOUT";
+  const value = `${result.stderr}
+${result.stdout}`;
+  if (/eacces|eperm|access denied|permission denied/i.test(value)) return "PERMISSION";
+  if (/scope/i.test(value)) return "SCOPE";
+  if (/managed|read.only|policy/i.test(value)) return "MANAGED";
+  if (/not found|not configured|no (?:mcp )?server|does not exist/i.test(value)) return "ENTRY";
+  if (result.code === null) return "SPAWN";
+  return "OTHER";
+}
+async function reconcileMcpEntry(id, binary, launch, action, run = DEFAULT_SPAWN, cwd) {
+  const invoke = (args2) => run(binary.command, [...binary.prefixArgs, ...args2], { timeoutMs: PROCESS_TIMEOUT_MS, cwd });
+  const before = await getEntry(id, binary, (command, args2, options) => run(command, args2, { ...options, cwd }));
+  if (before.named && !before.entry) return { ok: false, state: "conflict", message: "AGENT_ENTRY_AMBIGUOUS" };
+  if (before.entry && !before.entry.knownOwner) return { ok: false, state: "conflict", message: "AGENT_ENTRY_AMBIGUOUS" };
+  if (action === "configure" && before.entry) {
+    return sameLaunch(before.entry, launch) ? { ok: true, state: "identical", message: "Already configured and verified." } : { ok: false, state: "outdated", message: "AGENT_ALREADY_CONFIGURED" };
+  }
+  if (action === "repair" && !before.entry)
+    return { ok: false, state: "failed", message: "AGENT_NOT_CONFIGURED" };
+  if (action === "repair" && before.entry && sameLaunch(before.entry, launch))
+    return { ok: true, state: "identical", message: "Already configured and verified." };
+  if (action === "remove" && !before.entry)
+    return { ok: false, state: "failed", message: "AGENT_NOT_CONFIGURED" };
+  const old = before.entry;
+  const safeRun = (command, args2, options) => run(command, args2, { ...options, cwd });
+  if (old) {
+    const removed = await invoke(cliArgs(id, "remove", void 0, old.scope));
+    if (removed.code !== 0)
+      return {
+        ok: false,
+        state: "failed",
+        message: `AGENT_REMOVE_FAILED_${safeCliFailure(removed)}`
+      };
+    const after = await getEntry(id, binary, safeRun);
+    if (after.entry || after.named) {
+      await invoke(cliArgs(id, "add", { command: old.command, args: old.argsVector, version: "legacy" }, old.scope));
+      return { ok: false, state: "failed", message: "AGENT_REMOVE_VERIFY_FAILED" };
+    }
+    if (action === "remove") return { ok: true, state: "removed", message: "Removed and verified." };
+  }
+  const added = await invoke(cliArgs(id, "add", launch));
+  if (added.code === 0 && await verifyCurrent(id, binary, launch, safeRun))
+    return { ok: true, state: old ? "updated" : "configured", message: old ? "Repaired and verified." : "Configured and verified." };
+  if (old) {
+    const maybe = await getEntry(id, binary, safeRun);
+    if (maybe.entry?.knownOwner) await invoke(cliArgs(id, "remove", void 0, maybe.entry.scope));
+    await invoke(cliArgs(id, "add", { command: old.command, args: old.argsVector, version: "legacy" }, old.scope));
   }
-  if (!existing.relatedToGazeSight)
-    return {
-      ok: false,
-      state: "conflict",
-      message: `Refusing to overwrite an unrelated MCP entry named gazesight. Existing: ${display(existing)}`
-    };
-  if (!existing.args && allowUpdate)
-    return {
-      ok: false,
-      state: "conflict",
-      message: `Refusing an update because the existing GazeSight arguments cannot be reconstructed safely for rollback. Existing: ${display(existing)}`
-    };
-  if (configurationsMatch(existing, proposed))
-    return { ok: true, state: "identical", message: "Already configured (identical; unchanged)." };
-  const comparison = `Configuration differs.
-  Existing: ${display(existing)}
-  Proposed: ${display(proposed)}`;
-  if (!allowUpdate)
-    return {
-      ok: false,
-      state: "outdated",
-      message: `${comparison}
-  Re-run setup with --update to replace only this GazeSight entry while preserving its ${existing.scope} scope.`
-    };
-  const removeArgs = [
-    "mcp",
-    "remove",
-    "gazesight",
-    ...agent === "claude" ? ["--scope", existing.scope] : []
-  ];
-  const remove = spawn(binaryPath, removeArgs);
-  if (remove.status !== 0)
-    return { ok: false, state: "failed", message: `${comparison}
-  Update failed before replacement: ${failure(remove)}` };
-  const addArgs = [
-    "mcp",
-    "add",
-    "gazesight",
-    ...agent === "claude" ? ["--scope", existing.scope] : [],
-    "--",
-    proposed.command,
-    ...proposed.args
-  ];
-  const add = spawn(binaryPath, addArgs);
-  if (add.status === 0)
-    return { ok: true, state: "updated", message: `${comparison}
-  Updated safely.` };
-  const restoreArgs = [
-    "mcp",
-    "add",
-    "gazesight",
-    ...agent === "claude" ? ["--scope", existing.scope] : [],
-    "--",
-    existing.command,
-    ...existing.args
-  ];
-  const restore = spawn(binaryPath, restoreArgs);
   return {
     ok: false,
     state: "failed",
-    message: restore.status === 0 ? `${comparison}
-  Replacement failed: ${failure(add)}. The previous entry was restored.` : `${comparison}
-  Replacement failed: ${failure(add)}. Automatic restoration also failed: ${failure(restore)}. Follow the displayed existing configuration to restore it manually.`
+    message: added.timedOut ? "AGENT_OPERATION_TIMEOUT" : "AGENT_CONFIGURE_VERIFY_FAILED"
+  };
+}
+
+// apps/cli/src/agent-config.ts
+import { homedir as homedir2 } from "node:os";
+function safeFailure(result) {
+  const value = result.stderr || result.stdout || "unknown error";
+  return value.trim().split(/\r?\n/)[0].slice(0, 180);
+}
+async function configureAgent(agent, binaryPath, proposed, allowUpdate, spawn) {
+  const run = async (command, args2) => {
+    if (!spawn) return runAgentCommand(command, args2);
+    const result2 = spawn(command, args2);
+    return {
+      code: result2.status,
+      stdout: result2.stdout,
+      stderr: result2.stderr,
+      timedOut: false
+    };
+  };
+  const binary = typeof binaryPath === "string" ? { command: binaryPath, prefixArgs: [], source: "cli setup" } : binaryPath;
+  const result = await reconcileMcpEntry(
+    agent,
+    binary,
+    proposed,
+    allowUpdate ? "repair" : "configure",
+    run,
+    homedir2()
+  );
+  const states = ["configured", "identical", "outdated", "updated", "conflict", "failed"];
+  const state = states.includes(result.state) ? result.state : "failed";
+  return {
+    ok: result.ok,
+    state,
+    message: result.ok ? result.message : `${result.message}${result.message.startsWith("AGENT_") ? "" : ` \u2014 ${safeFailure({ stdout: "", stderr: result.message })}`}`
   };
 }
 
@@ -1580,14 +1792,6 @@ function option(name) {
     throw new Error("Missing option value.");
   return args[i + 1];
 }
-function detectOnPath(binary) {
-  for (const directory of (process.env.PATH ?? "").split(delimiter))
-    for (const name of [binary, `${binary}.exe`, `${binary}.cmd`]) {
-      const candidate = join2(directory, name);
-      if (existsSync2(candidate)) return candidate;
-    }
-  return void 0;
-}
 async function promptClientChoice() {
   if (!process.stdin.isTTY) return ["claude", "codex"];
   const rl = createInterface2({ input: process.stdin, output: process.stdout });
@@ -1671,17 +1875,19 @@ Agent guidance: ${config.agentGuidance.enabled ? "Enabled" : "Disabled"}${config
         args: serverArgs.slice(1),
         version: VERSION
       };
+      const available = /* @__PURE__ */ new Set();
       for (const agent of chosen) {
         const label = agent === "claude" ? "Claude Code" : "Codex";
-        const binaryPath = detectOnPath(agent);
-        if (!binaryPath) {
+        const binary = await findAgentBinary(agent, { home: process.env.USERPROFILE ?? process.env.HOME, env: process.env });
+        if (!binary.candidate) {
           console.log(`${label}: not detected on PATH \u2014 configure manually below.`);
           continue;
         }
-        const result2 = configureAgent(agent, binaryPath, proposed, args.includes("--update"));
+        available.add(agent);
+        const result2 = await configureAgent(agent, binary.candidate, proposed, args.includes("--update"));
         console.log(`${label}: ${result2.ok ? "PASS" : "FAIL"} \u2014 ${result2.message}`);
       }
-      const undetected = explicit ? chosen.filter((agent) => !detectOnPath(agent)) : ["claude", "codex"];
+      const undetected = explicit ? chosen.filter((agent) => !available.has(agent)) : ["claude", "codex"];
       if (undetected.length) {
         const server = { command: process.execPath, args: serverArgs.slice(1) };
         if (undetected.includes("claude")) {
@@ -1701,8 +1907,8 @@ args = ${JSON.stringify(server.args)}`
       }
       console.log(
         `Open your GazeSight browser extension and click Connect to GazeSight.
-Firefox: install or update the signed extension from the official listing \u2014 https://addons.mozilla.org/addon/6a2319d4fa544731884d/ (matches gazesight@${VERSION}).
-Chrome (manual install, not yet on the Chrome Web Store): open chrome://extensions, enable Developer mode, "Load unpacked", select ${join2(root, "chrome")}.
+Firefox: install or update the signed extension from the official listing \u2014 https://addons.mozilla.org/addon/6a2319d4fa544731884d/.
+Chrome: install or update the public extension from the Chrome Web Store \u2014 https://chromewebstore.google.com/detail/gazesight/hikhblabkhbaoilcffenldphdkjdmphc.
 Development only (building from this checkout, Firefox): about:debugging > Load Temporary Add-on > ${join2(root, "firefox/manifest.json")}, or install the unsigned XPI at ${join2(root, "gazesight-firefox.xpi")}.
 Manual JSON import remains available under Advanced settings.`
       );
@@ -1724,9 +1930,19 @@ Manual JSON import remains available under Advanced settings.`
     if (args[0] === "doctor" && rows.some((row) => !row.pass))
       process.exitCode = 1;
   }
-} catch {
-  console.error(
-    "FAIL \u2014 Check the command/options, Node >=20, installed package, private configuration and port 1024\u201365535. Run gazesight --help. Secrets are redacted."
-  );
-  process.exitCode = 1;
+} catch (error) {
+  const message = error instanceof Error ? error.message : "";
+  if (args[0] === "pair" && [
+    "Pairing administration unavailable.",
+    "The pairing request expired or was already used.",
+    "The approved credential was not delivered; keep the extension open and retry pairing."
+  ].includes(message)) {
+    console.error(`Pairing failed \u2014 ${message}`);
+    process.exitCode = 1;
+  } else {
+    console.error(
+      "FAIL \u2014 Check the command/options, Node >=20, installed package, private configuration and port 1024\u201365535. Run gazesight --help. Secrets are redacted."
+    );
+    process.exitCode = 1;
+  }
 }