vexp-cli 2.1.0 → 2.1.1

package/dist/autostart.js

@@ -311,60 +311,6 @@ export function uninstallAutostart() {
     }
     catch { /* absent */ }
 }
-/**
- * Idempotent install guard used by `vexp` preAction / REPL / plugin activate.
- *
- * First invocation after an upgrade installs autostart + writes a marker.
- * Subsequent invocations (including `vexp setup`, any subcommand, multiple
- * VS Code windows) short-circuit on the marker → zero extra work, zero
- * process duplication.
- *
- * Respects `VEXP_NO_AUTOSTART_INSTALL=1` as opt-out.
- */
-export function installAutostartIfNeeded() {
-    if (process.env.VEXP_NO_AUTOSTART_INSTALL === "1")
-        return;
-    // 2.0.12 shipped a broken Windows VBS template; rewrite any existing
-    // file matching that signature regardless of marker state, so upgraded
-    // users get fixed without manual autostart uninstall/install.
-    if (process.platform === "win32") {
-        try {
-            const p = windowsStartupPath();
-            if (fs.existsSync(p)) {
-                const existing = fs.readFileSync(p, "utf-8");
-                if (/sh\.Run\s+"cmd \/c "\s*&/.test(existing)) {
-                    installWindowsStartup();
-                }
-            }
-        }
-        catch { /* non-fatal */ }
-    }
-    const marker = installMarkerPath();
-    if (fs.existsSync(marker))
-        return;
-    // Previous install by a different path (e.g. user ran older `vexp setup`
-    // that called installAutostart directly). Record the marker so we don't
-    // probe the filesystem again on every invocation.
-    if (autostartStatus().installed) {
-        try {
-            fs.mkdirSync(path.dirname(marker), { recursive: true });
-            fs.writeFileSync(marker, new Date().toISOString());
-        }
-        catch { /* non-fatal */ }
-        return;
-    }
-    try {
-        const r = installAutostart();
-        if (r.installed) {
-            try {
-                fs.mkdirSync(path.dirname(marker), { recursive: true });
-                fs.writeFileSync(marker, new Date().toISOString());
-            }
-            catch { /* non-fatal */ }
-        }
-    }
-    catch { /* non-fatal — opt-in best effort */ }
-}
 const CLAUDE_UNPIN_MARKER_FILE = "claude-unpin-migrated";
 function claudeUnpinMarkerPath() {
     return path.join(homedir(), ".vexp", CLAUDE_UNPIN_MARKER_FILE);

package/dist/cli.js

@@ -6,14 +6,14 @@ import { spawn, spawnSync, execFileSync } from "child_process";
 import * as path from "path";
 import * as fs from "fs";
 import * as net from "net";
-import { checkbox } from "@inquirer/prompts";
+import { checkbox, confirm } from "@inquirer/prompts";
 import { getBinaryPath, getInstalledVersion, getMcpServerPath, binaryEnv } from "./binary.js";
 import { detectAgents, getAgentList, configureSelectedAgents } from "./agent-config.js";
 import { CLI_VERSION } from "./version.js";
 import { activateLicense, deactivateLicense, readLicenseLimits, readDeviceBlocked, } from "./license.js";
 import { checkForUpdate } from "./update-check.js";
 import { ensureMcpHttpServer, mcpHttpStatus } from "./mcp-supervisor.js";
-import { installAutostart, installAutostartIfNeeded, uninstallAutostart, autostartStatus, migrateClaudeUnpinIfNeeded } from "./autostart.js";
+import { installAutostart, uninstallAutostart, autostartStatus, migrateClaudeUnpinIfNeeded } from "./autostart.js";
 import { runServe } from "./serve.js";
 import { runDoctor } from "./doctor.js";
 import { isTraceEnabled } from "./trace.js";
@@ -218,11 +218,17 @@ async function ensureDaemonRunning(workspaceRoot, binaryPath) {
  * REPL, setup) can never spawn duplicates:
  *   - `ensureDaemonRunning`   → socket probe, skips spawn if alive
  *   - `ensureMcpHttpServer`   → ~/.vexp/mcp.pid + port probe, no-op if live
- *   - `installAutostartIfNeeded` → marker ~/.vexp/autostart-installed
  *
  * The point of this wrapper is to ensure users who upgraded via
  * `npm update` and then just typed `vexp` (never re-running `setup`) still
- * get: daemon up, MCP :7821 up, OS autostart installed for future reboots.
+ * get the daemon up and MCP :7821 up for this session. The daemon cold-starts
+ * lazily on the first invocation, so no OS-level login persistence is needed
+ * for interactive use.
+ *
+ * OS login autostart is NOT installed here — it is strictly opt-in via
+ * `vexp autostart install` or the setup wizard prompt, so vexp never writes
+ * LaunchAgent/systemd/Startup-folder persistence behind the user's back
+ * (which security tooling flags as a persistence anomaly).
  *
  * Honors VEXP_NO_AUTOSTART=1 as a global bypass.
  */
@@ -234,10 +240,6 @@ async function ensureBootstrap(workspaceRoot, binaryPath) {
         await ensureMcpHttpServer({ owner: "cli" });
     }
     catch { /* non-fatal */ }
-    try {
-        installAutostartIfNeeded();
-    }
-    catch { /* non-fatal */ }
 }
 /**
  * Start the vexp daemon and MCP HTTP server in the background.
@@ -625,20 +627,40 @@ program
             }
         }
     }
-    // Step 5: Install login autostart (per-user, no admin required)
-    if (process.env.VEXP_NO_AUTOSTART_INSTALL !== "1") {
-        const spinnerAuto = ora("Installing login autostart...").start();
-        try {
-            const r = installAutostart();
-            if (r.installed) {
-                spinnerAuto.succeed(`Login autostart installed (${r.mechanism})`);
+    // Step 5: Optionally install login autostart (per-user, no admin required).
+    // Opt-in only — writing OS persistence (LaunchAgent / systemd / Startup
+    // folder) without asking is flagged as an anomaly by security tooling, and
+    // the daemon already cold-starts on the first `vexp` invocation, so this is
+    // purely a convenience for post-reboot warm-up. Skip entirely when the user
+    // opted out via env or when stdin is not a TTY (non-interactive install).
+    if (process.env.VEXP_NO_AUTOSTART_INSTALL === "1") {
+        // Explicit opt-out — do nothing.
+    }
+    else if (!process.stdin.isTTY) {
+        console.log(chalk.dim("  Skipping login autostart (non-interactive). Run 'vexp autostart install' to enable."));
+    }
+    else {
+        const wantAutostart = await confirm({
+            message: "Start the vexp daemon automatically at login? (optional — it also starts on demand)",
+            default: false,
+        });
+        if (wantAutostart) {
+            const spinnerAuto = ora("Installing login autostart...").start();
+            try {
+                const r = installAutostart();
+                if (r.installed) {
+                    spinnerAuto.succeed(`Login autostart installed (${r.mechanism})`);
+                }
+                else {
+                    spinnerAuto.warn("Autostart not installed on this platform");
+                }
             }
-            else {
-                spinnerAuto.warn("Autostart not installed on this platform");
+            catch (err) {
+                spinnerAuto.warn(`Autostart install failed: ${err instanceof Error ? err.message : err}`);
             }
         }
-        catch (err) {
-            spinnerAuto.warn(`Autostart install failed: ${err instanceof Error ? err.message : err}`);
+        else {
+            console.log(chalk.dim("  Login autostart skipped. Enable later with 'vexp autostart install'."));
         }
     }
     // Final summary
@@ -782,14 +804,30 @@ async function runSetupInteractive(rl) {
         }
         console.log(chalk.green(`\n  ✓ Setup complete — ${result.agents.length} agent(s) configured\n`));
     }
-    // Login autostart — opt-out via env
-    if (process.env.VEXP_NO_AUTOSTART_INSTALL !== "1") {
-        try {
-            const r = installAutostart();
-            if (r.installed)
-                console.log(chalk.green(`  ✓ Login autostart installed (${r.mechanism})`));
+    // Login autostart — opt-in only. The daemon already cold-starts on demand,
+    // so OS login persistence is a convenience the user must explicitly request;
+    // installing it silently is flagged as a persistence anomaly by security
+    // tooling. Env opt-out and non-TTY both skip the prompt without installing.
+    if (process.env.VEXP_NO_AUTOSTART_INSTALL === "1" || !process.stdin.isTTY) {
+        // Opted out or non-interactive — leave autostart uninstalled.
+    }
+    else {
+        rl.resume();
+        const answer = (await ask(rl, "\n  Start the vexp daemon automatically at login? (optional — starts on demand too) [y/N]: ")).trim().toLowerCase();
+        rl.pause();
+        if (answer === "y" || answer === "yes") {
+            try {
+                const r = installAutostart();
+                if (r.installed)
+                    console.log(chalk.green(`  ✓ Login autostart installed (${r.mechanism})`));
+                else
+                    console.log(chalk.yellow("  ⚠ Autostart not installed on this platform"));
+            }
+            catch { /* non-fatal */ }
+        }
+        else {
+            console.log(chalk.dim("  Login autostart skipped. Enable later with 'vexp autostart install'."));
         }
-        catch { /* non-fatal */ }
     }
 }
 // ────────────────────────────────────────────────────

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vexp-cli",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "description": "Vexp — Context Engine for AI Coding Agents. Pre-indexes your codebase into a dependency graph and delivers ranked context to any MCP-compatible agent. 58% lower cost per task, 90% fewer tool calls (SWE-bench Verified). Works with Claude Code, Cursor, Copilot, Windsurf, Codex, Cline, Aider, and 12+ agents. Local-first. Your code never leaves your machine.",
   "type": "module",
   "bin": {
@@ -100,10 +100,10 @@
     "node": ">=20.0.0"
   },
   "optionalDependencies": {
-    "@vexp/core-linux-x64": "2.1.0",
-    "@vexp/core-linux-arm64": "2.1.0",
-    "@vexp/core-darwin-x64": "2.1.0",
-    "@vexp/core-darwin-arm64": "2.1.0",
-    "@vexp/core-win32-x64": "2.1.0"
+    "@vexp/core-linux-x64": "2.1.1",
+    "@vexp/core-linux-arm64": "2.1.1",
+    "@vexp/core-darwin-x64": "2.1.1",
+    "@vexp/core-darwin-arm64": "2.1.1",
+    "@vexp/core-win32-x64": "2.1.1"
   }
 }