Native proxy — what the decisions look like

Engineering read of D1–D9, before the pictures. Five decisions I'd take as written, two that need an amendment, and one new risk the plan doesn't name yet.

Why this section exists. The first draft of this page drew the pane's top half in detail and collapsed the register into a one-line stub. That made it read as though the plan replaced the register. It doesn't, and it mustn't: the register and the antenna are the only places a researcher sees what agents can reach, and they took most of August to get right. Every Settings frame now carries the real register, in whichever state fits the story: typical, never asked, just asked, all closed, a receipt, empty.

What's wrong with these today. Claude: on macOS 27 a fresh install fails its first question by design, and the user fixes it in System Settings. ChatGPT: the pasted config carries a port and a token that change on every relaunch, so the user re-copies after every restart. The one-click ChatGPT plugin is ready, but it needs Node.

Consequences the pictures show.

• 2.1 and 2.2 both say Install, even just after a successful install. That's today's rule on the Claude tab (.unknown and .matching map to Install) and D8 keeps it: we never say "Installed", because we can't see ChatGPT. The "it worked" signals are the shipped ones, and they arrive with the first question: the sidebar antenna radiates, the register's Last asked turns to Just now, and the row's subtitle says an agent asked recently (2.2). Benchmarked in section 8.
• 2.3 depends on the plugin version. The version carries the build number, so ChatGPT caches the new copy under a new folder. Whether ChatGPT then offers "Update" by itself, or needs uninstall-then-install, is P0.5 (section 5).
• 2.4 and 2.5 reuse the Claude tab's Link-instead-of-button pattern, so a dead button never produces the system's "no application" dialog. 2.5 can only be detected as "the app is there but no codex:// handler is registered". A ChatGPT that has the handler but ignores marketplacePath isn't detectable (F23), so a minimum version check goes on top.
• 2.6 is .dmg-only. The button is disabled rather than hidden, so the reason sits next to the thing it blocks. The copy deliberately doesn't say "translocation".
• 2.7: the TOML route survives for Codex CLI and IDE users. It is the one path that still re-copies after every restart, and the copy says so.

New strings (would go into 21 locales): chatgptHint, installPlugin / reinstallPlugin / updatePlugin, pluginBuild, downloadChatGPT, updateChatGPT, moveToApplications, connectByHand, and a shorter chatgptCodexHow for the TOML route. The ellipsis stays on "Install Plugin…" because the command finishes in another app (F9).

• Everything below the row goes. The Files & Folders note, its button, and the macOS 26 "access data from other apps" note all disappear. The helper reads the team group, and that read passes no TCC check on any version. The Files & Folders copy (21 locales) becomes recovery-only: it's reachable from the help page and from the Node sentence, for anyone still running the old extension.
• The right-hand frame is macOS 26 with a grant: the old Node proxy reaches serve, so the ladder can say "older". On macOS 27 the same user sees the left-hand frame, because their old proxy is denied before it ever calls us, so we never learn its version. Both offer the right button. Only one explains why.
• The tab gets shorter, about 60pt, and the window follows (fittingSize). The ChatGPT tab gets a little longer. Tab switches already refit, so neither is new behaviour.

Measured vs inferred. The link, the plugin page, "Install plugin", the toast and "Try now" were all measured on 29 Sep with the spike, and so were Work mode and the per-tool approvals. What isn't measured: whether readOnlyHint removes the approval cards (work-list item 14, "not yet re-measured"), and the page's exact version label. Net: the ChatGPT path goes from 5+ steps with a hand-edited file and a re-copy after every relaunch, to 3 clicks. The Claude path on macOS 27 goes from 6 steps with a detour through System Settings to 3 clicks. Agent Access (step 1) is the same on both, and deliberately so.

• Claude, measured: a higher manifest version shows Update and replaces the installed copy in place (v0.0.1 → v0.0.2, no uninstall). The same version only offers Uninstall, which Reinstall never hits, because the ladder offers it only when the versions differ.
• ChatGPT, measured: the page shows the new version number but offers only Try now; ⋯ holds a single item, Uninstall (no confirmation), and Install plugin then copies the new version. That is two extra clicks on the page our link already opens, so the fix is one sentence in the foot line (2.3), not a new control.
• Most updates never reach this screen. An older helper keeps working as long as the MCP contract still matches (mcp.contract). The "outdated" sentence (section 6) only fires when it doesn't. So outcome B costs a detour only in a release that breaks the contract. The pane's "Update" is advice, not an alarm.
• The version stamp (D8) is what makes outcome A possible at all. Without the build number in it, ChatGPT would treat a new build as the version it already cached.
• If P0.5 comes back as B, the fix belongs in the foot line (one extra sentence under the row, only in the .olderRelease state), not in a new control.

• The bubbles are the model paraphrasing our sentence, as it does. The wording we control is the proxy's MSG_* table, which tells the model to "tell the person…". Claude and ChatGPT both relayed it faithfully in the 29 Sep runs.
• The native "can't reach" sentence is the weakest one here. It stands in for three build defects (missing group, group never written, network entitlement denied), and D3 is meant to make all three unshippable. So in practice it should only fire for a broken install, where "install again" is the right advice. D5 accepts that.
• The Files & Folders sentence stays in the Node proxy, for users who never reinstall. It retires with the Node extension.

The cost of no flag is that the first time anyone except the maintainer sees the native path is the release itself. D9's external TestFlight is the mitigation: it puts a human reviewer and any external tester on the build before the store does. The benefit is that no user ever sees a half-state (a native Claude tab next to a TOML ChatGPT tab, say), and there is no Diagnostics toggle to explain.

The antenna already answers "is it working?" (right-hand frame, drawn loosely: the real one is the SF Symbol antenna.radiowaves.left.and.right, animated through its three variable-value frames). It is solid for an exposed project, radiates while an agent reads it, and taps twice when the agent has finished. That beats Xcode's alert on two counts: it's per project, and it says when the agent has finished. Nothing in this plan should duplicate it, so the "is asking now" subtitle I first drew here is withdrawn.

What's left is narrow. The antenna can't show "connected" before the first question or which host asked, and the install row still says Install after a successful install. Two small changes close it, both facts about our own endpoint, not about the client:

• At MCP initialize, the helper checks in once (/api/health, carrying its host label and build). The row can then say "ChatGPT connected today at 14:02" the moment "Try now" opens a thread. The helper writes nothing, so this isn't D5's rejected breadcrumb.
• Serve keeps the last check-in per host (D8 already keys by host). After that, .matching becomes a bordered "Reinstall Plugin…", and at rest the pane has no filled button.

Worth it? It's optional. For a researcher, the first question plus the antenna already proves it works. The check-in mostly fixes the Settings row, which would otherwise read as if the install hadn't taken.

The other shortfalls, and what I'd do. ChatGPT Work vs Chat in the docs: when the help page (work-list item 2) ships, give it ACE's treatment, with a screenshot of the Chat | Work toggle and one sentence on why Chat can't reach a local app. Per-item exclusion (DEVONthink): this is a product question, not part of this plan. A per-session "exclude from agents" would be the Bristlenose version. Park it.