tray: no way to point a dev/QA instance at an alternate root — every test run mutates real ~/.mcpproxy state

[Dumbris]

Dev-ergonomics issue, not a user-facing bug. Surfaced repeatedly while doing live QA of #927 and #930, where it forced awkward workarounds and caused one accidental mutation of real user state.

The problem

The tray resolves its paths via homeDirectoryForCurrentUser, which ignores $HOME. So a tray built from a branch and run out of a /tmp bundle copy still reads and writes the real ~/.mcpproxy. There is no instance-root override.

Two concrete consequences observed:

1. The socket path is fixed. ~/.mcpproxy/mcpproxy.sock is the only path a dev tray will use, so an isolated core must be started with --tray-endpoint unix:///Users/<user>/.mcpproxy/mcpproxy.sock to be found at all. It also makes the socket a machine-wide exclusive resource: two QA runs cannot proceed in parallel, and one will silently attach to the other's core and produce garbage results. That happened during this batch and had to be resolved by explicit sequencing.

2. The autostart sidecar silently overwrites real user state. AutostartSidecarService.refresh() reads AutoStartService.isEnabled (the running bundle's SMAppService login-item state) and writes it to ~/.mcpproxy/tray-autostart.json on every app launch. A copied bundle under /tmp is not a registered login item, so it writes {"enabled":false} straight over the user's {"enabled":true}. Observed and restored by hand during QA; the value was wrong for about seven minutes. Impact while wrong is limited to the core's telemetry autostart reporting — the actual login-item registration is only ever read, never changed — but the write is silent and unexpected.

For a normal user with a single installed app, both behaviours are correct. The gap is that there is no supported way to run a second instance.

Suggested direction

#926 already made socketPath injectable for tests. Extending that to the sidecar path would fix the immediate hazard, but the cleaner fix is a single instance-root override — an env var (e.g. MCPPROXY_HOME) or launch argument that relocates the socket, the sidecar file, and anything else resolved under ~/.mcpproxy in one move.

That would make tray QA safe by construction rather than by discipline, and would let independent tray runs proceed in parallel instead of being serialized on a hardcoded path.

[Dumbris]

Partial workaround found: CFFIXED_USER_HOME does work

While QA-ing #930 a second tray instance was successfully isolated without patching source, which narrows this issue usefully.

CFFIXED_USER_HOME is honoured even though $HOME is not. homeDirectoryForCurrentUser ignores $HOME, but Core Foundation respects CFFIXED_USER_HOME, so:

CFFIXED_USER_HOME=/tmp/qa930home
# + a distinct bundle id, e.g. com.smartmcpproxy.mcpproxy.qa930
# + --tray-endpoint unix:///tmp/qa930home/.mcpproxy/mcpproxy.sock

relocated the socket and the autostart sidecar. Confirmed in practice: the tray wrote its tray-autostart.json into /tmp/qa930home/.mcpproxy/, lsof showed only that instance's core on the scratch socket, and the run never touched the real ~/.mcpproxy — while two other agents' trays and cores ran concurrently and untouched. So two independent tray instances can coexist today, which the original report assumed impossible.

Three caveats that keep this a workaround rather than a fix:

1. cfprefsd ignores it. defaults write still lands in the real home — the run had to delete ~/Library/Preferences/com.smartmcpproxy.mcpproxy.<id>.plist afterwards by hand.
2. Socket path length. sockaddr_un caps the path at ~104 bytes, so a deep scratch directory silently fails to bind. /tmp/<short> works; a nested scratchpad path does not.
3. First-run gate. A fresh home triggers the "Welcome to MCPProxy" window, which blocks the tray in Idle until dismissed. It was bypassed with defaults write MCPProxy.firstRunCompleted — worth noting that its "Launch at login" checkbox is pre-checked, so clicking through it in a dev instance would register a real login item.

A first-class instance-root override would still be the right fix — it would cover the preferences domain, validate the socket-path length, and skip the first-run gate for non-default roots. But this unblocks parallel tray QA in the meantime.