@tianshu-ai/local-bridge 0.4.1 → 0.6.0

package/README.md

@@ -38,6 +38,25 @@ npx @tianshu-ai/local-bridge --server wss://your-tianshu.example.com/ws --token
 The **Local Bridge** panel in tianshu shows a ready-to-copy command with
 your server URL + token filled in.
 
+### macOS menu-bar app
+
+Prefer a UI? Build a tiny native menu-bar app (no Electron) that wraps
+the CLI — a menu-bar icon with Start/Stop + Settings (server / token /
+browser engine / headless):
+
+```bash
+npm i -g @tianshu-ai/local-bridge
+tsbridge install-app --run
+```
+
+That installs `Tianshu Bridge.app` to `~/Applications` (menu-bar only, no
+Dock icon) and launches it. Click the bolt icon → Settings to configure,
+then Start. Requires Xcode command line tools (`xcode-select --install`)
+for the one-time `swiftc` build. First launch: right-click → Open
+(unsigned local build).
+
+(`app/install-app.sh` is also available for a clone-based build.)
+
 For a local dev server with auth off, the token is optional:
 
 ```bash
@@ -49,11 +68,15 @@ tsbridge --server ws://localhost:3110/ws
 ### Keeping it updated
 
 ```bash
-tsbridge update         # check npm for a newer version
-tsbridge update --yes   # check and self-update (npm i -g …@latest)
-tsbridge version        # print the installed version
+tsbridge update            # update to the latest version if newer (default)
+tsbridge update --check    # just check; exit 1 if an update is available
+tsbridge update --dry-run  # print the npm command without running it
+tsbridge update --tag next # target a non-`latest` dist-tag
+tsbridge version           # print the installed version
 ```
 
+(Same semantics as `tianshu update`.)
+
 ### Flags
 
 | flag | meaning |
@@ -63,6 +86,8 @@ tsbridge version        # print the installed version
 | `--device <id>` | stable device id (default: hostname) |
 | `--label <name>` | human label shown in the panel |
 | `--no-browser` | don't expose browser tools |
+| `--no-shell` | don't expose the shell exec + file sync tools |
+| `--shell-root <dir>` | fixed root dir that jails `exec` + `sync_up`/`sync_down` (default: `~/.tianshu_shell`) |
 | `--headless` | run the browser without a window (default: headful) |
 | `--cdp <url>` | connect to an already-running Chrome's CDP endpoint (default probe `http://127.0.0.1:9222`; `off` to skip) |
 | `--chrome-channel <ch>` | which installed browser to launch: `chrome` (default), `msedge`, … |
@@ -85,11 +110,50 @@ To expose your everyday browser, start Chrome with a debugging port:
 
 ## Tools
 
-- `browser_navigate` / `browser_get_text` / `browser_click` /
-  `browser_screenshot` — drive your real local Chrome (via CDP connect
-  or system-Chrome launch; automation-detection softened).
-- With `--browser-engine stealth`, the full Playwright-MCP toolset
-  (snapshot / fill_form / evaluate / tabs / …) pointed at CloakBrowser.
+Both engines expose the **full Playwright-MCP toolset** (navigate,
+snapshot, click, type, fill_form, evaluate, tabs, screenshot, …). Only
+the underlying browser differs:
+
+- **own** — `@playwright/mcp` pointed at *your* Chrome: connects over CDP
+  to a Chrome already running with `--remote-debugging-port`, else
+  launches your system Chrome (`--browser chrome`). Real cookies +
+  fingerprint, no Chromium download.
+- **stealth** — `cloakbrowser-mcp`: the same toolset on CloakBrowser
+  stealth Chromium (source-level anti-bot-detection patches).
+
+### Shell + file sync
+
+Unless `--no-shell` is passed, the bridge also exposes three **native**
+tools that run directly on your machine. Their names, parameters and
+result shapes mirror tianshu's server-side `openshell` plugin, so an
+agent written against openshell works unchanged against a bridge device.
+
+**All three are jailed to a single fixed root directory**
+(`~/.tianshu_shell` by default, override with `--shell-root`). `exec`'s
+cwd + `workdir`, `sync_up`'s read base, and `sync_down`'s write dest all
+resolve *inside* that root; any path that escapes it is rejected.
+
+- **`exec`** — run a shell command via `bash -c`, cwd inside the root.
+  Params: `command`, optional `workdir` (relative to the root, defaults
+  to the root itself), optional `timeout_ms` (default 300s, cap 1800s).
+  Output is truncated at 200 lines / 8000 bytes per stream. Returns
+  `{ ok, exit_code, stdout, stderr, truncated, duration_ms, timed_out }`.
+- **`sync_up`** — read files/dirs under the root and return their bytes
+  (base64) *up* to the agent. Params: `paths[]` (relative to the root,
+  directories walked recursively). Per-file cap 8 MiB, ≤500 files/call.
+- **`sync_down`** — receive files (base64) from the agent and write them
+  *down* under the root. Params: `files: [{ path, base64 }]`. Parent
+  dirs are created; existing files overwritten.
+
+Transport is base64-in-args over the existing reverse-MCP `tools/call`
+channel — no protocol changes.
+
+> **Security:** `exec` runs commands with your user's permissions, but
+> is confined to the `--shell-root` directory (default `~/.tianshu_shell`)
+> — the agent can't `cd` or read/write outside it via these tools. It is
+> not a kernel sandbox (a determined command could still reach the wider
+> fs), so only connect a bridge to a tianshu server you trust; pass
+> `--no-shell` to expose the browser only.
 
 ## Protocol
 

package/app/TianshuBridge.swift

@@ -0,0 +1,311 @@
+// Tianshu Local Bridge — macOS menu-bar app.
+//
+// A thin GUI wrapper around the `tsbridge` CLI: lives only in the menu
+// bar (LSUIElement), lets you set the server URL / token / browser
+// engine / headless, and Start/Stop the bridge. It spawns `tsbridge`
+// with the chosen flags and shows connection status. Config persists to
+// ~/.tianshu-bridge/config.json.
+//
+// Built on demand by install-app.sh via `swiftc` — no external deps.
+
+import AppKit
+import Foundation
+
+// ─── config ─────────────────────────────────────────────────────────
+
+struct Config: Codable {
+    var server: String = "ws://localhost:3110/ws"
+    var token: String = ""
+    var engine: String = "own"        // "own" | "stealth"
+    var headless: Bool = false
+    var device: String = ""            // empty → hostname
+
+    static var path: URL {
+        let dir = FileManager.default.homeDirectoryForCurrentUser
+            .appendingPathComponent(".tianshu-bridge", isDirectory: true)
+        try? FileManager.default.createDirectory(at: dir, withIntermediateDirectories: true)
+        return dir.appendingPathComponent("config.json")
+    }
+
+    static func load() -> Config {
+        guard let data = try? Data(contentsOf: path),
+              let cfg = try? JSONDecoder().decode(Config.self, from: data) else {
+            return Config()
+        }
+        return cfg
+    }
+
+    func save() {
+        if let data = try? JSONEncoder().encode(self) {
+            try? data.write(to: Config.path)
+        }
+    }
+}
+
+// ─── locating tsbridge / node ────────────────────────────────────────
+
+// GUI apps don't inherit the shell PATH, and tsbridge often lives under
+// a Node version manager (nvm/fnm). Resolve a usable command + PATH.
+func resolveTsbridge() -> (cmd: String, env: [String: String])? {
+    let fm = FileManager.default
+    let home = fm.homeDirectoryForCurrentUser.path
+    var candidates: [String] = [
+        "/usr/local/bin/tsbridge",
+        "/opt/homebrew/bin/tsbridge",
+    ]
+    // nvm: newest version dir that has tsbridge
+    let nvm = "\(home)/.nvm/versions/node"
+    if let vers = try? fm.contentsOfDirectory(atPath: nvm) {
+        for v in vers.sorted(by: >) {
+            candidates.append("\(nvm)/\(v)/bin/tsbridge")
+        }
+    }
+    for c in candidates where fm.isExecutableFile(atPath: c) {
+        // Prepend the bin dir to PATH so the spawned tsbridge finds
+        // `node` and `npx` (needed for @playwright/mcp / cloakbrowser).
+        let bin = (c as NSString).deletingLastPathComponent
+        var env = ProcessInfo.processInfo.environment
+        env["PATH"] = "\(bin):/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin"
+        // GUI-launched processes can start with an empty/missing HOME;
+        // @playwright/mcp & cloakbrowser use it for their output dir
+        // (else they try to mkdir /.playwright-mcp and crash). Force it.
+        if (env["HOME"] ?? "").isEmpty { env["HOME"] = NSHomeDirectory() }
+        return (c, env)
+    }
+    return nil
+}
+
+// ─── the bridge process ──────────────────────────────────────────────
+
+final class Bridge {
+    private var proc: Process?
+    var isRunning: Bool { proc?.isRunning ?? false }
+    var onStateChange: (() -> Void)?
+
+    func start(_ cfg: Config) {
+        stop()
+        guard let (cmd, env) = resolveTsbridge() else {
+            notify("tsbridge not found", "Install it: npm i -g @tianshu-ai/local-bridge")
+            return
+        }
+        var args = ["--server", cfg.server]
+        if !cfg.token.isEmpty { args += ["--token", cfg.token] }
+        if cfg.engine == "stealth" { args += ["--browser-engine", "stealth"] }
+        if cfg.headless { args += ["--headless"] }
+        if !cfg.device.isEmpty { args += ["--device", cfg.device] }
+
+        let p = Process()
+        p.executableURL = URL(fileURLWithPath: cmd)
+        p.arguments = args
+        p.environment = env
+        // Log to ~/.tianshu-bridge/bridge.log for troubleshooting.
+        let logURL = Config.path.deletingLastPathComponent().appendingPathComponent("bridge.log")
+        FileManager.default.createFile(atPath: logURL.path, contents: nil)
+        if let fh = try? FileHandle(forWritingTo: logURL) {
+            p.standardOutput = fh
+            p.standardError = fh
+        }
+        p.terminationHandler = { [weak self] _ in
+            DispatchQueue.main.async { self?.onStateChange?() }
+        }
+        do {
+            try p.run()
+            proc = p
+        } catch {
+            notify("Failed to start bridge", error.localizedDescription)
+        }
+        onStateChange?()
+    }
+
+    func stop() {
+        if let p = proc, p.isRunning { p.terminate() }
+        proc = nil
+    }
+
+    private func notify(_ title: String, _ body: String) {
+        let a = NSAlert()
+        a.messageText = title
+        a.informativeText = body
+        a.runModal()
+    }
+}
+
+// ─── menu-bar controller ─────────────────────────────────────────────
+
+final class AppController: NSObject, NSApplicationDelegate {
+    // Created in applicationDidFinishLaunching (not at init) so the app
+    // is fully up before we claim a status-bar slot.
+    var statusItem: NSStatusItem!
+    let bridge = Bridge()
+    var cfg = Config.load()
+    var configWindow: NSWindow?
+
+    func applicationDidFinishLaunching(_ notification: Notification) {
+        statusItem = NSStatusBar.system.statusItem(withLength: NSStatusItem.variableLength)
+        updateIcon()
+        bridge.onStateChange = { [weak self] in
+            self?.updateIcon()
+            self?.rebuildMenu()
+        }
+        rebuildMenu()
+    }
+
+    func updateIcon() {
+        guard let btn = statusItem.button else { return }
+        let on = bridge.isRunning
+        let name = on ? "bolt.horizontal.circle.fill" : "bolt.horizontal.circle"
+        if let img = NSImage(systemSymbolName: name, accessibilityDescription: "Tianshu Bridge") {
+            img.isTemplate = true
+            btn.image = img
+            btn.title = ""
+        } else {
+            // SF Symbol unavailable → always-visible text fallback.
+            btn.image = nil
+            btn.title = on ? "⚡●" : "⚡"
+        }
+        btn.toolTip = on ? "Tianshu Bridge: connected" : "Tianshu Bridge: stopped"
+    }
+
+    func rebuildMenu() {
+        let menu = NSMenu()
+        let status = bridge.isRunning ? "● Connected" : "○ Stopped"
+        let statusMI = NSMenuItem(title: status, action: nil, keyEquivalent: "")
+        statusMI.isEnabled = false
+        menu.addItem(statusMI)
+        menu.addItem(NSMenuItem(title: "Server: \(cfg.server)", action: nil, keyEquivalent: ""))
+        let eng = cfg.engine == "stealth" ? "stealth" : "own"
+        menu.addItem(NSMenuItem(title: "Browser: \(eng)\(cfg.headless ? " (headless)" : "")",
+                                action: nil, keyEquivalent: ""))
+        menu.addItem(.separator())
+
+        if bridge.isRunning {
+            menu.addItem(withTitle: "Stop", action: #selector(stop), keyEquivalent: "s").target = self
+        } else {
+            menu.addItem(withTitle: "Start", action: #selector(start), keyEquivalent: "s").target = self
+        }
+        menu.addItem(withTitle: "Settings…", action: #selector(openSettings), keyEquivalent: ",").target = self
+        menu.addItem(withTitle: "Open Log", action: #selector(openLog), keyEquivalent: "").target = self
+        menu.addItem(.separator())
+        menu.addItem(withTitle: "Quit", action: #selector(quit), keyEquivalent: "q").target = self
+        statusItem.menu = menu
+    }
+
+    @objc func start() { bridge.start(cfg) }
+    @objc func stop() { bridge.stop(); updateIcon(); rebuildMenu() }
+    @objc func openLog() {
+        let log = Config.path.deletingLastPathComponent().appendingPathComponent("bridge.log")
+        NSWorkspace.shared.open(log)
+    }
+    @objc func quit() { bridge.stop(); NSApp.terminate(nil) }
+
+    // ── settings window (simple form) ──
+    @objc func openSettings() {
+        if configWindow == nil {
+            let w = NSWindow(contentRect: NSRect(x: 0, y: 0, width: 380, height: 300),
+                             styleMask: [.titled, .closable], backing: .buffered, defer: false)
+            w.title = "Tianshu Bridge Settings"
+            w.center()
+            w.contentView = makeSettingsView()
+            w.isReleasedWhenClosed = false
+            configWindow = w
+        }
+        NSApp.activate(ignoringOtherApps: true)
+        configWindow?.makeKeyAndOrderFront(nil)
+    }
+
+    private var serverField: NSTextField!
+    private var tokenField: NSTextField!
+    private var enginePopup: NSPopUpButton!
+    private var headlessCheck: NSButton!
+
+    private func makeSettingsView() -> NSView {
+        let v = NSView(frame: NSRect(x: 0, y: 0, width: 380, height: 300))
+        func label(_ s: String, _ y: CGFloat) -> NSTextField {
+            let l = NSTextField(labelWithString: s); l.frame = NSRect(x: 16, y: y, width: 90, height: 20); return l
+        }
+        // Paste-config row: grab the config string copied from the
+        // tianshu Local Bridge panel and fill every field at once.
+        let paste = NSButton(title: "Paste from tianshu", target: self, action: #selector(pasteConfig))
+        paste.frame = NSRect(x: 16, y: 258, width: 200, height: 28)
+        paste.bezelStyle = .rounded
+        v.addSubview(paste)
+        let hint = NSTextField(labelWithString: "(copies server + token + browser settings)")
+        hint.frame = NSRect(x: 16, y: 238, width: 348, height: 16)
+        hint.font = NSFont.systemFont(ofSize: 10)
+        hint.textColor = .secondaryLabelColor
+        v.addSubview(hint)
+
+        v.addSubview(label("Server", 210))
+        serverField = NSTextField(frame: NSRect(x: 110, y: 208, width: 250, height: 24))
+        serverField.stringValue = cfg.server; v.addSubview(serverField)
+
+        v.addSubview(label("Token", 172))
+        tokenField = NSTextField(frame: NSRect(x: 110, y: 170, width: 250, height: 24))
+        tokenField.stringValue = cfg.token; v.addSubview(tokenField)
+
+        v.addSubview(label("Browser", 134))
+        enginePopup = NSPopUpButton(frame: NSRect(x: 110, y: 130, width: 250, height: 26))
+        enginePopup.addItems(withTitles: ["own (your Chrome)", "stealth (CloakBrowser)"])
+        enginePopup.selectItem(at: cfg.engine == "stealth" ? 1 : 0)
+        v.addSubview(enginePopup)
+
+        headlessCheck = NSButton(checkboxWithTitle: "Headless (no window)", target: nil, action: nil)
+        headlessCheck.frame = NSRect(x: 110, y: 98, width: 250, height: 20)
+        headlessCheck.state = cfg.headless ? .on : .off
+        v.addSubview(headlessCheck)
+
+        let save = NSButton(title: "Save & Restart", target: self, action: #selector(saveSettings))
+        save.frame = NSRect(x: 200, y: 20, width: 160, height: 32)
+        save.bezelStyle = .rounded
+        v.addSubview(save)
+        return v
+    }
+
+    @objc func saveSettings() {
+        cfg.server = serverField.stringValue.trimmingCharacters(in: .whitespaces)
+        cfg.token = tokenField.stringValue.trimmingCharacters(in: .whitespaces)
+        cfg.engine = enginePopup.indexOfSelectedItem == 1 ? "stealth" : "own"
+        cfg.headless = headlessCheck.state == .on
+        cfg.save()
+        configWindow?.close()
+        rebuildMenu()
+        if bridge.isRunning { bridge.start(cfg) } // restart with new config
+    }
+
+    // Parse the config string copied from the tianshu panel and fill the
+    // form. Accepts a `tsbridge://configure?server=…&token=…&engine=…&
+    // headless=…` URL, or a bare query string of the same params.
+    @objc func pasteConfig() {
+        let raw = (NSPasteboard.general.string(forType: .string) ?? "").trimmingCharacters(in: .whitespacesAndNewlines)
+        guard !raw.isEmpty else { return alert("Clipboard is empty", "Copy the config from the tianshu Local Bridge panel first.") }
+        // Extract the query part whether it's a full URL or bare query.
+        var query = raw
+        if let q = raw.range(of: "?") { query = String(raw[raw.index(after: q.lowerBound)...]) }
+        var params: [String: String] = [:]
+        for pair in query.split(separator: "&") {
+            let kv = pair.split(separator: "=", maxSplits: 1).map(String.init)
+            if kv.count == 2 {
+                params[kv[0]] = kv[1].removingPercentEncoding ?? kv[1]
+            }
+        }
+        guard let server = params["server"], !server.isEmpty else {
+            return alert("Couldn't read config", "Expected a tsbridge://configure?server=… string copied from the tianshu panel.")
+        }
+        serverField.stringValue = server
+        if let t = params["token"] { tokenField.stringValue = t }
+        if let e = params["engine"] { enginePopup.selectItem(at: e == "stealth" ? 1 : 0) }
+        if let h = params["headless"] { headlessCheck.state = (h == "1" || h == "true") ? .on : .off }
+    }
+
+    private func alert(_ title: String, _ body: String) {
+        let a = NSAlert(); a.messageText = title; a.informativeText = body; a.runModal()
+    }
+}
+
+// ─── main ────────────────────────────────────────────────────────────
+
+let app = NSApplication.shared
+app.setActivationPolicy(.accessory) // menu-bar only, no Dock icon
+let controller = AppController()
+app.delegate = controller
+app.run()

package/dist/connection.js

@@ -90,7 +90,16 @@ export class BridgeConnection {
             }, delay);
         });
         ws.on("error", (err) => {
-            this.log(`socket error: ${err instanceof Error ? err.message : String(err)}`);
+            const e = err;
+            const detail = [e.code, e.message].filter(Boolean).join(" ") ||
+                (err ? String(err) : "unknown (connection refused / handshake rejected?)");
+            this.log(`socket error connecting to ${this.opts.server}: ${detail}`);
+        });
+        // Surface non-101 handshake responses (auth/path problems), which
+        // otherwise arrive as an opaque error.
+        ws.on("unexpected-response", (_req, res) => {
+            this.log(`server rejected the WebSocket upgrade: HTTP ${res.statusCode} ${res.statusMessage ?? ""} ` +
+                `(check --server URL/path and --token). Expected /ws to accept an upgrade.`);
         });
     }
     send(msg) {

package/dist/connection.js.map

@@ -1 +1 @@
-{"version":3,"file":"connection.js","sourceRoot":"","sources":["../src/connection.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,EAAE;AACF,0EAA0E;AAC1E,mEAAmE;AACnE,2DAA2D;AAE3D,OAAO,SAAS,MAAM,IAAI,CAAC;AAC3B,OAAO,EAAE,GAAG,EAAE,UAAU,EAAuE,MAAM,eAAe,CAAC;AAWrH,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC,MAAM,OAAO,gBAAgB;IAOE;IANrB,EAAE,GAAqB,IAAI,CAAC;IAC5B,MAAM,GAAG,KAAK,CAAC;IACf,OAAO,GAAG,CAAC,CAAC;IACH,WAAW,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC3C,GAAG,CAAsB;IAE1C,YAA6B,IAAmB;QAAnB,SAAI,GAAJ,IAAI,CAAe;QAC9C,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED,IAAI;QACF,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QACD,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC;QACjB,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;IACjB,CAAC;IAEO,OAAO;QACb,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,aAAa,GAAG,UAAU,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACzE,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QAEb,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACjB,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;YACjB,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7C,MAAM,GAAG,GAAgB;gBACvB,IAAI,EAAE,GAAG,CAAC,QAAQ;gBAClB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAC5B,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;gBACtB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;aAChD,CAAC;YACF,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;YACvB,IAAI,GAAgD,CAAC;YACrD,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;YACT,CAAC;YACD,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;gBACjB,KAAK,GAAG,CAAC,UAAU;oBACjB,IAAK,GAAwB,CAAC,EAAE,EAAE,CAAC;wBACjC,IAAI,CAAC,GAAG,CAAC,sBAAsB,IAAI,CAAC,IAAI,CAAC,QAAQ,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,CAAC;oBACzF,CAAC;yBAAM,CAAC;wBACN,IAAI,CAAC,GAAG,CAAC,sBAAuB,GAA0B,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC;oBACnF,CAAC;oBACD,MAAM;gBACR,KAAK,GAAG,CAAC,OAAO;oBACd,KAAK,IAAI,CAAC,aAAa,CAAC,GAA4B,CAAC,CAAC;oBACtD,MAAM;gBACR;oBACE,uDAAuD;oBACvD,MAAM;YACV,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YAClB,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;YACf,IAAI,IAAI,CAAC,MAAM;gBAAE,OAAO;YACxB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;YAChF,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,iCAAiC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;YACvE,UAAU,CAAC,GAAG,EAAE;gBACd,IAAI,CAAC,IAAI,CAAC,MAAM;oBAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YACnC,CAAC,EAAE,KAAK,CAAC,CAAC;QACZ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACrB,IAAI,CAAC,GAAG,CAAC,iBAAiB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChF,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,IAAI,CAAC,GAAgB;QAC3B,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,GAAe;QACzC,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,uBAAuB,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;YACrH,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAA2D,CAAC;QAC5F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YAChH,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YACtD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,GAAG,CAAC,QAAQ;gBAClB,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,MAAM,EAAE,UAAU,CAAC,SAAS,MAAM,CAAC,IAAI,aAAa,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC;aAC9G,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"connection.js","sourceRoot":"","sources":["../src/connection.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,EAAE;AACF,0EAA0E;AAC1E,mEAAmE;AACnE,2DAA2D;AAE3D,OAAO,SAAS,MAAM,IAAI,CAAC;AAC3B,OAAO,EAAE,GAAG,EAAE,UAAU,EAAuE,MAAM,eAAe,CAAC;AAWrH,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC,MAAM,OAAO,gBAAgB;IAOE;IANrB,EAAE,GAAqB,IAAI,CAAC;IAC5B,MAAM,GAAG,KAAK,CAAC;IACf,OAAO,GAAG,CAAC,CAAC;IACH,WAAW,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC3C,GAAG,CAAsB;IAE1C,YAA6B,IAAmB;QAAnB,SAAI,GAAJ,IAAI,CAAe;QAC9C,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED,IAAI;QACF,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QACD,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC;QACjB,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;IACjB,CAAC;IAEO,OAAO;QACb,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,aAAa,GAAG,UAAU,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACzE,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QAEb,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACjB,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;YACjB,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7C,MAAM,GAAG,GAAgB;gBACvB,IAAI,EAAE,GAAG,CAAC,QAAQ;gBAClB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAC5B,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;gBACtB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;aAChD,CAAC;YACF,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;YACvB,IAAI,GAAgD,CAAC;YACrD,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;YACT,CAAC;YACD,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;gBACjB,KAAK,GAAG,CAAC,UAAU;oBACjB,IAAK,GAAwB,CAAC,EAAE,EAAE,CAAC;wBACjC,IAAI,CAAC,GAAG,CAAC,sBAAsB,IAAI,CAAC,IAAI,CAAC,QAAQ,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,CAAC;oBACzF,CAAC;yBAAM,CAAC;wBACN,IAAI,CAAC,GAAG,CAAC,sBAAuB,GAA0B,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC;oBACnF,CAAC;oBACD,MAAM;gBACR,KAAK,GAAG,CAAC,OAAO;oBACd,KAAK,IAAI,CAAC,aAAa,CAAC,GAA4B,CAAC,CAAC;oBACtD,MAAM;gBACR;oBACE,uDAAuD;oBACvD,MAAM;YACV,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YAClB,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;YACf,IAAI,IAAI,CAAC,MAAM;gBAAE,OAAO;YACxB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;YAChF,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,iCAAiC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;YACvE,UAAU,CAAC,GAAG,EAAE;gBACd,IAAI,CAAC,IAAI,CAAC,MAAM;oBAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YACnC,CAAC,EAAE,KAAK,CAAC,CAAC;QACZ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACrB,MAAM,CAAC,GAAG,GAAmD,CAAC;YAC9D,MAAM,MAAM,GACV,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC7C,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,oDAAoD,CAAC,CAAC;YAC7E,IAAI,CAAC,GAAG,CAAC,8BAA8B,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QAEH,kEAAkE;QAClE,uCAAuC;QACvC,EAAE,CAAC,EAAE,CAAC,qBAAqB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YACzC,IAAI,CAAC,GAAG,CACN,+CAA+C,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,aAAa,IAAI,EAAE,GAAG;gBACzF,2EAA2E,CAC9E,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,IAAI,CAAC,GAAgB;QAC3B,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,GAAe;QACzC,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,uBAAuB,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;YACrH,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAA2D,CAAC;QAC5F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YAChH,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YACtD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,GAAG,CAAC,QAAQ;gBAClB,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,MAAM,EAAE,UAAU,CAAC,SAAS,MAAM,CAAC,IAAI,aAAa,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC;aAC9G,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/index.js

@@ -14,22 +14,44 @@
 //   --device <id>      stable device id (default: hostname)
 //   --label <name>     human label shown in the panel (default: device id)
 //   --no-browser         don't expose browser tools
+//   --no-shell           don't expose the shell exec + file sync tools
+//   --shell-root <dir>   fixed root dir that jails exec + sync
+//                          (default: ~/.tianshu_shell)
 //   --browser-engine     own | stealth (default: own)
 //                          own     = your system/running Chrome (no download,
 //                                    real cookies+fingerprint)
 //                          stealth = cloakbrowser-mcp (CloakBrowser stealth
 //                                    Chromium, full Playwright-MCP toolset,
 //                                    passes bot detection; ~200MB first run)
-//   --headless           run the browser without a window (own engine)
+//   --headless           run the browser without a window (own + stealth;
+//                          default is headful — a window you can watch)
 //   --cdp <url>          own: connect to a running Chrome's CDP endpoint
 //                        (default probe http://127.0.0.1:9222; "off" to skip)
 //   --chrome-channel     own: which installed browser to launch (chrome, msedge, …)
 //   --user-data-dir      own: reuse a Chrome profile dir so logins carry over
+//
+// Subcommands:
+//   tsbridge update [--check|--dry-run|--tag <t>]   self-update
+//   tsbridge install-app [--run]                    build + install the
+//                                                   macOS menu-bar app
+//   tsbridge version                                print installed version
 import os from "node:os";
 import { BridgeConnection } from "./connection.js";
-import { makeBrowserTools } from "./browser.js";
-import { connectMcpChild } from "./mcp-child.js";
+import { connectMcpChild, bridgeOutputDir } from "./mcp-child.js";
+import { localTools, defaultShellRoot } from "./local-tools.js";
 import { runUpdate, installedVersion } from "./update.js";
+import { installApp } from "./install-app.js";
+/** Is a Chrome already listening on this CDP endpoint? */
+async function probeCdp(cdpUrl) {
+    try {
+        const base = cdpUrl.replace(/\/$/, "");
+        const res = await fetch(`${base}/json/version`, { signal: AbortSignal.timeout(2500) });
+        return res.ok;
+    }
+    catch {
+        return false;
+    }
+}
 function parseArgs(argv) {
     const out = {};
     for (let i = 0; i < argv.length; i++) {
@@ -54,18 +76,30 @@ async function main() {
     const sub = argv.find((a) => !a.startsWith("--"));
     const args = parseArgs(argv);
     if (sub === "update") {
-        process.exit(await runUpdate(args.yes === true || args.y === true));
+        process.exit(await runUpdate({
+            check: args.check === true,
+            dryRun: args["dry-run"] === true,
+            tag: typeof args.tag === "string" ? args.tag : undefined,
+        }));
     }
     if (sub === "version" || args.version === true || args.v === true) {
         process.stdout.write(`@tianshu-ai/local-bridge v${installedVersion()}\n`);
         process.exit(0);
     }
+    if (sub === "install-app") {
+        process.exit(installApp({
+            run: args.run === true,
+            dest: typeof args.dest === "string" ? args.dest : undefined,
+        }));
+    }
     const server = typeof args.server === "string" ? args.server : "";
     if (!server) {
         console.error("error: --server <wss://host/ws> is required");
         console.error("example: tsbridge --server wss://tianshu.example.com/ws --token ***");
         console.error("install:  npm i -g @tianshu-ai/local-bridge   (then run `tsbridge`)");
-        console.error("commands: tsbridge update [--yes]   |   tsbridge version");
+        console.error("commands: tsbridge update [--check|--dry-run|--tag <t>]");
+        console.error("          tsbridge install-app [--run]   (macOS menu-bar app)");
+        console.error("          tsbridge version");
         process.exit(2);
     }
     const token = typeof args.token === "string" ? args.token : undefined;
@@ -78,17 +112,22 @@ async function main() {
     const channel = typeof args["chrome-channel"] === "string" ? args["chrome-channel"] : "chrome";
     const userDataDir = typeof args["user-data-dir"] === "string" ? args["user-data-dir"] : "";
     const browserOn = args["no-browser"] !== true;
+    const shellOn = args["no-shell"] !== true;
     const engine = args["browser-engine"] === "stealth" ? "stealth" : "own";
+    const shellRoot = typeof args["shell-root"] === "string" ? args["shell-root"] : defaultShellRoot();
     const tools = [];
     if (browserOn) {
         if (engine === "stealth") {
             // Full Playwright-MCP toolset pointed at CloakBrowser stealth
             // Chromium. Spawned as a child MCP server over stdio.
             try {
+                // cloakbrowser-mcp reads PLAYWRIGHT_MCP_HEADLESS (default true =
+                // headless). Set it explicitly from our headful/--headless flag
+                // so the window shows when the user wants it.
                 const stealthTools = await connectMcpChild({
                     command: "npx",
                     args: ["-y", "cloakbrowser-mcp@latest"],
-                    env: headful ? {} : { PWMCP_HEADLESS: "1" },
+                    env: { PLAYWRIGHT_MCP_HEADLESS: headful ? "false" : "true" },
                     log: (m) => console.log(`[local-bridge] ${m}`),
                 });
                 tools.push(...stealthTools);
@@ -99,17 +138,48 @@ async function main() {
             }
         }
         else {
-            tools.push(...makeBrowserTools({
-                cdpUrl,
-                channel,
-                userDataDir,
-                headful,
-                log: (m) => console.log(`[local-bridge] ${m}`),
-            }));
+            // own engine: the full @playwright/mcp toolset pointed at the
+            // user's real Chrome — connect to a running Chrome over CDP if one
+            // is up, else launch the system Chrome (channel). Same tool
+            // surface as stealth; only the underlying browser differs.
+            const log = (m) => console.log(`[local-bridge] ${m}`);
+            // Pin output dir explicitly so it never resolves against a bad cwd.
+            const mcpArgs = ["-y", "@playwright/mcp@latest", "--output-dir", bridgeOutputDir()];
+            const cdpUp = cdpUrl ? await probeCdp(cdpUrl) : false;
+            if (cdpUp) {
+                mcpArgs.push("--cdp-endpoint", cdpUrl);
+                log(`own: connecting to your running Chrome at ${cdpUrl}`);
+            }
+            else {
+                // @playwright/mcp: --browser takes a browser OR chrome channel
+                // ("chrome", "msedge", …). Point it at the system Chrome.
+                mcpArgs.push("--browser", channel);
+                if (userDataDir)
+                    mcpArgs.push("--user-data-dir", userDataDir);
+                if (!headful)
+                    mcpArgs.push("--headless");
+                log(`own: launching system ${channel}${headful ? "" : " (headless)"}`);
+            }
+            try {
+                const ownTools = await connectMcpChild({ command: "npx", args: mcpArgs, log });
+                tools.push(...ownTools);
+            }
+            catch (err) {
+                console.error(`[local-bridge] failed to start browser (@playwright/mcp): ${err instanceof Error ? err.message : String(err)}`);
+                process.exit(1);
+            }
         }
     }
+    // Native local tools: shell exec + file sync. Run directly on this
+    // machine (no child MCP), mirroring the openshell plugin's
+    // exec / sync_up / sync_down surface.
+    if (shellOn) {
+        const log = (m) => console.log(`[local-bridge] ${m}`);
+        tools.push(...localTools({ root: shellRoot, log }));
+        log(`shell: exec + sync_up/sync_down enabled, jailed to ${shellRoot}`);
+    }
     if (tools.length === 0) {
-        console.error("[local-bridge] no tools enabled — nothing to expose. Remove --no-browser (or enable a capability) and try again.");
+        console.error("[local-bridge] no tools enabled — nothing to expose. Remove --no-browser / --no-shell (or enable a capability) and try again.");
         process.exit(2);
     }
     const conn = new BridgeConnection({
@@ -127,7 +197,7 @@ async function main() {
             : cdpUrl
                 ? `own: connect(${cdpUrl}) or ${channel}`
                 : `own: ${channel}`;
-    console.log(`[local-bridge] starting — device="${deviceId}", ${tools.length} tools, browser=${browserDesc}`);
+    console.log(`[local-bridge] starting — device="${deviceId}", ${tools.length} tools, browser=${browserDesc}, shell=${shellOn ? "on" : "off"}`);
     conn.start();
     const shutdown = () => {
         console.log("\n[local-bridge] shutting down…");