@tobq/boardclip 0.0.0-stage → 2.1.108

package/mcp/boardclip-mcp.js

@@ -0,0 +1,255 @@
+#!/usr/bin/env node
+'use strict';
+
+// BoardClip MCP server (stdio).
+//
+// Spawned by an AI client (Claude Code, Codex, Claude Desktop, VS Code, …) over
+// stdio - no HTTP, no port. It exposes the user's CURATED clipboard context and
+// management actions:
+//
+//   - Reads of clips in groups the user shared with AI are served directly from
+//     the data files (work even when the app is closed), filtered by the same
+//     opt-in group allowlist the app uses (lib/mcp-core).
+//   - Anything beyond the allowlist, any mutation, and any clipboard write is
+//     forwarded to the running BoardClip app over the local control channel,
+//     where it is gated behind the approval modal. If the app is not running,
+//     those tools return a clear "open BoardClip" message.
+//
+// All model/filtering logic is reused from lib/*; this file is the thin SDK glue.
+
+const fs = require('fs');
+const path = require('path');
+const { z } = require('zod');
+const { McpServer } = require('@modelcontextprotocol/sdk/server/mcp.js');
+const { StdioServerTransport } = require('@modelcontextprotocol/sdk/server/stdio.js');
+
+const model = require('../lib/clipboard-model');
+const textBlobStore = require('../lib/text-blob-store');
+const mcpCore = require('../lib/mcp-core');
+const mcpPaths = require('../lib/mcp-paths');
+const controlClient = require('../lib/control-client');
+
+// --- Data location -----------------------------------------------------------
+const discovery = mcpPaths.readDiscovery();
+const DATA_DIR = (discovery && discovery.dataDir) || mcpPaths.defaultDataDir();
+const HISTORY_PATH = path.join(DATA_DIR, 'clipboard-history.json');
+const SETTINGS_PATH = path.join(DATA_DIR, 'clipboard-settings.json');
+const TEXT_DIR = path.join(DATA_DIR, textBlobStore.TEXT_BLOB_DIRNAME);
+
+function readSettings() {
+  try {
+    return { ...model.DEFAULT_SETTINGS, ...JSON.parse(fs.readFileSync(SETTINGS_PATH, 'utf8')) };
+  } catch {
+    return { ...model.DEFAULT_SETTINGS };
+  }
+}
+
+function readHistory() {
+  try {
+    const loaded = JSON.parse(fs.readFileSync(HISTORY_PATH, 'utf8'));
+    const items = Array.isArray(loaded) ? loaded : [];
+    for (const item of items) { model.migrateItemPin(item); model.ensureItemId(item); }
+    return items;
+  } catch {
+    return [];
+  }
+}
+
+// --- Result helpers ----------------------------------------------------------
+function jsonResult(value) {
+  return { content: [{ type: 'text', text: JSON.stringify(value, null, 2) }] };
+}
+
+function errorResult(message) {
+  return { content: [{ type: 'text', text: message }], isError: true };
+}
+
+// Every clip mutation carries the rev it read; the app refuses a stale one.
+const REV_NOTE = ' Requires expected_rev: the clip\'s `rev` from list_clips/search_clips/get_clip (or from your previous change\'s result). If the clip changed since you read it the change is refused - re-read it and retry. Returns the clip\'s new rev.';
+const expectedRevSchema = () => z.string().min(1).describe('The clip\'s `rev` as you last read it; the change is refused if the clip changed since.');
+
+function revisionConflictMessage(err) {
+  if (!err || !/revision_conflict:/.test(String(err.message || ''))) return null;
+  const d = err.details || {};
+  const code = err.code || String(err.message).split('revision_conflict:')[1];
+  if (code === 'stale_revision') return `Clip ${d.id} changed since you read it (your rev ${d.expectedRev}, now ${d.currentRev}), so nothing was changed. Re-read it with get_clip and retry with the new rev.`;
+  if (code === 'superseded') return `Clip ${d.id} was edited and is now clip ${d.currentId}, so nothing was changed. Re-read ${d.currentId} with get_clip and retry with its rev.`;
+  if (code === 'rev_required') return 'expected_rev is required: pass the clip\'s rev from list_clips/search_clips/get_clip.';
+  if (code === 'not_found') return `No clip with id "${d.id}" (it may have been deleted), so nothing was changed.`;
+  return `The clip changed (${code}), so nothing was changed. Re-read it and retry.`;
+}
+
+let clientLabel = 'an AI assistant';
+
+// Forward a gated action/read to the running app and shape the response (or a
+// friendly error) for the MCP client.
+async function runForward(tool, args) {
+  try {
+    const result = await controlClient.request('action', '/action', { tool, args, client: clientLabel });
+    return jsonResult(result);
+  } catch (err) {
+    const conflict = revisionConflictMessage(err);
+    if (conflict) return errorResult(conflict);
+    if (err && err.code === 'app_not_running') {
+      return errorResult('BoardClip is not running. Open the BoardClip app so it can show the approval prompt and perform this action.');
+    }
+    if (err && /denied/i.test(err.message)) {
+      return errorResult('The user denied this action in the BoardClip approval prompt.');
+    }
+    if (err && /timed_out/i.test(err.message)) {
+      return errorResult('The approval prompt timed out (no response), so the action was not performed.');
+    }
+    return errorResult(err && err.message ? err.message : 'Action failed.');
+  }
+}
+
+// --- Server ------------------------------------------------------------------
+const server = new McpServer({ name: 'boardclip', version: '1.0.0' });
+
+// ---- Read tools (served locally from the data files) ----
+server.registerTool('list_context', {
+  description: 'Summary of the user\'s clipboard organisation: groups (with which are shared with AI), pinned and numpad-slot clips, and totals. The starting point for understanding what is available.',
+  inputSchema: {},
+}, async () => jsonResult(mcpCore.buildContext(readHistory(), readSettings())));
+
+server.registerTool('list_clips', {
+  description: 'List clipboard clips the user shared with AI (most recent first, with text previews). Non-shared clips are excluded unless include_unshared_metadata is set, in which case they appear as metadata only (no text).',
+  inputSchema: {
+    limit: z.number().int().min(1).max(200).optional(),
+    group: z.string().optional().describe('Only clips in this group.'),
+    include_unshared_metadata: z.boolean().optional(),
+  },
+}, async ({ limit, group, include_unshared_metadata }) => {
+  const res = mcpCore.listClips(readHistory(), readSettings(), {
+    limit: limit || mcpCore.DEFAULT_LIST_LIMIT,
+    group: group || null,
+    includeNonShared: !!include_unshared_metadata,
+  });
+  return jsonResult(res);
+});
+
+server.registerTool('search_clips', {
+  description: 'Search shared clips with the BoardClip search language (the same text the app\'s search field takes). Plain words are literal, case-insensitive substrings, and every term must match (AND); "a quoted phrase" matches exactly; /pattern/ is a regular expression term (case-insensitive, . never crosses a line break; title:/re/ and text:/re/ too); a OR b matches either (OR binds tighter than AND, so x a OR b = x AND (a OR b)); ( ) groups at any depth; -term or -( ... ) excludes. Field scopes title:/text:/group: (short: t:/b:/g:), facets is:pinned|is:image|is:text|is:numpad|is:url|is:multiline|is:rich, num:1-9 (n:), since:/before: e.g. since:7d (s:/bf:), len:>100 or len:50-200 (l:), lines:>3 (ln:), words:<20 (wd:), sort:new|best (o:), id:. Every prefix has a short + long alias. Example: group:Work OR group:Ideas /inv(oice)?/ -draft. Returns matching shared clips with previews plus a count of how many NON-shared clips also matched. Set include_unshared to run the full search over everything - that requires the app and pops an approval prompt.',
+  inputSchema: {
+    query: z.string().min(1),
+    regex: z.boolean().optional().describe('Legacy: read the query\'s free text as ONE regular expression. Prefer /pattern/ terms in the query.'),
+    include_unshared: z.boolean().optional(),
+    limit: z.number().int().min(1).max(200).optional(),
+  },
+}, async ({ query, regex, include_unshared, limit }) => {
+  if (include_unshared) {
+    return runForward('search_all', { query, regex: !!regex, limit: limit || mcpCore.DEFAULT_LIST_LIMIT });
+  }
+  const res = mcpCore.searchClips(readHistory(), readSettings(), {
+    query, regex: !!regex, limit: limit || mcpCore.DEFAULT_LIST_LIMIT,
+  });
+  return jsonResult(res);
+});
+
+server.registerTool('get_clip', {
+  description: 'Get the full text of a clip by id. Shared clips return immediately. A non-shared clip requires the app and pops an approval prompt before the text is returned.',
+  inputSchema: { id: z.string() },
+}, async ({ id }) => {
+  const settings = readSettings();
+  const resolved = mcpCore.resolveForRead(readHistory(), settings, id);
+  if (resolved.reason === 'not_found') return errorResult(`No clip with id "${id}".`);
+  if (resolved.reason === 'ok') {
+    const item = resolved.item;
+    const sharedSet = mcpCore.sharedGroupSet(settings);
+    if (item.type === 'image') return jsonResult(mcpCore.clipView(item, { sharedSet }));
+    textBlobStore.hydrateTextItem(item, TEXT_DIR);
+    return jsonResult(mcpCore.fullTextResult(item, sharedSet));
+  }
+  // not_shared -> approval-gated read through the app.
+  return runForward('read_clip', { id, reason: resolved.reason });
+});
+
+server.registerTool('get_image', {
+  description: 'Get metadata for an image clip (type, dimensions, group, timestamp). Set include_path to also get the local file path, which requires the app and pops an approval prompt.',
+  inputSchema: { id: z.string(), include_path: z.boolean().optional() },
+}, async ({ id, include_path }) => {
+  if (include_path) return runForward('image_path', { id });
+  const settings = readSettings();
+  const resolved = mcpCore.resolveForRead(readHistory(), settings, id);
+  if (resolved.reason === 'not_found') return errorResult(`No clip with id "${id}".`);
+  if (resolved.item.type !== 'image') return errorResult(`Clip "${id}" is not an image.`);
+  // clipView returns metadata-only for a non-shared image; full meta for a shared one.
+  return jsonResult(mcpCore.clipView(resolved.item, { sharedSet: mcpCore.sharedGroupSet(settings) }));
+});
+
+// ---- Management tools (forwarded to the app; gated there) ----
+server.registerTool('add_clip', {
+  description: 'Add a new text clip to history, optionally into a group. Pops an approval prompt unless you have allowed this action.',
+  inputSchema: { text: z.string().min(1), group: z.string().optional() },
+}, async ({ text, group }) => runForward('add_clip', { text, group: group || null }));
+
+server.registerTool('edit_clip', {
+  description: 'Replace (or append to) the text of an existing TEXT clip in place, keeping its pin, groups, and numpad slot. Text clips are content-addressed, so editing changes the clip id - the new id is returned in the result. Images cannot be edited. Pops an approval prompt.' + REV_NOTE,
+  inputSchema: {
+    id: z.string(),
+    expected_rev: expectedRevSchema(),
+    text: z.string().min(1),
+    title: z.string().optional().describe('Optional new title/name for the clip.'),
+    append: z.boolean().optional().describe('Append text to the existing content (newline-joined) instead of replacing it.'),
+  },
+}, async ({ id, expected_rev, text, title, append }) => runForward('edit_clip', { id, expected_rev, text, title: title != null ? title : null, append: !!append }));
+
+server.registerTool('pin_clip', {
+  description: 'Toggle the pin (star) on a clip by id.' + REV_NOTE,
+  inputSchema: { id: z.string(), expected_rev: expectedRevSchema() },
+}, async ({ id, expected_rev }) => runForward('pin_clip', { id, expected_rev }));
+
+server.registerTool('set_numpad', {
+  description: 'Assign a clip to a numpad quick-paste slot (1-9).' + REV_NOTE,
+  inputSchema: { id: z.string(), expected_rev: expectedRevSchema(), slot: z.number().int().min(1).max(9) },
+}, async ({ id, expected_rev, slot }) => runForward('set_numpad', { id, expected_rev, slot }));
+
+server.registerTool('assign_group', {
+  description: 'Toggle a clip\'s membership in a group (adds if absent, removes if present).' + REV_NOTE,
+  inputSchema: { id: z.string(), expected_rev: expectedRevSchema(), group: z.string().min(1) },
+}, async ({ id, expected_rev, group }) => runForward('assign_group', { id, expected_rev, group }));
+
+server.registerTool('create_group', {
+  description: 'Create a new group.',
+  inputSchema: { name: z.string().min(1) },
+}, async ({ name }) => runForward('create_group', { name }));
+
+server.registerTool('delete_group', {
+  description: 'Delete a group (clips stay in history, just lose this group label).',
+  inputSchema: { name: z.string().min(1) },
+}, async ({ name }) => runForward('delete_group', { name }));
+
+server.registerTool('delete_clip', {
+  description: 'Delete a clip from history. Always pops an approval prompt.' + REV_NOTE,
+  inputSchema: { id: z.string(), expected_rev: expectedRevSchema() },
+}, async ({ id, expected_rev }) => runForward('delete_clip', { id, expected_rev }));
+
+server.registerTool('copy_to_clipboard', {
+  description: 'Put a clip (by id) or literal text onto the user\'s system clipboard. Always pops an approval prompt.',
+  inputSchema: { id: z.string().optional(), text: z.string().optional() },
+}, async ({ id, text }) => {
+  if (!id && !text) return errorResult('Provide either id or text.');
+  return runForward('copy_to_clipboard', { id: id || null, text: text != null ? text : null });
+});
+
+server.registerTool('paste_clip', {
+  description: 'Put a clip on the clipboard and paste it into the foreground app. Always pops an approval prompt.',
+  inputSchema: { id: z.string() },
+}, async ({ id }) => runForward('paste_clip', { id }));
+
+// --- Connect -----------------------------------------------------------------
+async function main() {
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+  // Best-effort: label the client for the approval modal.
+  try {
+    const info = server.server.getClientVersion && server.server.getClientVersion();
+    if (info && info.name) clientLabel = info.version ? `${info.name} ${info.version}` : info.name;
+  } catch {}
+}
+
+main().catch(err => {
+  // stderr only - stdout is the JSON-RPC channel.
+  try { process.stderr.write(`boardclip-mcp fatal: ${err && err.stack || err}\n`); } catch {}
+  process.exit(1);
+});

package/mcp-approval-preload.js

@@ -0,0 +1,22 @@
+const { contextBridge, ipcRenderer } = require('electron');
+
+// Bridge for the AI-action approval modal (mcp-approval.html). The main process
+// pushes the request to render; the renderer sends back exactly one decision.
+contextBridge.exposeInMainWorld('approval', {
+  onRequest: (callback) => {
+    ipcRenderer.on('approval-request', (_, request) => callback(request));
+  },
+  onSettings: (callback) => {
+    ipcRenderer.on('approval-settings', (_, s) => callback(s));
+  },
+  // Appearance (accent, density, corners, theme mode, this window's surface):
+  // one event whenever any of it changes - a setting, another device, the OS accent.
+  onAppearanceChanged: (callback) => {
+    const listener = (_, look) => callback(look || {});
+    ipcRenderer.on('appearance-changed', listener);
+    return () => ipcRenderer.removeListener('appearance-changed', listener);
+  },
+  decide: (id, choice) => ipcRenderer.send('approval-decide', id, choice),
+  hold: (id, held, remainingSec) => ipcRenderer.send('approval-hold', id, held, remainingSec),
+  resize: (height) => ipcRenderer.send('approval-resize', height),
+});

package/mcp-approval.html

@@ -0,0 +1,218 @@
+<!DOCTYPE html>
+<html><head><meta charset="utf-8"><title>Approve AI action</title>
+<script>
+  document.documentElement.dataset.theme = matchMedia('(prefers-color-scheme: light)').matches ? 'light' : 'dark';
+</script>
+<link rel="stylesheet" href="site/shared/clipboard-popup.css">
+<link rel="stylesheet" href="site/shared/clipboard-window.css">
+<!-- The shared core: its applyTheme / applyAppearance render the appearance
+     payload exactly as every other window does. -->
+<script src="site/shared/clip-search.js"></script>
+<script src="site/shared/clipboard-ui-core.js"></script>
+<style>
+  /* Tokens, the .mi icon spec, the .overline label, the .btn set, the focus
+     ring and the scrollbar come from the shared clipboard-popup.css; the
+     window base (reset, font, glass scrim) from clipboard-window.css, so the
+     modal can never drift from the app. Only the modal's own layout lives here.
+     Layout answers, top to bottom: WHO is asking, WHAT happens (title + one
+     plain sentence with the consequence), WHY it is asking, WHICH clip (facts),
+     the text only as a labelled preview, then the decision: [Deny] [Allow
+     once], with "for this session" / "always" as quiet options above it. */
+  body { user-select:none; }
+  /* The bar is the shared window bar (.bc-bar: drag region, --bar-h, the title in sentence case). */
+  /* Two tones, as in every window: the request on the canvas, the decision
+     (countdown, the session / always options, Deny / Allow once) on a foot
+     band like the editor's, held at the bottom. */
+  body { display:flex; flex-direction:column; }
+  .wrap { padding:var(--sp-5) var(--gutter) var(--sp-6); display:flex; flex-direction:column; gap:var(--sp-4); }
+  .foot { margin-top:auto; padding:var(--sp-5) var(--gutter); display:flex; flex-direction:column; gap:var(--sp-4);
+          background:var(--surface); border-top:1px solid var(--line); }
+  .who { font-size:var(--fs-meta); line-height:var(--lh-ui); color:var(--text-dim); }
+  .who b { color:var(--text); font-weight:var(--fw-strong); }
+  .head { display:flex; gap:var(--sp-5); align-items:center; }
+  .badge { width:var(--ctl-lg); height:var(--ctl-lg); border-radius:var(--r-panel); flex-shrink:0; display:flex; align-items:center; justify-content:center;
+           background:var(--accent-bg); color:var(--accent); }
+  .badge.danger { background:var(--red-bg); color:var(--red); }
+  h1 { font-size:var(--fs-ui); font-weight:var(--fw-strong); line-height:var(--lh-ui); }
+  .explain { font-size:var(--fs-ui); line-height:var(--lh-text); color:var(--text); }
+  .why { font-size:var(--fs-meta); line-height:var(--lh-ui); color:var(--text-dim); display:flex; gap:var(--sp-2); align-items:flex-start; }
+  .why .mi { flex-shrink:0; }
+  .facts { display:grid; grid-template-columns:auto 1fr; gap:var(--sp-1) var(--sp-4); font-size:var(--fs-meta); }
+  .facts dt { color:var(--text-dim); }
+  .facts dd { color:var(--text); word-break:break-word; }
+  .card { background:var(--surface); border-radius:var(--r-panel); padding:var(--sp-4) var(--sp-5); }
+  .card .overline { margin-bottom:var(--sp-2); }
+  .detail { font-family:var(--font-mono); font-size:var(--fs-ui); line-height:var(--lh-text); color:var(--text);
+            white-space:pre-wrap; word-break:break-word; max-height:88px; overflow:auto; }
+  /* The countdown is information, not a warning: neutral, whatever the action. */
+  .meter { height:3px; border-radius:var(--r-chip); background:var(--line); overflow:hidden; }
+  .meter > span { display:block; height:100%; width:100%; background:var(--text-dim); transition:width 1s linear; }
+  .meter.paused > span { opacity:.45; }
+  .countdown { font-size:var(--fs-meta); color:var(--text-dim); display:flex; justify-content:space-between; margin-top:var(--sp-3); }
+  .later { display:flex; flex-wrap:wrap; gap:var(--sp-2); margin:0 calc(-1 * var(--sp-3)); }
+  .acts { display:flex; justify-content:flex-end; gap:var(--sp-4); }
+</style></head>
+<body>
+  <div class="bc-bar"><span class="bc-bar-title">AI action</span></div>
+  <div class="wrap" id="wrap">
+    <div class="who" id="who" title="Asked through BoardClip's AI access (its MCP connection). You can turn AI access off in Settings."><b id="client">An AI assistant</b> wants BoardClip to:</div>
+    <div class="head">
+      <div class="badge" id="badge"><span class="mi lg" id="badgeIcon">smart_toy</span></div>
+      <h1 id="title">Act on your clips</h1>
+    </div>
+    <div class="explain" id="explain"></div>
+    <div class="why" id="whyRow"><span class="mi sm">info</span><span id="why"></span></div>
+    <dl class="facts" id="facts"></dl>
+    <div class="card" id="detailCard">
+      <div class="label overline" id="detailLabel">Clip text</div>
+      <div class="detail" id="detail"></div>
+    </div>
+  </div>
+  <div class="foot" id="foot">
+    <div>
+      <div class="meter" id="meter"><span id="meterBar"></span></div>
+      <div class="countdown"><span id="countLabel">Denies automatically if you don't respond</span><span id="countNum"></span></div>
+    </div>
+    <div class="later">
+      <button type="button" class="btn quiet sm" id="allowSession" data-allow>Allow for this session</button>
+      <button type="button" class="btn quiet sm" id="allowAlways" data-allow>Always allow</button>
+    </div>
+    <div class="acts">
+      <button type="button" class="btn" id="deny" title="Deny (Enter or Esc)">Deny</button>
+      <button type="button" class="btn primary" id="allowOnce" data-allow>Allow once</button>
+    </div>
+  </div>
+
+<script>
+  const Core = window.BoardClipCore;
+  const $ = id => document.getElementById(id);
+  let current = null, remaining = 60, timer = null, decided = false, paused = false, armedAt = Infinity;
+  // Glyphs match the ones the app uses for the same action (star = pin, sell =
+  // group, edit_note = edit).
+  const ICONS = {
+    delete_clip:'delete', edit_clip:'edit_note', copy_to_clipboard:'content_copy', paste_clip:'content_paste_go',
+    add_clip:'add', pin_clip:'star', set_numpad:'tag', assign_group:'sell',
+    create_group:'new_label', delete_group:'label_off', read_clip:'visibility',
+    search_all:'search', image_path:'image',
+  };
+  const KIND = {
+    delete_clip:'deleting clips', edit_clip:'editing clip text', copy_to_clipboard:'writing your clipboard', paste_clip:'pasting into apps',
+    add_clip:'adding clips', pin_clip:'pinning', set_numpad:'numpad slots', assign_group:'group changes',
+    create_group:'group changes', delete_group:'group changes', read_clip:'reading private clips',
+    search_all:'searching private clips', image_path:'revealing image paths',
+  };
+  // The prompt never takes focus (main shows it inactive) and never allows by
+  // accident: Enter and Esc deny; allowing takes a click, or Ctrl+Enter
+  // (Cmd+Enter on macOS) once the window has focus. The allow buttons arm a
+  // moment after the prompt appears, so a click already on its way to
+  // whatever was under the pointer cannot land on them.
+  const ARM_MS = 800;
+  const MOD = /Mac/i.test(navigator.platform) ? 'Cmd' : 'Ctrl';
+  const armed = () => Date.now() >= armedAt;
+  const allowButtons = () => [...document.querySelectorAll('[data-allow]')];
+
+  // The appearance payload every window gets (main's windowAppearance): with
+  // the request (plus main's resolved theme), then again on any change.
+  function applyLook(look) {
+    const root = document.documentElement;
+    if (look.theme === 'light' || look.theme === 'dark') root.dataset.theme = look.theme;
+    else if (look.themeMode) Core.applyTheme(root, look.themeMode, matchMedia('(prefers-color-scheme: dark)').matches);
+    Core.applyAppearance(root, look);
+  }
+  if (window.approval.onSettings) window.approval.onSettings(applyLook);
+  if (window.approval.onAppearanceChanged) window.approval.onAppearanceChanged(applyLook);
+
+  function fit() {
+    // The natural height of bar + request + foot (the foot's margin-top:auto
+    // only takes up slack, so it never feeds back into the measure).
+    const h = ['.bc-bar', '#wrap', '#foot'].reduce((sum, sel) => { const el = document.querySelector(sel); return sum + (el ? el.getBoundingClientRect().height : 0); }, 0);
+    if (window.approval && window.approval.resize) window.approval.resize(Math.ceil(h));
+  }
+  function decide(choice) {
+    if (decided || !current) return;
+    if (choice !== 'deny' && choice !== 'timeout' && !armed()) return;
+    decided = true;
+    if (timer) clearInterval(timer);
+    window.approval.decide(current.id, choice);
+  }
+  // The countdown stops while the mouse is over the prompt so it can be read
+  // at leisure; main is told so its safety timer (and the waiting helper's
+  // keepalive) follow. Leaving the window resumes from the same second.
+  function setPaused(next) {
+    if (decided || !current || paused === next) return;
+    paused = next;
+    $('countLabel').textContent = paused ? 'Paused while your mouse is over this' : "Denies automatically if you don't respond";
+    $('countNum').textContent = paused ? 'paused' : remaining + 's';
+    $('meter').classList.toggle('paused', paused);
+    if (window.approval.hold) window.approval.hold(current.id, paused, remaining);
+  }
+  document.documentElement.addEventListener('mouseenter', () => setPaused(true));
+  document.documentElement.addEventListener('mouseleave', () => setPaused(false));
+  function tick() {
+    if (paused) return;
+    remaining -= 1;
+    $('countNum').textContent = remaining + 's';
+    $('meterBar').style.width = Math.max(0, (remaining / (current.timeoutSec || 60)) * 100) + '%';
+    if (remaining <= 0) decide('timeout');
+  }
+
+  window.approval.onRequest(req => {
+    current = req;
+    remaining = req.timeoutSec || 60;
+    const danger = !!req.danger;
+    const kind = KIND[req.tool] || req.tool;
+    $('title').textContent = req.title || 'Act on your clips';
+    $('client').textContent = req.client || 'An AI assistant';
+    $('badgeIcon').textContent = ICONS[req.tool] || 'smart_toy';
+    $('badge').classList.toggle('danger', danger);
+    $('allowOnce').classList.toggle('danger', danger);
+    $('allowOnce').classList.toggle('primary', !danger);
+    $('allowOnce').title = `Allow once (${MOD}+Enter). Enter and Esc deny.`;
+    $('allowSession').title = `Allow ${kind} until BoardClip restarts`;
+    $('allowAlways').textContent = `Always allow ${kind}`;
+    $('allowAlways').title = `Never ask again before ${kind} (Settings > AI access lists what is always allowed)`;
+    $('explain').textContent = req.explain || req.summary || '';
+    $('why').textContent = req.why || '';
+    $('whyRow').style.display = req.why ? '' : 'none';
+    const facts = Array.isArray(req.facts) ? req.facts : [];
+    $('facts').innerHTML = '';
+    for (const [k, v] of facts) {
+      const dt = document.createElement('dt'); dt.textContent = k;
+      const dd = document.createElement('dd'); dd.textContent = v;
+      $('facts').append(dt, dd);
+    }
+    $('facts').style.display = facts.length ? '' : 'none';
+    const preview = req.preview && req.preview.text ? req.preview : (req.detail ? { label: 'Clip text', text: req.detail } : null);
+    if (preview) { $('detailLabel').textContent = preview.label || 'Clip text'; $('detail').textContent = preview.text.trim(); $('detailCard').style.display = ''; }
+    else { $('detailCard').style.display = 'none'; }
+    $('countNum').textContent = remaining + 's';
+    timer = setInterval(tick, 1000);
+    for (const b of allowButtons()) b.disabled = true;
+    armedAt = Date.now() + ARM_MS;
+    setTimeout(() => { if (!decided) for (const b of allowButtons()) b.disabled = false; }, ARM_MS);
+    requestAnimationFrame(fit);
+    // Opened under a resting cursor: no mouseenter fires, so ask directly.
+    requestAnimationFrame(() => { if (document.documentElement.matches(':hover')) setPaused(true); });
+  });
+
+  $('allowOnce').onclick = () => decide('once');
+  $('allowSession').onclick = () => decide('session');
+  $('allowAlways').onclick = () => decide('always');
+  $('deny').onclick = () => decide('deny');
+  // Capture phase, so a focused button never gets the key first: Enter on a
+  // focused Allow still denies, and Space cannot press an allow button.
+  window.addEventListener('keydown', e => {
+    if (e.key === 'Escape') { e.preventDefault(); decide('deny'); return; }
+    if (e.key === 'Enter') {
+      e.preventDefault();
+      if ((e.ctrlKey || e.metaKey) && !e.altKey && !e.shiftKey) decide('once');
+      else decide('deny');
+      return;
+    }
+    if (e.key === ' ' && e.target && e.target.closest && e.target.closest('[data-allow]')) e.preventDefault();
+  }, true);
+  window.addEventListener('keyup', e => {
+    if (e.key === ' ' && e.target && e.target.closest && e.target.closest('[data-allow]')) e.preventDefault();
+  }, true);
+</script>
+</body></html>

package/package.json

@@ -1,6 +1,57 @@
 {
   "name": "@tobq/boardclip",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "productName": "BoardClip",
+  "version": "2.1.108",
+  "description": "Cross-platform clipboard history tray app with numpad quick-paste and native cloud sync",
+  "keywords": [
+    "clipboard",
+    "clipboard-manager",
+    "clipboard-history",
+    "electron",
+    "tray",
+    "windows",
+    "macos",
+    "linux",
+    "mcp"
+  ],
+  "homepage": "https://boardclip.app",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/tobq/boardclip.git"
+  },
+  "license": "MIT",
+  "author": "BoardClip contributors",
+  "main": "main.js",
+  "bin": {
+    "boardclip": "bin/boardclip.js"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "koffi": "^2.15.6",
+    "zod": "^4.4.3",
+    "electron": "^34.0.0"
+  },
+  "files": [
+    "main.js",
+    "preload.js",
+    "index.html",
+    "mcp-approval.html",
+    "mcp-approval-preload.js",
+    "lib/**",
+    "mcp/**",
+    "site/shared/**",
+    "assets/boardclip-icon.png",
+    "editor.html",
+    "editor-preload.js",
+    "viewer.html",
+    "viewer-preload.js",
+    "iconTemplate.png",
+    "iconTemplate@2x.png",
+    "icon.png",
+    "icon@2x.png",
+    "bin/**"
+  ],
+  "engines": {
+    "node": ">=18"
+  }
+}