easy-local-mcp 0.3.9

package/dist/agent.js

@@ -0,0 +1,498 @@
+#!/usr/bin/env node
+import { mkdir, readFile, unlink } from 'node:fs/promises';
+import { randomBytes } from 'node:crypto';
+import { spawn } from 'node:child_process';
+import { createServer as createNetServer } from 'node:net';
+import { fileURLToPath } from 'node:url';
+import { resolve } from 'node:path';
+import { stateDir, logFile, maskMcpUrl, serveControl } from './lifecycle.js';
+import { config } from './config.js';
+import WebSocket from 'ws';
+import { Assembly, frames, parseFrame, MAX_BYTES } from './relay-protocol.js';
+import { DEFAULT_PUBLIC_WORKER_URL, validatedWorkerOrigin } from './relay.js';
+import { clearPendingRegistrationToken, configuredRelayUrl, registrationToken, saveRelayPreference } from './relay-config.js';
+import { auditSecurity, getUnlockStatus, lockLocal, resetUnlockOnAgentStart, secureWriteFile, unlockLocal } from './security.js';
+await mkdir(stateDir, { recursive: true, mode: 0o700 });
+await resetUnlockOnAgentStart();
+await auditSecurity('agent_start', { pid: process.pid });
+const pidFile = resolve(stateDir, 'agent.pid');
+const workerFile = resolve(stateDir, 'worker.json');
+const connectionFile = resolve(stateDir, 'connection.json');
+let closing = false;
+let ready = false;
+let mcpUrl = null;
+let local;
+let socket;
+let reconnect;
+let reloading;
+let settings;
+let origin;
+async function registerDevice(workerUrl) {
+    const target = validatedWorkerOrigin(workerUrl);
+    const headers = {
+        'Content-Type': 'application/json'
+    };
+    const token = await registrationToken();
+    if (token) {
+        headers.Authorization = `Bearer ${token}`;
+    }
+    if (target.href === validatedWorkerOrigin(DEFAULT_PUBLIC_WORKER_URL).href) {
+        console.error('Security warning: the default public relay is trusted infrastructure and can observe relayed MCP request/response plaintext. Use a self-hosted Worker for sensitive environments.');
+    }
+    const response = await fetch(new URL('/register', target), {
+        method: 'POST',
+        headers,
+        body: '{}',
+        signal: AbortSignal.timeout(15000)
+    });
+    if (!response.ok) {
+        throw new Error(`Worker registration failed (${response.status}). Check the Relay URL and registration token in the Control Center, or the LOCALMCP_WORKER_URL / LOCALMCP_REGISTRATION_TOKEN environment overrides.`);
+    }
+    const registered = await response.json();
+    if (!registered.workerUrl
+        || !registered.agentToken
+        || !registered.mcpToken) {
+        throw new Error('Worker returned an invalid registration response');
+    }
+    return {
+        workerUrl: registered.workerUrl,
+        agentToken: registered.agentToken,
+        mcpToken: registered.mcpToken,
+        deviceId: registered.deviceId
+    };
+}
+async function loadSettings() {
+    const desiredWorkerUrl = await configuredRelayUrl();
+    const desiredOrigin = validatedWorkerOrigin(desiredWorkerUrl);
+    try {
+        settings = JSON.parse(await readFile(workerFile, 'utf8'));
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    const registeredOrigin = settings?.workerUrl
+        ? validatedWorkerOrigin(settings.workerUrl)
+        : undefined;
+    if (!settings || registeredOrigin?.href !== desiredOrigin.href) {
+        settings = await registerDevice(desiredOrigin.href);
+        await secureWriteFile(workerFile, JSON.stringify(settings, null, 2));
+        await clearPendingRegistrationToken();
+        await auditSecurity('worker_registration', {
+            deviceId: settings.deviceId,
+            publicRelay: desiredOrigin.href === validatedWorkerOrigin(DEFAULT_PUBLIC_WORKER_URL).href
+        });
+        console.error(`Registered Easy Local MCP device ${settings.deviceId ?? 'legacy'}.`);
+    }
+    origin = desiredOrigin;
+}
+function currentMcpUrl() {
+    if (!settings || !origin)
+        return null;
+    const path = settings.deviceId
+        ? `/mcp/${settings.deviceId}/${settings.mcpToken}`
+        : `/mcp/${settings.mcpToken}`;
+    return new URL(path, origin).href;
+}
+async function writeConnectionFile() {
+    mcpUrl = currentMcpUrl();
+    if (!mcpUrl || !settings) {
+        throw new Error('Easy Local MCP connection settings are not ready');
+    }
+    await secureWriteFile(connectionFile, JSON.stringify({
+        url: mcpUrl,
+        authentication: 'none',
+        transport: 'worker-websocket',
+        deviceId: settings.deviceId,
+        root: process.env.LOCALMCP_ROOT || process.cwd()
+    }, null, 2));
+}
+async function reregisterDevice(workerUrl) {
+    if (process.env.LOCALMCP_WORKER_URL) {
+        throw new Error('Worker origin is controlled by LOCALMCP_WORKER_URL; remove the environment override before changing it in the UI.');
+    }
+    const requested = validatedWorkerOrigin(workerUrl);
+    const next = await registerDevice(requested.href);
+    const nextOrigin = validatedWorkerOrigin(next.workerUrl);
+    settings = next;
+    origin = nextOrigin;
+    await saveRelayPreference(nextOrigin.href);
+    await secureWriteFile(workerFile, JSON.stringify(settings, null, 2));
+    await writeConnectionFile();
+    await clearPendingRegistrationToken();
+    await auditSecurity('worker_registration', {
+        deviceId: settings.deviceId,
+        publicRelay: origin.href === validatedWorkerOrigin(DEFAULT_PUBLIC_WORKER_URL).href
+    });
+    ready = false;
+    socket?.terminate();
+}
+async function rotateCredentials() {
+    if (!settings || !origin) {
+        throw new Error('Easy Local MCP Worker settings are not ready');
+    }
+    if (!settings.deviceId) {
+        throw new Error('Credential rotation is not available for the legacy single-user Worker model. Rotate Worker secrets and re-register manually.');
+    }
+    const response = await fetch(new URL(`/rotate/${settings.deviceId}`, origin), {
+        method: 'POST',
+        headers: {
+            Authorization: `Bearer ${settings.agentToken}`
+        },
+        body: '{}',
+        signal: AbortSignal.timeout(15000)
+    });
+    if (!response.ok) {
+        throw new Error(`Worker credential rotation failed (${response.status})`);
+    }
+    const rotated = await response.json();
+    if (rotated.deviceId !== settings.deviceId
+        || !rotated.agentToken
+        || !rotated.mcpToken
+        || !rotated.workerUrl) {
+        throw new Error('Worker returned an invalid rotation response');
+    }
+    settings = {
+        workerUrl: rotated.workerUrl,
+        agentToken: rotated.agentToken,
+        mcpToken: rotated.mcpToken,
+        deviceId: rotated.deviceId
+    };
+    await secureWriteFile(workerFile, JSON.stringify(settings, null, 2));
+    await writeConnectionFile();
+    await auditSecurity('credential_rotation', { deviceId: settings.deviceId });
+    socket?.terminate();
+}
+const closeControl = await serveControl(async () => {
+    const unlock = await getUnlockStatus();
+    return {
+        status: 'running',
+        pid: process.pid,
+        url: mcpUrl,
+        config: resolve(process.env.LOCALMCP_CONFIG || resolve(stateDir, 'localmcp.json')),
+        log: logFile,
+        ready,
+        locked: unlock.locked,
+        unlockExpiresAt: unlock.expiresAt,
+        workerUrl: origin?.href ?? null,
+        deviceId: settings?.deviceId ?? null,
+        workerManagedByEnv: process.env.LOCALMCP_WORKER_URL !== undefined
+    };
+}, {
+    stop: () => stop(),
+    reload: async () => {
+        reloading ??= reloadLocal().finally(() => {
+            reloading = undefined;
+        });
+        await reloading;
+    },
+    unlock: async (minutes) => {
+        await unlockLocal(minutes ?? 30);
+    },
+    lock: async () => {
+        await lockLocal('manual');
+    },
+    rotate: rotateCredentials,
+    reregister: reregisterDevice
+});
+await secureWriteFile(pidFile, String(process.pid));
+process.once('SIGINT', () => stop());
+process.once('SIGTERM', () => stop());
+process.on('SIGHUP', () => {
+    if (!reloading) {
+        reloading = reloadLocal()
+            .catch(error => console.error(error.message))
+            .finally(() => {
+            reloading = undefined;
+        });
+    }
+});
+process.on('uncaughtException', error => {
+    console.error(error);
+    stop(1);
+});
+process.on('unhandledRejection', error => {
+    console.error(error);
+    stop(1);
+});
+await loadSettings();
+const localToken = randomBytes(32).toString('hex');
+async function findFreePort() {
+    if (process.env.LOCALMCP_AGENT_PORT) {
+        return Number(process.env.LOCALMCP_AGENT_PORT);
+    }
+    return await new Promise((resolvePort, reject) => {
+        const server = createNetServer();
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', () => {
+            const address = server.address();
+            if (!address || typeof address === 'string') {
+                server.close();
+                reject(new Error('Unable to allocate local port'));
+                return;
+            }
+            const selected = address.port;
+            server.close(error => error ? reject(error) : resolvePort(selected));
+        });
+    });
+}
+const port = await findFreePort();
+function spawnLocal() {
+    return spawn(process.execPath, [fileURLToPath(new URL('./index.js', import.meta.url)), 'http'], {
+        env: {
+            ...process.env,
+            LOCALMCP_PORT: String(port),
+            LOCALMCP_TOKEN: localToken,
+            LOCALMCP_INTERNAL: '1'
+        },
+        stdio: ['ignore', 'ignore', 'inherit'],
+        windowsHide: process.platform === 'win32'
+    });
+}
+function watchLocal(child) {
+    child.on('error', error => {
+        console.error(error.message);
+        stop(1);
+    });
+    child.on('exit', code => {
+        if (!closing && !reloading && child === local) {
+            console.error(`Local server exited (${code})`);
+            stop(1);
+        }
+    });
+}
+local = spawnLocal();
+watchLocal(local);
+function stop(code = 0) {
+    if (closing)
+        return;
+    closing = true;
+    ready = false;
+    clearTimeout(reconnect);
+    socket?.terminate();
+    local?.kill('SIGTERM');
+    setTimeout(async () => {
+        local?.kill('SIGKILL');
+        await lockLocal('agent_stop').catch(() => { });
+        await auditSecurity('agent_stop', { pid: process.pid, code });
+        await unlink(pidFile).catch(() => { });
+        await closeControl();
+        process.exit(code);
+    }, 1500);
+}
+async function reloadLocal() {
+    if (closing || !local) {
+        throw new Error('Easy Local MCP is not ready');
+    }
+    await config();
+    const previous = local;
+    await new Promise(done => {
+        const timer = setTimeout(() => previous.kill('SIGKILL'), 5000);
+        previous.once('exit', () => {
+            clearTimeout(timer);
+            done();
+        });
+        previous.kill('SIGTERM');
+    });
+    if (closing) {
+        throw new Error('Easy Local MCP is stopping');
+    }
+    local = spawnLocal();
+    watchLocal(local);
+    const deadline = Date.now() + 10000;
+    while (Date.now() < deadline && !closing) {
+        if (local.exitCode !== null || local.signalCode !== null) {
+            break;
+        }
+        try {
+            const response = await fetch(`http://127.0.0.1:${port}/mcp`, {
+                headers: {
+                    Authorization: `Bearer ${localToken}`
+                },
+                signal: AbortSignal.timeout(500)
+            });
+            if (response.status === 405) {
+                await auditSecurity('config_reload');
+                console.error('Easy Local MCP configuration reloaded.');
+                return;
+            }
+        }
+        catch { }
+        await new Promise(resolvePause => setTimeout(resolvePause, 100));
+    }
+    stop(1);
+    throw new Error('Reload failed; see ' + logFile);
+}
+let localReady = false;
+for (let i = 0; i < 100 && !closing; i++) {
+    try {
+        const response = await fetch(`http://127.0.0.1:${port}/mcp`, {
+            headers: {
+                Authorization: `Bearer ${localToken}`
+            },
+            signal: AbortSignal.timeout(500)
+        });
+        if (response.status === 405) {
+            localReady = true;
+            break;
+        }
+    }
+    catch { }
+    await new Promise(resolvePause => setTimeout(resolvePause, 100));
+}
+if (!localReady || closing) {
+    stop(1);
+}
+else {
+    let attempt = 0;
+    let busy = false;
+    await writeConnectionFile();
+    function connect() {
+        if (closing || !settings || !origin)
+            return;
+        const wsUrl = new URL(settings.deviceId ? `/agent/${settings.deviceId}` : '/agent', origin);
+        wsUrl.protocol = origin.protocol === 'https:' ? 'wss:' : 'ws:';
+        const ws = new WebSocket(wsUrl, {
+            headers: {
+                Authorization: `Bearer ${settings.agentToken}`
+            },
+            handshakeTimeout: 15000,
+            maxPayload: 160000
+        });
+        socket = ws;
+        let assembly;
+        let requestId;
+        let pong = Date.now();
+        const heartbeat = setInterval(() => {
+            if (ws.readyState !== WebSocket.OPEN)
+                return;
+            if (Date.now() - pong > 65000) {
+                ws.terminate();
+                return;
+            }
+            ws.send('ping');
+        }, 25000);
+        ws.on('open', () => {
+            ready = true;
+            attempt = 0;
+            console.log(`Easy Local MCP is running\n\nMCP URL: ${maskMcpUrl(mcpUrl)}\nUse "easy-local-mcp url" to reveal the full credential-bearing URL.\nConfig: ~/.localmcp/localmcp.json\nSecurity: LOCKED until locally unlocked.\n`);
+        });
+        const respond = (id, value) => {
+            if (ws.readyState === WebSocket.OPEN) {
+                for (const frame of frames(id, value)) {
+                    ws.send(frame);
+                }
+            }
+        };
+        ws.on('message', async (raw) => {
+            const message = raw.toString();
+            if (message === 'pong') {
+                pong = Date.now();
+                return;
+            }
+            try {
+                const frame = parseFrame(message);
+                if (!assembly) {
+                    if (busy) {
+                        respond(frame.id, {
+                            status: 429,
+                            body: JSON.stringify({
+                                error: 'Local execution still in progress; do not retry automatically.'
+                            })
+                        });
+                        return;
+                    }
+                    assembly = new Assembly();
+                    requestId = frame.id;
+                }
+                if (requestId !== frame.id) {
+                    throw new Error('Overlapping requests');
+                }
+                const complete = assembly.push(frame);
+                if (!complete)
+                    return;
+                assembly = undefined;
+                requestId = undefined;
+                const data = complete.value;
+                if (!data
+                    || typeof data.body !== 'string'
+                    || Buffer.byteLength(data.body) > 2 * 1024 * 1024) {
+                    throw new Error('Invalid request body');
+                }
+                JSON.parse(data.body);
+                busy = true;
+                try {
+                    const headers = {
+                        'Content-Type': 'application/json',
+                        'Accept': 'application/json, text/event-stream',
+                        Authorization: `Bearer ${localToken}`
+                    };
+                    if (data.protocolVersion) {
+                        headers['MCP-Protocol-Version'] = data.protocolVersion;
+                    }
+                    const response = await fetch(`http://127.0.0.1:${port}/mcp`, {
+                        method: 'POST',
+                        headers,
+                        body: data.body,
+                        signal: AbortSignal.timeout(125000)
+                    });
+                    const reader = response.body?.getReader();
+                    let body = '';
+                    let bytes = 0;
+                    const decoder = new TextDecoder();
+                    if (reader) {
+                        try {
+                            while (true) {
+                                const part = await reader.read();
+                                if (part.done)
+                                    break;
+                                bytes += part.value.length;
+                                if (bytes > MAX_BYTES - 1024) {
+                                    await reader.cancel();
+                                    throw new Error('Tool response exceeds relay limit');
+                                }
+                                body += decoder.decode(part.value, { stream: true });
+                            }
+                            body += decoder.decode();
+                        }
+                        finally {
+                            reader.releaseLock();
+                        }
+                    }
+                    respond(frame.id, {
+                        status: response.status,
+                        body
+                    });
+                }
+                catch {
+                    respond(frame.id, {
+                        status: 502,
+                        body: JSON.stringify({
+                            error: 'Local call failed or timed out. Outcome may be unknown; do not automatically retry.'
+                        })
+                    });
+                }
+                finally {
+                    busy = false;
+                }
+            }
+            catch {
+                ws.close(1008, 'Invalid relay request');
+            }
+        });
+        ws.on('error', error => {
+            console.error(`Worker connection error: ${error.message}`);
+        });
+        ws.on('close', () => {
+            ready = false;
+            clearInterval(heartbeat);
+            if (!closing) {
+                const delay = Math.min(30000, 1000 * 2 ** Math.min(attempt++, 5))
+                    + Math.random() * 1000;
+                console.error(`Worker disconnected; reconnecting in ${Math.ceil(delay / 1000)}s. Requests are not replayed.`);
+                reconnect = setTimeout(connect, delay);
+            }
+        });
+    }
+    connect();
+}

package/dist/command.js

@@ -0,0 +1,30 @@
+import { spawn } from 'node:child_process';
+export function runCommand(command, cwd, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        // Deliberately do not pass the server's credentials to commands.
+        const env = {};
+        for (const key of ['PATH', 'HOME', 'USER', 'TMPDIR', 'LANG', 'SHELL', 'SystemRoot'])
+            if (process.env[key])
+                env[key] = process.env[key];
+        const child = spawn(command, { cwd, shell: true, detached: process.platform !== 'win32', env, stdio: ['ignore', 'pipe', 'pipe'], windowsHide: process.platform === 'win32' });
+        let output = Buffer.alloc(0), timedOut = false, truncated = false;
+        const stop = () => { try {
+            if (process.platform !== 'win32' && child.pid)
+                process.kill(-child.pid, 'SIGKILL');
+            else
+                child.kill('SIGKILL');
+        }
+        catch { } };
+        const timer = setTimeout(() => { timedOut = true; stop(); }, timeoutMs);
+        const collect = (chunk) => {
+            const remaining = 256 * 1024 - output.length;
+            if (chunk.length > remaining)
+                truncated = true;
+            output = Buffer.concat([output, chunk.subarray(0, Math.max(0, remaining))]);
+        };
+        child.stdout.on('data', collect);
+        child.stderr.on('data', collect);
+        child.on('error', e => { clearTimeout(timer); reject(e); });
+        child.on('close', (exitCode, signal) => { clearTimeout(timer); stop(); resolve({ exitCode, signal, output: output.toString('utf8'), timedOut, truncated }); });
+    });
+}

package/dist/config-watch.js

@@ -0,0 +1,35 @@
+import { readFile } from 'node:fs/promises';
+// Poll contents rather than a file inode: editors commonly save via rename.
+// A single loop coalesces writes and never overlaps reloads.
+export function watchConfig(path, apply, report, interval = 500) {
+    let stopped = false, timer;
+    let observed, settled, lastError;
+    let running = Promise.resolve();
+    async function scan() {
+        try {
+            const content = await readFile(path, 'utf8');
+            lastError = undefined;
+            if (stopped)
+                return;
+            if (content !== observed) {
+                observed = content;
+                return;
+            }
+            if (content === settled)
+                return;
+            // Remember rejected content too, avoiding repeated errors until the next edit.
+            settled = content;
+            await apply(content);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            if (!stopped && message !== lastError)
+                report(error);
+            lastError = message;
+        }
+    }
+    function tick() { running = scan().finally(() => { if (!stopped)
+        timer = setTimeout(tick, interval); }); }
+    timer = setTimeout(tick, interval);
+    return async () => { stopped = true; clearTimeout(timer); await running; };
+}

package/dist/config.js

@@ -0,0 +1,83 @@
+import { realpath, stat, readFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { homedir } from 'node:os';
+import { z } from 'zod';
+const mcpEntrySchema = z.object({ enabled: z.boolean().optional().default(true), command: z.string().min(1), args: z.array(z.string()).optional().default([]), env: z.record(z.string(), z.string()).optional() }).strict();
+const filePermissionsSchema = z.object({ read: z.boolean().optional(), write: z.boolean().optional(), delete: z.boolean().optional() }).strict();
+const featureSchema = z.object({
+    files: z.union([z.boolean(), filePermissionsSchema]).optional(),
+    shell: z.boolean().optional(),
+    processes: z.boolean().optional(),
+    externalMcp: z.boolean().optional(),
+}).strict();
+export const localMcpConfigSchema = z.object({
+    root: z.string().optional(),
+    workspaces: z.record(z.string().min(1), z.string().min(1)).optional(),
+    defaultWorkspace: z.string().min(1).optional(),
+    features: featureSchema.optional().default({}),
+    skills: z.object({ dir: z.string().optional().default('skills'), enabled: z.array(z.string().min(1)).optional() }).strict().optional().default({ dir: 'skills' }),
+    mcpServers: z.record(z.string(), mcpEntrySchema).optional().default({}),
+}).strict();
+function parseConfig(raw, path) {
+    const result = localMcpConfigSchema.safeParse(raw);
+    if (result.success)
+        return result.data;
+    const details = result.error.issues.map(i => `${i.path.join('.') || '<root>'}: ${i.message}`).join('; ');
+    throw new Error(`Invalid Easy Local MCP config ${path}: ${details}`);
+}
+async function readConfig() {
+    const explicit = process.env.LOCALMCP_CONFIG, path = explicit ? resolve(explicit) : resolve(homedir(), '.localmcp', 'localmcp.json');
+    try {
+        return { value: parseConfig(JSON.parse(await readFile(path, 'utf8')), path), base: dirname(path), path };
+    }
+    catch (e) {
+        if (e instanceof SyntaxError)
+            throw new Error(`Invalid JSON in Easy Local MCP config ${path}: ${e.message}`);
+        if (e.code !== 'ENOENT')
+            throw e;
+        return { value: localMcpConfigSchema.parse({}), base: homedir() };
+    }
+}
+export function configFilePath() { return resolve(process.env.LOCALMCP_CONFIG || resolve(homedir(), '.localmcp', 'localmcp.json')); }
+export async function config(snapshot) {
+    const loaded = snapshot ? { value: parseConfig(JSON.parse(snapshot.content), snapshot.path), base: dirname(snapshot.path), path: snapshot.path } : await readConfig(), c = loaded.value;
+    const configured = c.workspaces && Object.keys(c.workspaces).length ? c.workspaces : { default: c.root || '.' };
+    const rootOverride = process.env.LOCALMCP_ROOT;
+    const expand = (path) => path === '~' || path.startsWith('~/') ? resolve(homedir(), path.slice(2)) : resolve(loaded.base, path);
+    const workspaces = {};
+    for (const [name, path] of Object.entries(configured)) {
+        const selected = rootOverride && name === (c.defaultWorkspace || Object.keys(configured)[0]) ? rootOverride : path;
+        const root = await realpath(expand(selected));
+        if (!(await stat(root)).isDirectory())
+            throw new Error(`Workspace '${name}' must be a directory`);
+        workspaces[name] = root;
+    }
+    const defaultWorkspace = c.defaultWorkspace || Object.keys(workspaces)[0];
+    if (!workspaces[defaultWorkspace])
+        throw new Error(`Unknown defaultWorkspace '${defaultWorkspace}'`);
+    const root = workspaces[defaultWorkspace];
+    const port = Number(process.env.LOCALMCP_PORT || 8787);
+    if (!Number.isInteger(port) || port < 1 || port > 65535)
+        throw new Error('Invalid LOCALMCP_PORT');
+    const mcpServers = {};
+    for (const [name, m] of Object.entries(c.mcpServers))
+        if (m.enabled)
+            mcpServers[name] = { command: m.command, args: m.args, env: m.env };
+    const files = c.features.files;
+    const fileRead = typeof files === 'boolean' ? files : files?.read ?? false;
+    const fileWrite = typeof files === 'boolean' ? files : files?.write ?? false;
+    const fileDelete = typeof files === 'boolean' ? files : files?.delete ?? false;
+    const shell = process.env.LOCALMCP_SHELL !== undefined ? process.env.LOCALMCP_SHELL === '1' : c.features.shell ?? false;
+    const processes = (c.features.processes ?? false) && shell;
+    // Existing configs with configured MCP servers retain the capability unless they explicitly disable it.
+    const externalMcp = c.features.externalMcp ?? Object.keys(mcpServers).length > 0;
+    return {
+        root, workspaces, defaultWorkspace,
+        files: fileRead || fileWrite || fileDelete,
+        fileRead, fileWrite, fileDelete,
+        shell, processes, externalMcp,
+        port, token: process.env.LOCALMCP_TOKEN,
+        skillsDir: resolve(loaded.base, c.skills.dir), enabledSkills: c.skills.enabled,
+        mcpServers, configFile: loaded.path
+    };
+}

package/dist/control-endpoint.js

@@ -0,0 +1,13 @@
+import { createHash } from 'node:crypto';
+import { resolve, win32 } from 'node:path';
+export function controlEndpoint(directory, platform = process.platform) {
+    if (platform === 'win32') {
+        // Named pipes have a flat namespace. Normalize aliases and keep the name
+        // short and deterministic so CLI and Agent agree for each user directory.
+        const key = win32.resolve(directory).toLowerCase();
+        const id = createHash('sha256').update(key).digest('hex').slice(0, 32);
+        return { address: `\\\\.\\pipe\\localmcp-${id}` };
+    }
+    const socketFile = resolve(directory, 'agent.sock');
+    return { address: socketFile, socketFile };
+}