local-mcp 3.0.114 → 3.0.116

package/download.js

@@ -439,4 +439,50 @@ async function ensureHelper() {
   }
 }
 
-module.exports = { ensureBinary, ensureRuntime, ensureTray, ensureTeamsProxy, ensureSlackProxy, ensureHelper, CACHE_DIR, TRAY_DIR }
+/**
+ * Downloads local-mcp-jxa-runner on first install only.
+ * CRITICAL: never replaces an existing jxa-runner binary — the runner owns
+ * Automation (JXA) TCC grants for Mail, Messages, Safari, etc. via its cdhash.
+ * Replacing the binary silently resets those grants and users would have to
+ * re-authorize in System Settings → Privacy & Security → Automation.
+ * @returns {Promise<string|null>} Path to the binary, or null if it fails
+ */
+async function ensureJXARunner() {
+  const binPath = path.join(CACHE_DIR, 'local-mcp-jxa-runner')
+
+  // Already installed — never replace. Stable cdhash = stable TCC grants.
+  if (fs.existsSync(binPath)) return binPath
+
+  const info = await getLatestBinary()
+  const version = info.version
+  const arch = process.arch === 'arm64' ? 'darwin-arm64' : 'darwin-x64'
+  const url = `https://download.local-mcp.com/local-mcp-jxa-runner-${version}-${arch}.tar.gz`
+  process.stderr.write(`\nDownloading local-mcp-jxa-runner v${version}...\n`)
+
+  fs.mkdirSync(CACHE_DIR, { recursive: true })
+  const tarPath = path.join(CACHE_DIR, `local-mcp-jxa-runner-${version}.tar.gz`)
+
+  try {
+    await downloadFile(url, tarPath)
+    const stat = fs.statSync(tarPath)
+    if (stat.size < 1000) { fs.unlinkSync(tarPath); throw new Error(`Incomplete download (${stat.size} bytes)`) }
+
+    execFileSync('tar', ['-xzf', tarPath, '-C', CACHE_DIR], { stdio: 'pipe' })
+    fs.unlinkSync(tarPath)
+
+    if (!fs.existsSync(binPath)) throw new Error('local-mcp-jxa-runner not found after extraction')
+    fs.chmodSync(binPath, 0o755)
+    // Do NOT codesign: the pre-built binary's cdhash must remain exactly as
+    // distributed so the Automation TCC entry stays valid permanently.
+
+    fs.writeFileSync(path.join(CACHE_DIR, '.jxa-runner-version'), version, 'utf8')
+    process.stderr.write(`  local-mcp-jxa-runner installed at ${binPath}\n`)
+    return binPath
+  } catch (err) {
+    try { if (fs.existsSync(tarPath)) fs.unlinkSync(tarPath) } catch {}
+    process.stderr.write(`  (local-mcp-jxa-runner not available: ${err.message})\n`)
+    return null
+  }
+}
+
+module.exports = { ensureBinary, ensureRuntime, ensureTray, ensureTeamsProxy, ensureSlackProxy, ensureHelper, ensureJXARunner, CACHE_DIR, TRAY_DIR }

package/index.js

@@ -103,10 +103,11 @@ async function main() {
         : ''
       if (cachedVersion && semverGte(cachedVersion, pkg.version)) {
         // Cached binary is same or newer — use fast path, no download needed
-        const { ensureTray, ensureTeamsProxy, ensureHelper } = require('./download')
+        const { ensureTray, ensureTeamsProxy, ensureHelper, ensureJXARunner } = require('./download')
         ensureTray().catch(() => {})
         ensureTeamsProxy().catch(() => {})
         ensureHelper().catch(() => {})
+        ensureJXARunner().catch(() => {})
         const child = spawn(stableBin, [], { stdio: 'inherit', env: process.env })
         child.on('error', () => process.exit(1))
         child.on('exit', (code) => process.exit(code ?? 0))
@@ -162,12 +163,13 @@ async function main() {
   }
 
   // Slow path: download/repair binary
-  const { ensureRuntime, ensureTray, ensureTeamsProxy, ensureHelper } = require('./download')
+  const { ensureRuntime, ensureTray, ensureTeamsProxy, ensureHelper, ensureJXARunner } = require('./download')
 
-  // Update tray + proxies in background. Helper is downloaded only on first install.
+  // Update tray + proxies in background. Helper + jxa-runner downloaded only on first install.
   ensureTray().catch(() => {})
   ensureTeamsProxy().catch(() => {})
   ensureHelper().catch(() => {})
+  ensureJXARunner().catch(() => {})
 
   let runtime
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "local-mcp",
-  "version": "3.0.114",
+  "version": "3.0.116",
   "description": "LMCP — connect Claude Desktop, Cursor, Windsurf to Mail, Calendar, Contacts, Teams, OneDrive on macOS. Privacy-first: all data stays on your Mac.",
   "main": "index.js",
   "bin": {