local-mcp 3.0.148 → 3.0.149

package/download.js

@@ -45,7 +45,7 @@ function _getMachineId() {
     try {
       const ioreg = execSync('ioreg -rd1 -c IOPlatformExpertDevice', { stdio: 'pipe' }).toString()
       const match = ioreg.match(/"IOPlatformUUID"\s*=\s*"([^"]+)"/)
-      return match ? match[1] : os.hostname()
+      if (match) return match[1]
     } catch {}
   } else if (process.platform === 'win32') {
     try {
@@ -59,7 +59,9 @@ function _getMachineId() {
       if (mid) return mid
     } catch {}
   }
-  return os.hostname()
+  // Fallback: hash hostname instead of sending raw PII
+  const crypto = require('crypto')
+  return crypto.createHash('sha256').update(os.hostname()).digest('hex').slice(0, 16)
 }
 
 function getArch() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "local-mcp",
-  "version": "3.0.148",
+  "version": "3.0.149",
   "description": "LMCP — connect Claude Desktop, Cursor, Windsurf to Mail, Calendar, Contacts, Teams, OneDrive on macOS. Privacy-first: all data stays on your Mac.",
   "main": "index.js",
   "bin": {

package/setup.js

@@ -749,7 +749,8 @@ function _getMachineId() {
     // Generate from hardware UUID (full UUID, same format as Swift server)
     const ioreg = execSync('ioreg -rd1 -c IOPlatformExpertDevice', { stdio: 'pipe' }).toString()
     const match = ioreg.match(/"IOPlatformUUID"\s*=\s*"([^"]+)"/)
-    const id = match ? match[1] : require('os').hostname()
+    if (!match) return ''  // No hostname fallback — avoid PII leak
+    const id = match[1]
     // Save to Keychain for Swift server to read
     try { execSync(`security add-generic-password -s com.local-mcp.machine-id -a machine-id -w "${id}" -U 2>/dev/null`, { stdio: 'pipe' }) } catch {}
     return id