local-mcp 3.0.413 → 3.0.414

package/README.md

@@ -1,14 +1,14 @@
 # Local MCP
 
-> **The only Mac MCP you can use from ChatGPT & Claude.ai on the web** — plus 188+ local tools for Claude Desktop, Cursor, Windsurf, VS Code & Zed. Connect any AI to Mail, Calendar, Contacts, iMessage, Teams, Slack, WhatsApp, Signal, OneDrive, Google Drive, Microsoft 365, Notes, Reminders, OmniFocus, Word/Excel/PowerPoint and more. 100% local, no API keys, free — your data never leaves your machine.
+> **Use your Mac from ChatGPT & Claude.ai on the web** — plus 191+ local tools for Claude Desktop, Cursor, Windsurf, VS Code & Zed. Connect any AI to Mail, Calendar, Contacts, iMessage, Teams, Slack, WhatsApp, Signal, OneDrive, Google Drive, Microsoft 365, Notes, Reminders, OmniFocus, Word/Excel/PowerPoint and more. Runs on your computer, no API keys, free — local tools read your data on your machine, and your AI provider receives the content needed for each request.
 
 [![npm](https://img.shields.io/npm/v/local-mcp?style=flat-square&label=npm)](https://www.npmjs.com/package/local-mcp)
 [![macOS](https://img.shields.io/badge/macOS-13%2B-111111?style=flat-square)](https://local-mcp.com?ref=npm)
 [![Signed](https://img.shields.io/badge/Developer%20ID-notarized-111111?style=flat-square)](https://local-mcp.com?ref=npm)
-[![Privacy](https://img.shields.io/badge/data-stays%20on%20device-2e7d32?style=flat-square)](https://local-mcp.com/en/privacy)
+[![Privacy](https://img.shields.io/badge/tools-run%20locally-2e7d32?style=flat-square)](https://local-mcp.com/en/privacy)
 [![Glama](https://glama.ai/mcp/servers/lanchuske/local-mcp-releases/badge)](https://glama.ai/mcp/servers/lanchuske/local-mcp-releases?ref=npm)
 
-**No cloud. No tokens. No API keys. 100% free.**
+**Runs on your computer. No tokens. No API keys. Free.**
 
  
 
@@ -71,6 +71,7 @@ LMCP runs a native MCP server that bridges your Mac apps to any AI client:
 | **NordVPN** | Status, server recommendations, diagnostics |
 | **Image Playground** | Generate images on-device from a text prompt — Apple Intelligence, no cloud, no API key (requires macOS 15.4+) |
 | **Skills / Recipes** | Save a working multi-tool flow as a reusable skill, rerun it, **export to share with others & import theirs**, see run history, manage in Settings → Skills |
+| **Shortcuts** | List, run (preview → confirm), and inspect the user's own macOS Shortcuts — HomeKit, Focus modes, and any personal automation |
 
  
 
@@ -134,6 +135,8 @@ Agent mesh (9): `agent_mesh_status` `agent_mesh_create` `agent_mesh_invite` `age
 
 System (12): `lmcp_state` `get_config` `get_datetime` `daily_brief` `run_diagnostics` `get_audit_log` `lmcp_install_upgrade` `lmcp_upgrade_diagnostics` `report_problem` `request_feature` `report_friction` `run_terminal_command`
 
+Shortcuts (3): `shortcuts_list` `shortcuts_run` `shortcuts_view`
+
 _Coming soon (not included in the 162 count above): **Evernote** (support is being rebuilt)._
 
  

package/download.js

@@ -543,17 +543,86 @@ function _isUsableTrayBundle(trayApp) {
   catch { return false }
 }
 
+// Version compare mirroring mac-swift/Sources/LocalMCPServer/Version.swift's isNewer —
+// #3599 criterio 6: un mismo criterio "más nuevo gana" en los dos lados, cada uno probado
+// por separado (no hay código compartido entre Swift y Node). Incluye el mismo desempate
+// que Version.swift: en un empate numérico, un release gana a un pre-release
+// ("3.0.297" > "3.0.297-test").
+function _versionIsNewer(a, b) {
+  const parse = (v) => {
+    const s = String(v || '')
+    const nums = s.split(/[-+]/, 1)[0].split('.').map((n) => parseInt(n, 10) || 0)
+    return { nums, isPrerelease: s.includes('-') || s.includes('+') }
+  }
+  const pa = parse(a), pb = parse(b)
+  for (let i = 0; i < Math.max(pa.nums.length, pb.nums.length); i++) {
+    const x = pa.nums[i] || 0, y = pb.nums[i] || 0
+    if (x !== y) return x > y
+  }
+  if (pa.isPrerelease !== pb.isPrerelease) return !pa.isPrerelease && pb.isPrerelease
+  return false
+}
+
+const _CFBUNDLE_VERSION_RE = /<key>CFBundleShortVersionString<\/key>\s*<string>([^<]*)<\/string>/
+
+// CFBundleShortVersionString of an installed .app, or null when unreadable. Tries a plain
+// UTF8 text read FIRST — an xml1 plist (what every test fixture here writes, and what some
+// build toolchains leave on disk) needs no external tool and reads on ANY platform, unlike
+// `plutil` (macOS-only, absent on the ubuntu-latest runner these tests also run on, #3599
+// review). Only reaches for `plutil -convert xml1` when the direct read finds no match —
+// the real fallback for a genuinely binary-encoded Info.plist.
+function _bundleVersion(appPath, exec = execFileSync) {
+  const infoPath = path.join(appPath, 'Contents', 'Info.plist')
+  try {
+    const m = _CFBUNDLE_VERSION_RE.exec(fs.readFileSync(infoPath, 'utf8'))
+    if (m) return m[1]
+  } catch { /* missing, unreadable, or not text — fall through to plutil */ }
+  try {
+    const xml = exec('/usr/bin/plutil', ['-convert', 'xml1', '-o', '-', infoPath], { stdio: 'pipe' }).toString()
+    const m = _CFBUNDLE_VERSION_RE.exec(xml)
+    return m ? m[1] : null
+  } catch {
+    return null
+  }
+}
+
+// Whether a LocalMCPTray process is running FROM this exact bundle path — matched on the
+// full executable path so a sibling copy elsewhere never counts. Unreadable (pgrep
+// missing/blocked) fails CLOSED to "running": a guard that cannot see must not say "safe
+// to delete" (same rule as index.js's countRunningServers, #1394 §C).
+function _isTrayRunningFrom(appPath, exec = execFileSync) {
+  const bin = path.join(appPath, 'Contents', 'MacOS', 'LocalMCPTray')
+  try {
+    exec('pgrep', ['-f', bin], { stdio: 'pipe' })
+    return true   // exit 0: matched — a tray IS running from this bundle
+  } catch (err) {
+    if (err && err.status === 1) return false   // ran fine, matched nothing
+    return true                                  // could not tell — fail closed
+  }
+}
+
 // Retira las copias que `trayApp` supersede — SOLO si `trayApp` ya tiene un bundle usable.
 // Sin esa guarda, la migración borra la única copia que el Mac tiene antes de que exista su
 // reemplazo, y una descarga fallida deja la máquina sin cliente (#2654, hermano de #2643).
-// Devuelve lo retirado para que los tests puedan afirmar sobre el efecto, no sobre el orden.
-function _retireSupersededTrays(trayApp, supersededPaths, rm = _rmrf) {
+// #3599 AC5: tampoco retira una copia cuya versión no se pueda leer, ni una LEÍBLEMENTE más
+// nueva que `trayApp`, ni una que un proceso vivo esté sirviendo — mismo criterio fail-closed
+// que el lado Swift (TrayInstallHealth.shouldRemoveOtherCopy): no haber podido medir no es
+// haber medido que es seguro borrar. Devuelve lo retirado para que los tests puedan afirmar
+// sobre el efecto, no sobre el orden.
+function _retireSupersededTrays(trayApp, supersededPaths, rm = _rmrf,
+                                 bundleVersion = _bundleVersion,
+                                 isTrayRunningFrom = _isTrayRunningFrom) {
   if (!trayApp || !_isUsableTrayBundle(trayApp)) return []
+  const trayVersion = bundleVersion(trayApp)
   const retired = []
   for (const p of supersededPaths) {
     if (!p) continue
     if (_sameLocation(p, trayApp)) continue
     if (!fs.existsSync(p)) continue
+    const otherVersion = bundleVersion(p)
+    if (!trayVersion || !otherVersion) continue          // unreadable — fail closed, keep it
+    if (_versionIsNewer(otherVersion, trayVersion)) continue
+    if (isTrayRunningFrom(p)) continue
     try { rm(p); retired.push(p) } catch { /* ignorar */ }
   }
   return retired
@@ -588,6 +657,8 @@ async function ensureTray(deps = {}) {
     extract          = extractTar,
     writeLaunchAgent = _writeTrayLaunchAgent,
     isTTY            = () => process.stdin.isTTY,
+    bundleVersion    = _bundleVersion,
+    isTrayRunningFrom = _isTrayRunningFrom,
   } = deps
 
   // Windows/Linux: the tray + background daemon are installed by the native
@@ -608,36 +679,28 @@ async function ensureTray(deps = {}) {
   ]
   if (markers.some((p) => { try { return fs.existsSync(p) } catch { return false } })) return null
 
+  // #3627: a usable tray ANYWHERE a user would look (/Applications or ~/Applications) is this
+  // wrapper's stop condition, at ANY version — keeping it current from here on is the tray's
+  // own job (UpdateManager: staged, verified, self-update). This used to fall through to a
+  // download+"migrate" that moved a same-version /Applications copy to ~/Applications and
+  // deleted the original; on the published 3.0.413 wrapper (no version/process guard on the
+  // delete) that reproduced with a fresh DMG install too, not just the QA prerelease that
+  // surfaced it (#3627, #3599). A bundle that exists but fails `_isUsableTrayBundle` (a
+  // partial extraction, #1338) is NOT covered — that still needs repairing below.
+  if (_isUsableTrayBundle(trayApp)) return trayApp
+  if (_isUsableTrayBundle(systemTrayApp)) return systemTrayApp
+
   const info     = await getLatest()
   const version  = info.version
   const verFile  = path.join(trayDir, '.version')
 
-  // Las dos migraciones —~/.local/share (legacy) y /Applications → ~/Applications (evita el
-  // diálogo App Management)— retiran una copia que puede ser la ÚNICA del Mac. Por eso el
-  // retiro corre en exactamente dos lugares: pegado a cada early-return (no se instala nada,
-  // el tray de destino ya está verificado) y después de extraer y verificar. Nunca en el
-  // camino que descarga: ahí una falla dejaba la máquina sin cliente. (#2654)
+  // La migración legacy (~/.local/share → ~/Applications) retira una copia que puede ser la
+  // ÚNICA del Mac — nunca en el camino que descarga: ahí una falla dejaba la máquina sin
+  // cliente. (#2654) Reached only when neither main location has a usable bundle (guard
+  // above), so `systemTrayApp` in this list is a stale/broken leftover, never a live one.
   const superseded = [path.join(trayDir, 'LocalMCPTray.app'), systemTrayApp]
-  const retireSuperseded = () => _retireSupersededTrays(trayApp, superseded)
-
-  // Ya instalado y actualizado. "Instalado" es el bundle USABLE, no el directorio: si no,
-  // una extracción a medias se early-returnea para siempre y nadie la repara (#1338).
-  if (_isUsableTrayBundle(trayApp) && fs.existsSync(verFile)) {
-    if (fs.readFileSync(verFile, 'utf8').trim() === version) {
-      retireSuperseded()
-      return trayApp
-    }
-  }
-
-  // In an active MCP session (non-TTY) the tray is running and self-updates via UpdateManager.
-  // Downloading a new tray bundle and rm-rf'ing the old one mid-session kills the Unix socket
-  // that local-mcp-server uses, crashing the session. Skip the update; it'll apply next login.
-  // Un bundle sin ejecutable no tiene tray corriendo que esta descarga pueda romper, así que
-  // ese caso NO se early-returnea: se repara.
-  if (!isTTY() && _isUsableTrayBundle(trayApp)) {
-    retireSuperseded()
-    return trayApp
-  }
+  const retireSuperseded = () =>
+    _retireSupersededTrays(trayApp, superseded, _rmrf, bundleVersion, isTrayRunningFrom)
 
   const url = `https://download.local-mcp.com/local-mcp-tray-${version}-darwin-universal.tar.gz`
   process.stderr.write(`\nDescargando tray v${version}...\n`)
@@ -668,8 +731,8 @@ async function ensureTray(deps = {}) {
   extract(tarPath, userAppsDir)
   fs.unlinkSync(tarPath)
 
-  // Mismo criterio que usa el retiro, o se estampa .version sobre un bundle roto y el
-  // early-return de arriba lo da por bueno en cada corrida siguiente.
+  // Mismo criterio que usa el guard de arriba y el retiro — un directorio sin ejecutable no
+  // cuenta como instalado, o `verFile` (abajo) queda apuntando a un bundle que no sirve.
   if (!_isUsableTrayBundle(trayApp)) {
     throw new Error(`Tray no usable tras extraer: ${trayApp}`)
   }
@@ -794,4 +857,5 @@ module.exports = {
   _probeWinHardwareId, _resetWinHardwareIdCacheForTests,
   _readWinMachineIdCache, _writeWinMachineIdCache, WIN_MACHINE_ID_CACHE_NAME,
   _retireSupersededTrays, _isUsableTrayBundle, SYSTEM_TRAY_APP,
+  _bundleVersion, _isTrayRunningFrom, _versionIsNewer,
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "local-mcp",
-  "version": "3.0.413",
+  "version": "3.0.414",
   "description": "Let ChatGPT, Claude, Cursor & any MCP client actually use your Mac or Windows PC — read & reply to email, manage your calendar, text over iMessage, find files, work with Teams, Slack & Office. Runs locally, no API keys, free.",
   "main": "index.js",
   "bin": {
@@ -64,14 +64,14 @@
     "automation"
   ],
   "author": "LMCP <hello@local-mcp.com>",
-  "license": "SEE LICENSE IN LICENSE",
+  "license": "UNLICENSED",
   "homepage": "https://local-mcp.com",
   "repository": {
     "type": "git",
-    "url": "https://github.com/colibird-ai/local-mcp.git"
+    "url": "https://github.com/lanchuske/local-mcp-releases.git"
   },
   "bugs": {
-    "url": "https://github.com/colibird-ai/local-mcp/issues"
+    "url": "https://github.com/lanchuske/local-mcp-releases/issues"
   },
   "mcpName": "com.local-mcp/local-mcp"
 }

package/setup.js

@@ -530,7 +530,7 @@ async function runSetup(opts = {}) {
   if (configured.length > 0) {
     if (healthOk) {
       console.log(`✅ LMCP configured for: ${configured.join(', ')}\n`)
-      console.log('  ✓ Server binary verified — 188+ tools ready\n')
+      console.log('  ✓ Server binary verified — 191+ tools ready\n')
     } else {
       console.log(`⚠  LMCP configured for: ${configured.join(', ')}`)
       console.log('  Server binary could not be verified — it may still work after restart.\n')