local-mcp 3.0.419 → 3.0.420

package/README.md

@@ -8,7 +8,7 @@
 [![Privacy](https://img.shields.io/badge/tools-run%20locally-2e7d32?style=flat-square)](https://local-mcp.com/en/privacy)
 [![Glama](https://glama.ai/mcp/servers/colibird-ai/local-mcp-releases/badge)](https://glama.ai/mcp/servers/colibird-ai/local-mcp-releases?ref=npm)
 
-**Runs on your computer. No tokens. No API keys. Free.**
+**Runs on your computer. No tokens. No API keys.**
 
  
 

package/download.js

@@ -5,8 +5,7 @@
  * Cache: ~/.local/share/local-mcp/bin/{version}/
  */
 
-const https  = require('https')
-const http   = require('http')
+const { https, http } = require('./user-agent')
 const fs     = require('fs')
 const path   = require('path')
 const os     = require('os')
@@ -543,20 +542,37 @@ async function ensureRuntime() {
   return { pythonBin: binPath, serverPath: binPath, runtimeDir: versionDir, binPath, version }
 }
 
+/**
+ * The version a co-process is published at (lmcp-mac#382). `/runtime/latest` names it apart from
+ * the server's (`coprocess_version`, #3598); the Mac updater installs exactly that one and writes
+ * the same `.<name>-version` file. Asking for `version` instead made the two writers disagree
+ * whenever the two differ, and each re-downloaded what the other had just written.
+ */
+function coprocessVersion(info) {
+  const cp = info && info.coprocess_version
+  return typeof cp === 'string' && /^[0-9][0-9A-Za-z.+-]*$/.test(cp) ? cp : info.version
+}
+
 /**
  * Descarga el co-proceso teams-proxy si no está instalado o es una versión diferente.
  * El binary se instala en ~/.local/share/local-mcp/bin/teams-proxy
+ *
+ * lmcp-mac#382: not when the tray app is installed. The tray's updater owns teams-proxy (it
+ * verifies its digest and Developer ID; this does not), and trays 3.0.418-3.0.419 delete it every
+ * update cycle: npx put it back on every spawn — 140 addresses downloaded it 5-49 times a day.
  * @returns {Promise<string|null>} Ruta al binary, o null si falla
  */
-async function ensureTeamsProxy(platform = process.platform) {
+async function ensureTeamsProxy(platform = process.platform, deps = {}) {
+  const { trayApps = [TRAY_APP, SYSTEM_TRAY_APP] } = deps
   // Only published for darwin (darwin-arm64/darwin-x64 artifacts) — mirrors the
   // guard ensureTray() already has. Without it, every Windows/Linux install fired
   // a doomed download attempt and printed a confusing "not available" error (#1390).
   // platform is a parameter (default process.platform) so the guard is testable
   // without a network mock — same pattern as _writeLaunchScript's isWin.
   if (platform !== 'darwin') return null
+  if (trayApps.some(app => app && _isUsableTrayBundle(app))) return null
   const info = await getLatestBinary()
-  const version = info.version
+  const version = coprocessVersion(info)
   const arch = process.arch === 'arm64' ? 'darwin-arm64' : 'darwin-x64'
   const binPath = path.join(CACHE_DIR, 'teams-proxy')
   const verFile = path.join(CACHE_DIR, '.teams-proxy-version')
@@ -874,7 +890,7 @@ async function ensureSlackProxy(platform = process.platform) {
   // without a network mock — same pattern as _writeLaunchScript's isWin.
   if (platform !== 'darwin') return null
   const info = await getLatestBinary()
-  const version = info.version
+  const version = coprocessVersion(info)   // lmcp-mac#382: the same version the tray installs
   const arch = process.arch === 'arm64' ? 'darwin-arm64' : 'darwin-x64'
   const binPath = path.join(CACHE_DIR, 'slack-proxy')
   const verFile = path.join(CACHE_DIR, '.slack-proxy-version')
@@ -918,7 +934,7 @@ async function ensureSlackProxy(platform = process.platform) {
 }
 
 module.exports = {
-  ensureBinary, ensureRuntime, ensureTray, ensureTeamsProxy, ensureSlackProxy, versionFromArtifactUrl,
+  ensureBinary, ensureRuntime, ensureTray, ensureTeamsProxy, ensureSlackProxy, versionFromArtifactUrl, coprocessVersion,
   latestVersionForPlatform, getArch,
   CACHE_DIR, TRAY_DIR, _getMachineId, LINUX_NO_SOPORTADO,
   _probeWinHardwareId, _resetWinHardwareIdCacheForTests, UUIDS_DE_HARDWARE_BASURA, _esIdDeHardwareValido,

package/index.js

@@ -16,7 +16,7 @@ const { spawn, execFileSync, execSync } = require('child_process')
 const path  = require('path')
 const os    = require('os')
 const fs    = require('fs')
-const https = require('https')
+const { https } = require('./user-agent')
 const evento = require('./launch-event')
 
 // ── Version + liveness helpers (module scope so they are testable) ────────────
@@ -405,6 +405,25 @@ async function main() {
     // copy and the durable App Support copy (see uninstallSentinelPaths).
     writeUninstallSentinels()
 
+    // #48 (2): quitar la entrada de los clientes de IA que se alcanzan (mismo catálogo que el setup);
+    // lo que no se puede tocar se dice. Sin catálogo (sin red) se dice también, no se adivina.
+    try {
+      const { unconfigureClients } = require('./unconfigure')
+      const catalogFile = process.env.LMCP_CLIENTS_CATALOG_FILE
+      const catalog = catalogFile
+        ? JSON.parse(fs.readFileSync(catalogFile, 'utf8'))
+        : await require('./setup')._fetchClientsCatalog()
+      if (!catalog) {
+        console.log('No se pudo leer el catálogo de clientes: las entradas "local-mcp" de tus clientes de IA quedan; quitalas a mano.')
+      } else {
+        const r = unconfigureClients(catalog)
+        for (const x of r.removed) console.log(`Entrada local-mcp eliminada de ${x.client}: ${x.file}`)
+        for (const x of r.left) console.log(`Dejada en ${x.client}${x.file ? ' (' + x.file + ')' : ''}: ${x.reason}; quitá "local-mcp" a mano.`)
+      }
+    } catch (e) {
+      console.log('No se pudieron quitar las entradas de los clientes de IA: ' + e.message)
+    }
+
     if (fs.existsSync(CACHE_DIR)) {
       fs.rmSync(CACHE_DIR, { recursive: true, force: true })
       console.log(`Runtime eliminado de ${CACHE_DIR}`)

package/launch-event.js

@@ -13,7 +13,7 @@
 //   · demorar el arranque del server o una salida — sin reintentos, timeout corto, todo error
 //     tragado;
 //   · mandar algo que no sea uno de los cinco campos: ni el argumento, ni rutas, ni entorno.
-const https = require('https')
+const { https } = require('./user-agent')
 const cp = require('child_process')
 const DESTINO = { hostname: 'office-mcp-production.up.railway.app', path: '/launch-event' }
 const PLATAFORMAS = ['darwin', 'win32', 'linux', 'other']

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "local-mcp",
-  "version": "3.0.419",
+  "version": "3.0.420",
   "description": "Let ChatGPT, Claude, Cursor & any MCP client actually use your Mac or Windows PC — read & reply to email, manage your calendar, text over iMessage, find files, work with Teams, Slack & Office. Runs locally, no API keys, free.",
   "main": "index.js",
   "bin": {
@@ -15,6 +15,8 @@
     "download.js",
     "setup.js",
     "launch-event.js",
+    "user-agent.js",
+    "unconfigure.js",
     "postinstall.js",
     "README.md"
   ],

package/setup.js

@@ -67,7 +67,7 @@ function _writeLaunchScript(npxAbsPath, cacheDir, isWin = _IS_WIN) {
       'NODE_MAJOR=$(echo "$NODE_VER" | sed \'s/v//\' | cut -d. -f1)',
       'if [ "${NODE_MAJOR:-0}" -lt 16 ] 2>/dev/null; then',
       '  # curl telemetry — no Node dependency, fire-and-forget',
-      `  curl -sf --max-time 3 -X POST "https://${BACKEND_HOST}/install-event" \\`,
+      `  curl -sf --max-time 3 -A "LMCP-npm (launcher)" -X POST "https://${BACKEND_HOST}/install-event" \\`,
       '    -H "Content-Type: application/json" \\',
       '    -d "{\\\"stage\\\":\\\"node_too_old\\\",\\\"version\\\":\\\"$NODE_VER\\\"}" &>/dev/null &',
       '  printf \'LMCP requires Node 16+. Current: %s\\nFix: nvm alias default 22 && nvm uninstall %s — then restart Claude Desktop.\\n\' "$NODE_VER" "$NODE_VER" >&2',
@@ -328,7 +328,7 @@ async function runSetup(opts = {}) {
   const _preToken = process.env.LMCP_PRE_TOKEN || ''
   if (_preToken.startsWith('lmcp-pre-')) {
     try {
-      const https = require('https')
+      const { https } = require('./user-agent')
       const req = https.request({
         hostname: BACKEND_HOST,
         path: `/install/started/${_preToken}`,
@@ -819,7 +819,7 @@ function _getMachineId() {
 async function _associateEmail(email, token) {
   return new Promise((resolve) => {
     try {
-      const https = require('https')
+      const { https } = require('./user-agent')
       const payload = JSON.stringify({
         stage: 'email_prompt',
         email_prompt_result: 'submitted',
@@ -892,7 +892,7 @@ function _writeCloudToken(cacheDir, token) {
 /// treat failure as non-fatal and fall through to the email-based path.
 async function _registerAnonToken() {
   return new Promise((resolve) => {
-    const https = require('https')
+    const { https } = require('./user-agent')
     const machineId = _getMachineId()
     const payload = JSON.stringify({ machine_id: machineId })
     const req = https.request({
@@ -951,7 +951,7 @@ function _migrateCurlLaunchAgent() {
 
 function _trackSetupStep(step, status, client, detail) {
   try {
-    const https = require('https')
+    const { https } = require('./user-agent')
     const payload = {
       machine_id:  _getMachineId(),
       install_id:  process.env.INSTALL_ID || '',
@@ -989,7 +989,7 @@ function _trackSetupStep(step, status, client, detail) {
 
 function _trackConfigWritten(clientId, clientName) {
   try {
-    const https = require('https')
+    const { https } = require('./user-agent')
     const machineId = _getMachineId()
     const data = JSON.stringify({
       stage: 'config_written',
@@ -1015,7 +1015,7 @@ function _trackConfigWritten(clientId, clientName) {
 
 function _trackRestartPrompted(clientName) {
   try {
-    const https = require('https')
+    const { https } = require('./user-agent')
     const machineId = _getMachineId()
     const payload = {
       stage: 'restart_prompted',
@@ -1040,7 +1040,7 @@ function _trackRestartPrompted(clientName) {
 
 function _pingInstall(clients, method, email = '', binaryVersion = '') {
   try {
-    const https = require('https')
+    const { https } = require('./user-agent')
     const pkg    = require('./package.json')
     const machineId = _getMachineId()
     // Persist the attribution ref so the server reports it on every heartbeat —
@@ -1133,7 +1133,7 @@ function _pingInstall(clients, method, email = '', binaryVersion = '') {
 // callers treat that as "don't launch anything," never as an error.
 function _fetchClientsCatalog(totalMs = 4000) {
   return new Promise((resolve) => {
-    const https = require('https')
+    const { https } = require('./user-agent')
     const req = https.request({
       hostname: BACKEND_HOST, path: '/clients/catalog', method: 'GET', timeout: totalMs,
     }, (res) => {

package/unconfigure.js

@@ -0,0 +1,101 @@
+'use strict'
+// #48 (2): `npx local-mcp uninstall` quita la entrada `local-mcp` de las configs de los clientes de IA
+// que puede alcanzar, con el MISMO catálogo que usa el setup (nada de lista de clientes aquí). Sin esto
+// el cliente sigue lanzando el wrapper en cada arranque contra una máquina ya desinstalada.
+//
+// Sólo toca lo que puede deshacer sin riesgo: JSON estándar (cfgSchema mcpServers / servers /
+// context_servers) y sólo la clave `local-mcp` dentro de ese objeto. Lo demás (TOML/YAML, esquemas
+// propios, JSON con comentarios o inválido, comodines sin carpeta) no se reescribe: se devuelve en
+// `left` con el motivo, para que el comando diga qué dejó.
+const fs = require('fs')
+const os = require('os')
+const path = require('path')
+
+const ENTRY = 'local-mcp'
+const KEY_BY_SCHEMA = { mcpServers: 'mcpServers', servers: 'servers', context_servers: 'context_servers' }
+
+function _expand(p, env) {
+  return p
+    .replace(/^~(?=[\\/]|$)/, env.home)
+    .replace(/%APPDATA%/g, env.appData)
+    .replace(/%LOCALAPPDATA%/g, env.localAppData)
+}
+
+// Un `*` sólo vale dentro de UN segmento; se resuelve contra el disco.
+function _glob(p) {
+  if (!p.includes('*')) return [p]
+  const parts = p.split(/[\\/]/)
+  let bases = [parts[0] === '' ? path.sep : parts[0]]
+  for (const seg of parts.slice(1)) {
+    const next = []
+    for (const b of bases) {
+      if (!seg.includes('*')) { next.push(path.join(b, seg)); continue }
+      const re = new RegExp('^' + seg.replace(/[.+?^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*') + '$')
+      let names = []
+      try { names = fs.readdirSync(b) } catch {}
+      for (const n of names) if (re.test(n)) next.push(path.join(b, n))
+    }
+    bases = next
+  }
+  return bases
+}
+
+function _paths(client, plat, env) {
+  const platform = (client.platforms || {})[plat]
+  if (!platform || !Array.isArray(platform.cfgPaths)) return []
+  const hosts = Array.isArray(platform.hosts) && platform.hosts.length ? platform.hosts : [null]
+  const out = []
+  for (const raw of platform.cfgPaths) {
+    for (const h of hosts) {
+      const withHost = h === null ? raw : raw.replace(/\{host\}/g, h)
+      if (withHost.includes('{host}')) continue
+      for (const f of _glob(_expand(withHost, env))) if (!out.includes(f)) out.push(f)
+    }
+  }
+  return out
+}
+
+function _writeAtomic(file, data) {
+  const tmp = file + '.lmcp-tmp'
+  fs.writeFileSync(tmp, JSON.stringify(data, null, 2) + '\n', 'utf8')
+  fs.renameSync(tmp, file)
+}
+
+/**
+ * @param {object} catalog  el catálogo servido (`clients[]`).
+ * @param {object} [opts]   platform, home, appData, localAppData (para probar sin tocar el disco real).
+ * @returns {{removed: {client:string,file:string}[], left: {client:string,file?:string,reason:string}[]}}
+ */
+function unconfigureClients(catalog, opts = {}) {
+  const home = opts.home || os.homedir()
+  const platform = opts.platform || process.platform
+  const env = {
+    home,
+    appData: opts.appData || process.env.APPDATA || path.join(home, 'AppData', 'Roaming'),
+    localAppData: opts.localAppData || process.env.LOCALAPPDATA || path.join(home, 'AppData', 'Local'),
+  }
+  const plat = platform === 'darwin' ? 'macos' : platform === 'win32' ? 'windows' : null
+  const removed = []
+  const left = []
+  if (!plat || !catalog || !Array.isArray(catalog.clients)) return { removed, left }
+  for (const c of catalog.clients) {
+    const files = _paths(c, plat, env).filter((f) => { try { return fs.statSync(f).isFile() } catch { return false } })
+    for (const file of files) {
+      const key = KEY_BY_SCHEMA[c.cfgSchema]
+      if (!key) { left.push({ client: c.id, file, reason: 'schema ' + c.cfgSchema }); continue }
+      let data
+      try { data = JSON.parse(fs.readFileSync(file, 'utf8')) } catch {
+        left.push({ client: c.id, file, reason: 'not plain JSON' }); continue
+      }
+      const block = data && typeof data === 'object' ? data[key] : null
+      if (!block || typeof block !== 'object' || !(ENTRY in block)) continue
+      delete block[ENTRY]
+      try { _writeAtomic(file, data); removed.push({ client: c.id, file }) } catch (e) {
+        left.push({ client: c.id, file, reason: e.message })
+      }
+    }
+  }
+  return { removed, left }
+}
+
+module.exports = { unconfigureClients }

package/user-agent.js

@@ -0,0 +1,40 @@
+'use strict'
+// Every outbound HTTP request from npx carries `User-Agent: LMCP-npm/<version> (<platform>)`.
+// Node sends none by default, and an empty-UA download of a binary from a fresh process looks
+// like malware to a security gateway. Drop-in `https`/`http` wrappers: same signatures,
+// the header is added unless the caller already set one. Resolve `request`/`get` at call time.
+const https = require('https')
+const http = require('http')
+
+let VERSION = '0'
+try { VERSION = require('./package.json').version || '0' } catch {}
+
+function userAgent (platform = process.platform) {
+  return `LMCP-npm/${VERSION} (${platform})`
+}
+
+function conUA (opts) {
+  const o = { ...(opts || {}) }
+  const h = { ...(o.headers || {}) }
+  if (!Object.keys(h).some((k) => k.toLowerCase() === 'user-agent')) h['User-Agent'] = userAgent()
+  o.headers = h
+  return o
+}
+
+function envolver (mod) {
+  return {
+    request (opts, cb) {
+      if (typeof opts === 'string' || opts instanceof URL) return mod.request(opts, conUA({}), cb)
+      return mod.request(conUA(opts), cb)
+    },
+    get (url, opts, cb) {
+      if (typeof url === 'string' || url instanceof URL) {
+        if (typeof opts === 'function') return mod.get(url, conUA({}), opts)
+        return mod.get(url, conUA(opts), cb)
+      }
+      return mod.get(conUA(url), typeof opts === 'function' ? opts : cb)
+    }
+  }
+}
+
+module.exports = { userAgent, conUA, https: envolver(https), http: envolver(http) }