local-mcp 3.0.419 → 3.0.421

package/README.md

@@ -1,14 +1,14 @@
 # Local MCP
 
-> **Use your Mac from ChatGPT & Claude.ai on the web** — plus 192+ local tools for Claude Desktop, Cursor, Windsurf, VS Code & Zed. Connect any AI to Mail, Calendar, Contacts, iMessage, Teams, Slack, WhatsApp, Signal, OneDrive, Google Drive, Microsoft 365, Notes, Reminders, OmniFocus, Word/Excel/PowerPoint and more. Runs on your computer, no API keys, free — local tools read your data on your machine, and your AI provider receives the content needed for each request.
+> **Use your Mac or Windows PC from ChatGPT & Claude.ai on the web** — plus local tools for Claude Desktop, Cursor, Windsurf, VS Code & Zed. Connect any AI to Mail, Calendar, Contacts, iMessage, Teams, Slack, WhatsApp, Signal, OneDrive, Google Drive, Notion, Microsoft 365, Notes, Reminders, OmniFocus, Word/Excel/PowerPoint and more. Runs on your computer, no API keys — local tools read your data on your machine, and your AI provider receives the content needed for each request.
 
 [![npm](https://img.shields.io/npm/v/local-mcp?style=flat-square&label=npm)](https://www.npmjs.com/package/local-mcp)
-[![macOS](https://img.shields.io/badge/macOS-13%2B-111111?style=flat-square)](https://local-mcp.com?ref=npm)
+[![Platform](https://img.shields.io/badge/platform-macOS%2013%2B%20%7C%20Windows%2010%2B-111111?style=flat-square)](https://local-mcp.com?ref=npm)
 [![Signed](https://img.shields.io/badge/Developer%20ID-notarized-111111?style=flat-square)](https://local-mcp.com?ref=npm)
 [![Privacy](https://img.shields.io/badge/tools-run%20locally-2e7d32?style=flat-square)](https://local-mcp.com/en/privacy)
 [![Glama](https://glama.ai/mcp/servers/colibird-ai/local-mcp-releases/badge)](https://glama.ai/mcp/servers/colibird-ai/local-mcp-releases?ref=npm)
 
-**Runs on your computer. No tokens. No API keys. Free.**
+**Runs on your computer. No tokens. No API keys.**
 
  
 
@@ -41,7 +41,7 @@ Auto-detects and configures Claude Desktop, Claude Code, Cursor, Windsurf, VS Co
 
 ## What it does
 
-LMCP runs a native MCP server that bridges your Mac apps to any AI client:
+LMCP runs a native MCP server that bridges the apps on your Mac or Windows PC to any AI client. Availability varies by platform:
 
 | Service | Capabilities |
 |---------|-------------|
@@ -137,8 +137,6 @@ System (12): `lmcp_state` `get_config` `get_datetime` `daily_brief` `run_diagnos
 
 Shortcuts (3): `shortcuts_list` `shortcuts_run` `shortcuts_view`
 
-_Coming soon (not included in the 162 count above): **Evernote** (support is being rebuilt)._
-
  
 
 ## Safety
@@ -165,7 +163,7 @@ Full policy: **[local-mcp.com/en/privacy](https://local-mcp.com/en/privacy)**.
 
 ## Requirements
 
-- macOS 13 Ventura or later (Apple Silicon and Intel)
+- macOS 13 Ventura or later (Apple Silicon and Intel), or Windows 10 or later (64-bit)
 - One of: Claude Desktop, Claude Code, Cursor, Windsurf, VS Code, Zed
 
 ### Config file locations

package/download.js

@@ -5,8 +5,7 @@
  * Cache: ~/.local/share/local-mcp/bin/{version}/
  */
 
-const https  = require('https')
-const http   = require('http')
+const { https, http } = require('./user-agent')
 const fs     = require('fs')
 const path   = require('path')
 const os     = require('os')
@@ -332,7 +331,7 @@ function downloadOnce(url, destPath) {
         }
         if (res.statusCode !== 200) {
           file.close()
-          fs.unlinkSync(destPath)
+          fs.rmSync(destPath, { force: true })
           return reject(new Error(`HTTP ${res.statusCode} descargando binario`))
         }
 
@@ -353,7 +352,7 @@ function downloadOnce(url, destPath) {
 
         res.pipe(file)
         file.on('finish', () => { file.close(); process.stderr.write('\n'); resolve() })
-        file.on('error', (err) => { fs.unlinkSync(destPath); reject(err) })
+        file.on('error', (err) => { fs.rmSync(destPath, { force: true }); reject(err) })
       }).on('error', reject)
     }
 
@@ -543,20 +542,37 @@ async function ensureRuntime() {
   return { pythonBin: binPath, serverPath: binPath, runtimeDir: versionDir, binPath, version }
 }
 
+/**
+ * The version a co-process is published at (lmcp-mac#382). `/runtime/latest` names it apart from
+ * the server's (`coprocess_version`, #3598); the Mac updater installs exactly that one and writes
+ * the same `.<name>-version` file. Asking for `version` instead made the two writers disagree
+ * whenever the two differ, and each re-downloaded what the other had just written.
+ */
+function coprocessVersion(info) {
+  const cp = info && info.coprocess_version
+  return typeof cp === 'string' && /^[0-9][0-9A-Za-z.+-]*$/.test(cp) ? cp : info.version
+}
+
 /**
  * Descarga el co-proceso teams-proxy si no está instalado o es una versión diferente.
  * El binary se instala en ~/.local/share/local-mcp/bin/teams-proxy
+ *
+ * lmcp-mac#382: not when the tray app is installed. The tray's updater owns teams-proxy (it
+ * verifies its digest and Developer ID; this does not), and trays 3.0.418-3.0.419 delete it every
+ * update cycle: npx put it back on every spawn — 140 addresses downloaded it 5-49 times a day.
  * @returns {Promise<string|null>} Ruta al binary, o null si falla
  */
-async function ensureTeamsProxy(platform = process.platform) {
+async function ensureTeamsProxy(platform = process.platform, deps = {}) {
+  const { trayApps = [TRAY_APP, SYSTEM_TRAY_APP] } = deps
   // Only published for darwin (darwin-arm64/darwin-x64 artifacts) — mirrors the
   // guard ensureTray() already has. Without it, every Windows/Linux install fired
   // a doomed download attempt and printed a confusing "not available" error (#1390).
   // platform is a parameter (default process.platform) so the guard is testable
   // without a network mock — same pattern as _writeLaunchScript's isWin.
   if (platform !== 'darwin') return null
+  if (trayApps.some(app => app && _isUsableTrayBundle(app))) return null
   const info = await getLatestBinary()
-  const version = info.version
+  const version = coprocessVersion(info)
   const arch = process.arch === 'arm64' ? 'darwin-arm64' : 'darwin-x64'
   const binPath = path.join(CACHE_DIR, 'teams-proxy')
   const verFile = path.join(CACHE_DIR, '.teams-proxy-version')
@@ -874,7 +890,7 @@ async function ensureSlackProxy(platform = process.platform) {
   // without a network mock — same pattern as _writeLaunchScript's isWin.
   if (platform !== 'darwin') return null
   const info = await getLatestBinary()
-  const version = info.version
+  const version = coprocessVersion(info)   // lmcp-mac#382: the same version the tray installs
   const arch = process.arch === 'arm64' ? 'darwin-arm64' : 'darwin-x64'
   const binPath = path.join(CACHE_DIR, 'slack-proxy')
   const verFile = path.join(CACHE_DIR, '.slack-proxy-version')
@@ -918,7 +934,7 @@ async function ensureSlackProxy(platform = process.platform) {
 }
 
 module.exports = {
-  ensureBinary, ensureRuntime, ensureTray, ensureTeamsProxy, ensureSlackProxy, versionFromArtifactUrl,
+  ensureBinary, ensureRuntime, ensureTray, ensureTeamsProxy, ensureSlackProxy, versionFromArtifactUrl, coprocessVersion,
   latestVersionForPlatform, getArch,
   CACHE_DIR, TRAY_DIR, _getMachineId, LINUX_NO_SOPORTADO,
   _probeWinHardwareId, _resetWinHardwareIdCacheForTests, UUIDS_DE_HARDWARE_BASURA, _esIdDeHardwareValido,

package/index.js

@@ -16,7 +16,7 @@ const { spawn, execFileSync, execSync } = require('child_process')
 const path  = require('path')
 const os    = require('os')
 const fs    = require('fs')
-const https = require('https')
+const { https } = require('./user-agent')
 const evento = require('./launch-event')
 
 // ── Version + liveness helpers (module scope so they are testable) ────────────
@@ -268,11 +268,22 @@ function reportarLanzamiento(outcome, opciones) {
   if (ES_LANZAMIENTO) evento.reportar(outcome, evento.claseDeArgumento(cmd), opciones)
 }
 // Antes que nada: un `spawned` que en Windows esperaba su id sale ahora, por el proceso suelto (#21).
-if (ES_LANZAMIENTO) process.on('exit', () => { evento.soltarPendiente(); reportarLanzamiento('other') })
+// La red dice además por qué (#82), como clase: una excepción que nadie atrapó, o no se sabe.
+let razonDeSalida = 'unknown'
+if (ES_LANZAMIENTO) {
+  process.on('uncaughtExceptionMonitor', () => { razonDeSalida = 'uncaught-exception' })
+  process.on('exit', () => { evento.soltarPendiente(); reportarLanzamiento('other', { reason: razonDeSalida }) })
+}
+// #82: un server que sale con error dentro de esta ventana no arrancó. El `spawned` espera a que
+// pase; el server y el cliente no esperan nada: sólo se demora el evento.
+const VENTANA_ARRANQUE_MS = 2000
 
 // Platform support: macOS (Swift tray + embedded server) and Windows (go-server standalone
 // binary downloaded from R2). Linux passes this guard so that `--help`, `status`, `update` and
 // `uninstall` answer, but it is NOT supported: the server path and `setup` say so (#9).
+// Since local-mcp-releases#61 row 5 npm refuses the install on Linux (`os` in package.json), so
+// this branch is no longer reached through `npm install`/`npx`. It stays for whoever gets past
+// that: `node index.js` on a checkout, `npm install --force`, or a tool that ignores `os`.
 const SUPPORTED_PLATFORMS = ['darwin', 'win32', 'linux']
 if (!SUPPORTED_PLATFORMS.includes(process.platform)) {
   console.error(`LMCP supports macOS and Windows. Your platform (${process.platform}) is not supported yet — see https://local-mcp.com`)
@@ -344,7 +355,15 @@ async function main() {
   // sólo buscaba ayuda de CLI. Un comando de consulta no instala software.
   //
   // Sin argumentos sigue arrancando el server, que es como lo invocan los clientes de IA.
-  if (cmd !== undefined && !COMANDOS.includes(cmd) && !SINONIMOS_DEL_SERVER.includes(cmd)) {
+  //
+  // #88: un cliente de IA (stdin sin TTY) que manda un argumento desconocido quiere el server, y
+  // con exit 2 reintentaba en bucle. Ahí se ignora el argumento (una línea por stderr, nunca
+  // stdout: es JSON-RPC) y se sigue por el camino del server, que reporta `spawned` con la clase.
+  // En una terminal (TTY) y ante un pedido de ayuda sigue la ayuda: una consulta no descarga ni instala.
+  const desconocido = cmd !== undefined && !COMANDOS.includes(cmd) && !SINONIMOS_DEL_SERVER.includes(cmd)
+  if (desconocido && !PEDIDOS_DE_AYUDA.includes(cmd) && !(process.stdin && process.stdin.isTTY)) {
+    process.stderr.write(`[LMCP] ignoring unknown argument ${JSON.stringify(String(cmd).slice(0, 40))}; starting the MCP server\n`)
+  } else if (desconocido) {
     const pedidoDeAyuda = PEDIDOS_DE_AYUDA.includes(cmd)
     mostrarAyuda()
     if (!pedidoDeAyuda) {
@@ -405,6 +424,25 @@ async function main() {
     // copy and the durable App Support copy (see uninstallSentinelPaths).
     writeUninstallSentinels()
 
+    // #48 (2): quitar la entrada de los clientes de IA que se alcanzan (mismo catálogo que el setup);
+    // lo que no se puede tocar se dice. Sin catálogo (sin red) se dice también, no se adivina.
+    try {
+      const { unconfigureClients } = require('./unconfigure')
+      const catalogFile = process.env.LMCP_CLIENTS_CATALOG_FILE
+      const catalog = catalogFile
+        ? JSON.parse(fs.readFileSync(catalogFile, 'utf8'))
+        : await require('./setup')._fetchClientsCatalog()
+      if (!catalog) {
+        console.log('No se pudo leer el catálogo de clientes: las entradas "local-mcp" de tus clientes de IA quedan; quitalas a mano.')
+      } else {
+        const r = unconfigureClients(catalog)
+        for (const x of r.removed) console.log(`Entrada local-mcp eliminada de ${x.client}: ${x.file}`)
+        for (const x of r.left) console.log(`Dejada en ${x.client}${x.file ? ' (' + x.file + ')' : ''}: ${x.reason}; quitá "local-mcp" a mano.`)
+      }
+    } catch (e) {
+      console.log('No se pudieron quitar las entradas de los clientes de IA: ' + e.message)
+    }
+
     if (fs.existsSync(CACHE_DIR)) {
       fs.rmSync(CACHE_DIR, { recursive: true, force: true })
       console.log(`Runtime eliminado de ${CACHE_DIR}`)
@@ -584,14 +622,28 @@ async function main() {
     try { _pkgVer = require('./package.json').version || '' } catch {}
     const child = spawn(binaryPath, spawnArgs, { stdio: 'inherit', env: { ...process.env, LMCP_NPM_VERSION: _pkgVer } })
     noteSpawnedServer(child.pid)
-    // El server ya arrancó y este proceso queda vivo toda la sesión: el evento sale desde acá.
-    child.on('spawn', () => reportarLanzamiento('spawned', { enProceso: true }))
+    // El server arrancó y sigue vivo pasada la ventana: este proceso queda toda la sesión y el
+    // evento sale desde acá.
+    let arranque = null
+    child.on('spawn', () => {
+      arranque = setTimeout(() => { arranque = null; reportarLanzamiento('spawned', { enProceso: true }) }, VENTANA_ARRANQUE_MS)
+      arranque.unref() // el evento nunca retiene al proceso ni demora una salida
+    })
     child.on('error', (err) => {
-      reportarLanzamiento('spawn-failed')
+      reportarLanzamiento('spawn-failed', { reason: evento.razonDeError(err) })
       process.stderr.write(`Error ejecutando LMCP: ${err.message}\n`)
       process.exit(1)
     })
-    child.on('exit', (code) => process.exit(code ?? 0))
+    child.on('exit', (code, signal) => {
+      // Dentro de la ventana (#82): salió con error = no arrancó (`spawn-failed`), nunca `spawned`.
+      // El código de salida pasa al cliente igual que siempre.
+      if (arranque) {
+        clearTimeout(arranque)
+        if (code === 0) reportarLanzamiento('spawned')
+        else reportarLanzamiento('spawn-failed', { reason: signal ? 'signal' : 'early-exit' })
+      }
+      process.exit(code ?? 0)
+    })
   }
 
   // On Windows: apply pending update before launching (same as Mac's UpdateManager)
@@ -728,7 +780,7 @@ async function main() {
   try {
     runtime = await ensureRuntime()
   } catch (err) {
-    reportarLanzamiento('download-failed')
+    reportarLanzamiento('download-failed', { reason: evento.razonDeError(err) })
     process.stderr.write(`\nError al preparar el runtime de LMCP:\n${err.message}\n`)
     process.stderr.write(`Intentá reinstalar: npx local-mcp update\n\n`)
     process.exit(1)
@@ -764,6 +816,7 @@ async function main() {
 // round-trip that no static check can see.
 if (require.main === module) {
   main().catch(err => {
+    razonDeSalida = 'uncaught-exception'
     process.stderr.write(`Error fatal: ${err.message}\n`)
     process.exit(1)
   })

package/launch-event.js

@@ -12,23 +12,49 @@
 //   · escribir en stdout — es el protocolo;
 //   · demorar el arranque del server o una salida — sin reintentos, timeout corto, todo error
 //     tragado;
-//   · mandar algo que no sea uno de los cinco campos: ni el argumento, ni rutas, ni entorno.
-const https = require('https')
+//   · mandar algo que no sea uno de los campos del contrato, con valores de conjunto cerrado: ni
+//     el argumento, ni rutas, ni entorno, ni el mensaje de un error (#82: de un error sale su clase).
+const { https } = require('./user-agent')
 const cp = require('child_process')
 const DESTINO = { hostname: 'office-mcp-production.up.railway.app', path: '/launch-event' }
 const PLATAFORMAS = ['darwin', 'win32', 'linux', 'other']
-const CLASES = ['none', 'stdio', 'unknown']
+const CLASES = ['none', 'stdio', 'unknown', 'start', 'serve', 'server', 'run', 'mcp', '--stdio', 'other-word', 'other-flag']
 const OUTCOMES = ['spawned', 'rejected-argument', 'unsupported-node', 'unsupported-platform',
   'download-failed', 'spawn-failed', 'uninstalled', 'other']
+// #82: por qué falló, como clase. Sólo acompaña a un outcome de falla, y sólo donde hay algo que
+// clasificar (`download-failed`, `spawn-failed`, `other`); `checksum-mismatch` e `init-failed`
+// son del contrato y este wrapper no los produce.
+const RAZONES = ['network', 'timeout', 'http-status', 'checksum-mismatch', 'disk-write',
+  'permission-denied', 'binary-missing', 'early-exit', 'signal', 'uncaught-exception', 'init-failed', 'unknown']
+const CAMINO = 'npm-wrapper' // launch_path: quién arrancó el server
 const RE_VERSION = /^\d{1,3}\.\d{1,3}\.\d{1,5}$/
 const RE_MAQUINA = /^[A-Za-z0-9._:{}-]{1,64}$/
 const [TIMEOUT_MS, TOPE_MS] = [3000, 4000] // el pedido · la vida del proceso suelto
 const TOPE_ID_MS = 2000 // Windows: cuánto puede esperar el `spawned` al id de hardware (#21)
 
-// Del argumento sólo viaja su clase. `stdio` es el único que se nombra: es el del incidente.
+// Del argumento sólo viaja su clase (#88): `stdio` y las formas que los clientes inventan se
+// nombran (conjunto fijo); cualquier otra cosa es `other-flag` si empieza con `-` y `other-word`
+// si no. El texto crudo no sale nunca. `unknown` queda en el conjunto por compatibilidad: ya no se emite.
+const NOMBRADOS = ['stdio', 'start', 'serve', 'server', 'run', 'mcp', '--stdio']
 function claseDeArgumento (cmd) {
   if (cmd === undefined) return 'none'
-  return cmd === 'stdio' ? 'stdio' : 'unknown'
+  if (NOMBRADOS.includes(cmd)) return cmd
+  return typeof cmd === 'string' && cmd.startsWith('-') ? 'other-flag' : 'other-word'
+}
+
+// De un error sólo viaja su clase (#82). El mensaje se LEE acá —trae rutas y URLs— y no sale: lo
+// que devuelve es siempre un valor de RAZONES. El orden importa: «EACCES … open <ruta>» es de
+// permisos aunque la ruta diga otra cosa.
+function razonDeError (err) {
+  let t = ''
+  try { t = `${(err && err.code) || ''} ${(err && err.message) || ''}` } catch {}
+  if (/\b(EACCES|EPERM)\b/.test(t)) return 'permission-denied'
+  if (/timeout|ETIMEDOUT/i.test(t)) return 'timeout'
+  if (/HTTP \d{3}|not yet available/.test(t)) return 'http-status'
+  if (/\b(ENOTFOUND|EAI_AGAIN|ECONNRESET|ECONNREFUSED|ENETUNREACH|EHOSTUNREACH|EPIPE)\b|socket hang up|CERT|ERR_TLS/.test(t)) return 'network'
+  if (/\b(ENOSPC|EROFS|EIO|EBUSY|EDQUOT)\b/.test(t)) return 'disk-write'
+  if (/\bENOENT\b|not found after extraction|no encontrado después de extraer|tar\.exe not found/.test(t)) return 'binary-missing'
+  return 'unknown'
 }
 
 // El heartbeat no tiene compuerta de consentimiento (ver #11). Este evento respeta además el
@@ -55,8 +81,11 @@ function cuerpo (outcome, clase, deps = {}) {
     package_version: version,
     platform: PLATAFORMAS.includes(plataforma) ? plataforma : 'other',
     arg_class: clase,
-    outcome
+    outcome,
+    launch_path: CAMINO
   }
+  // Una razón fuera del conjunto no viaja, y un `spawned` no lleva razón; el evento sale igual.
+  if (outcome !== 'spawned' && RAZONES.includes(deps.reason)) c.reason = deps.reason
   const id = 'machineId' in deps ? deps.machineId : idDeMaquina()
   if (typeof id === 'string' && RE_MAQUINA.test(id)) c.machine_id = id
   return c
@@ -140,7 +169,7 @@ function idDeHardwareWindows (listo) {
 // Una persona en una terminal (stdin TTY) no es un cliente de IA lanzando el server: no reporta.
 let reportado = false
 let pendiente = null
-function reportar (outcome, clase, { enProceso = false } = {}) {
+function reportar (outcome, clase, { enProceso = false, reason } = {}) {
   if (reportado) return
   reportado = true
   try {
@@ -162,7 +191,7 @@ function reportar (outcome, clase, { enProceso = false } = {}) {
       if (c) enviar(c, { soltar: true })
       return
     }
-    lanzarSuelto(outcome, clase)
+    lanzarSuelto(outcome, clase, reason)
   } catch {}
 }
 
@@ -170,8 +199,9 @@ function reportar (outcome, clase, { enProceso = false } = {}) {
 // como reportado para que la red del `exit` tampoco lo mande como `other`.
 function silenciar () { reportado = true }
 
-function lanzarSuelto (outcome, clase) {
-  const hijo = cp.spawn(process.execPath, [__filename, outcome, clase],
+function lanzarSuelto (outcome, clase, reason) {
+  // La razón viaja como argumento sólo si es del conjunto: al proceso suelto no le llega texto libre.
+  const hijo = cp.spawn(process.execPath, [__filename, outcome, clase, ...(RAZONES.includes(reason) ? [reason] : [])],
     { detached: true, stdio: 'ignore', windowsHide: true })
   hijo.on('error', () => {})
   hijo.unref()
@@ -187,12 +217,12 @@ function soltarPendiente () {
   try { lanzarSuelto(outcome, clase) } catch {}
 }
 
-// Como programa es el proceso suelto: `node launch-event.js <outcome> <clase>`.
+// Como programa es el proceso suelto: `node launch-event.js <outcome> <clase> [reason]`.
 if (require.main === module) {
   setTimeout(() => process.exit(0), TOPE_MS).unref()
-  const c = apagado() ? null : cuerpo(process.argv[2], process.argv[3])
+  const c = apagado() ? null : cuerpo(process.argv[2], process.argv[3], { reason: process.argv[4] })
   if (c) enviar(c)
 }
 
-module.exports = { PLATAFORMAS, CLASES, OUTCOMES, RE_VERSION, RE_MAQUINA, TOPE_ID_MS, claseDeArgumento, apagado, cuerpo, reportar, silenciar, soltarPendiente,
+module.exports = { PLATAFORMAS, CLASES, OUTCOMES, RAZONES, CAMINO, razonDeError, RE_VERSION, RE_MAQUINA, TOPE_ID_MS, claseDeArgumento, apagado, cuerpo, reportar, silenciar, soltarPendiente,
   _idDeHardwareWindows: idDeHardwareWindows } // costura de test

package/package.json

@@ -1,20 +1,22 @@
 {
   "name": "local-mcp",
-  "version": "3.0.419",
-  "description": "Let ChatGPT, Claude, Cursor & any MCP client actually use your Mac or Windows PC — read & reply to email, manage your calendar, text over iMessage, find files, work with Teams, Slack & Office. Runs locally, no API keys, free.",
+  "version": "3.0.421",
+  "description": "Let ChatGPT, Claude, Cursor & any MCP client actually use your Mac or Windows PC — read & reply to email, manage your calendar, text over iMessage, find files, work with Teams, Slack, Notion & Office. Runs locally, no API keys.",
   "main": "index.js",
   "bin": {
     "local-mcp": "index.js"
   },
   "scripts": {
     "postinstall": "node postinstall.js",
-    "test": "node --test test/*.test.js"
+    "test": "node --require ./test/aislado.preload.js --test test/*.test.js"
   },
   "files": [
     "index.js",
     "download.js",
     "setup.js",
     "launch-event.js",
+    "user-agent.js",
+    "unconfigure.js",
     "postinstall.js",
     "README.md"
   ],
@@ -23,7 +25,6 @@
   },
   "os": [
     "darwin",
-    "linux",
     "win32"
   ],
   "keywords": [

package/setup.js

@@ -67,7 +67,7 @@ function _writeLaunchScript(npxAbsPath, cacheDir, isWin = _IS_WIN) {
       'NODE_MAJOR=$(echo "$NODE_VER" | sed \'s/v//\' | cut -d. -f1)',
       'if [ "${NODE_MAJOR:-0}" -lt 16 ] 2>/dev/null; then',
       '  # curl telemetry — no Node dependency, fire-and-forget',
-      `  curl -sf --max-time 3 -X POST "https://${BACKEND_HOST}/install-event" \\`,
+      `  curl -sf --max-time 3 -A "LMCP-npm (launcher)" -X POST "https://${BACKEND_HOST}/install-event" \\`,
       '    -H "Content-Type: application/json" \\',
       '    -d "{\\\"stage\\\":\\\"node_too_old\\\",\\\"version\\\":\\\"$NODE_VER\\\"}" &>/dev/null &',
       '  printf \'LMCP requires Node 16+. Current: %s\\nFix: nvm alias default 22 && nvm uninstall %s — then restart Claude Desktop.\\n\' "$NODE_VER" "$NODE_VER" >&2',
@@ -328,7 +328,7 @@ async function runSetup(opts = {}) {
   const _preToken = process.env.LMCP_PRE_TOKEN || ''
   if (_preToken.startsWith('lmcp-pre-')) {
     try {
-      const https = require('https')
+      const { https } = require('./user-agent')
       const req = https.request({
         hostname: BACKEND_HOST,
         path: `/install/started/${_preToken}`,
@@ -797,10 +797,12 @@ function _getRef() {
 // _getMachineId runs on every ensureBinary()/ensureTray()/... call (i.e. on every
 // npx spawn), and a Keychain write there would be needless overhead on a hot path
 // that setup.js — which only runs once at install time — doesn't share.
-function _getMachineId() {
-  const id = download._getMachineId()
-  if (_IS_MAC && id) {
-    try { execSync(`security add-generic-password -s com.local-mcp.machine-id -a machine-id -w "${id}" -U 2>/dev/null`, { stdio: 'pipe' }) } catch {}
+// `deps` es la costura de test (#84): sin ella un test pedía al Keychain REAL de quien lo corre
+// que creara o pisara la identidad de la máquina. Producto: nadie la pasa, nada cambia.
+function _getMachineId(deps = {}) {
+  const id = download._getMachineId(deps)
+  if ((deps.platform ? deps.platform === 'darwin' : _IS_MAC) && id) {
+    try { (deps.execImpl || execSync)(`security add-generic-password -s com.local-mcp.machine-id -a machine-id -w "${id}" -U 2>/dev/null`, { stdio: 'pipe' }) } catch {}
   }
   return id
 }
@@ -819,7 +821,7 @@ function _getMachineId() {
 async function _associateEmail(email, token) {
   return new Promise((resolve) => {
     try {
-      const https = require('https')
+      const { https } = require('./user-agent')
       const payload = JSON.stringify({
         stage: 'email_prompt',
         email_prompt_result: 'submitted',
@@ -892,7 +894,7 @@ function _writeCloudToken(cacheDir, token) {
 /// treat failure as non-fatal and fall through to the email-based path.
 async function _registerAnonToken() {
   return new Promise((resolve) => {
-    const https = require('https')
+    const { https } = require('./user-agent')
     const machineId = _getMachineId()
     const payload = JSON.stringify({ machine_id: machineId })
     const req = https.request({
@@ -951,7 +953,7 @@ function _migrateCurlLaunchAgent() {
 
 function _trackSetupStep(step, status, client, detail) {
   try {
-    const https = require('https')
+    const { https } = require('./user-agent')
     const payload = {
       machine_id:  _getMachineId(),
       install_id:  process.env.INSTALL_ID || '',
@@ -989,7 +991,7 @@ function _trackSetupStep(step, status, client, detail) {
 
 function _trackConfigWritten(clientId, clientName) {
   try {
-    const https = require('https')
+    const { https } = require('./user-agent')
     const machineId = _getMachineId()
     const data = JSON.stringify({
       stage: 'config_written',
@@ -1015,7 +1017,7 @@ function _trackConfigWritten(clientId, clientName) {
 
 function _trackRestartPrompted(clientName) {
   try {
-    const https = require('https')
+    const { https } = require('./user-agent')
     const machineId = _getMachineId()
     const payload = {
       stage: 'restart_prompted',
@@ -1040,7 +1042,7 @@ function _trackRestartPrompted(clientName) {
 
 function _pingInstall(clients, method, email = '', binaryVersion = '') {
   try {
-    const https = require('https')
+    const { https } = require('./user-agent')
     const pkg    = require('./package.json')
     const machineId = _getMachineId()
     // Persist the attribution ref so the server reports it on every heartbeat —
@@ -1133,7 +1135,7 @@ function _pingInstall(clients, method, email = '', binaryVersion = '') {
 // callers treat that as "don't launch anything," never as an error.
 function _fetchClientsCatalog(totalMs = 4000) {
   return new Promise((resolve) => {
-    const https = require('https')
+    const { https } = require('./user-agent')
     const req = https.request({
       hostname: BACKEND_HOST, path: '/clients/catalog', method: 'GET', timeout: totalMs,
     }, (res) => {

package/unconfigure.js

@@ -0,0 +1,101 @@
+'use strict'
+// #48 (2): `npx local-mcp uninstall` quita la entrada `local-mcp` de las configs de los clientes de IA
+// que puede alcanzar, con el MISMO catálogo que usa el setup (nada de lista de clientes aquí). Sin esto
+// el cliente sigue lanzando el wrapper en cada arranque contra una máquina ya desinstalada.
+//
+// Sólo toca lo que puede deshacer sin riesgo: JSON estándar (cfgSchema mcpServers / servers /
+// context_servers) y sólo la clave `local-mcp` dentro de ese objeto. Lo demás (TOML/YAML, esquemas
+// propios, JSON con comentarios o inválido, comodines sin carpeta) no se reescribe: se devuelve en
+// `left` con el motivo, para que el comando diga qué dejó.
+const fs = require('fs')
+const os = require('os')
+const path = require('path')
+
+const ENTRY = 'local-mcp'
+const KEY_BY_SCHEMA = { mcpServers: 'mcpServers', servers: 'servers', context_servers: 'context_servers' }
+
+function _expand(p, env) {
+  return p
+    .replace(/^~(?=[\\/]|$)/, env.home)
+    .replace(/%APPDATA%/g, env.appData)
+    .replace(/%LOCALAPPDATA%/g, env.localAppData)
+}
+
+// Un `*` sólo vale dentro de UN segmento; se resuelve contra el disco.
+function _glob(p) {
+  if (!p.includes('*')) return [p]
+  const parts = p.split(/[\\/]/)
+  let bases = [parts[0] === '' ? path.sep : parts[0]]
+  for (const seg of parts.slice(1)) {
+    const next = []
+    for (const b of bases) {
+      if (!seg.includes('*')) { next.push(path.join(b, seg)); continue }
+      const re = new RegExp('^' + seg.replace(/[.+?^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*') + '$')
+      let names = []
+      try { names = fs.readdirSync(b) } catch {}
+      for (const n of names) if (re.test(n)) next.push(path.join(b, n))
+    }
+    bases = next
+  }
+  return bases
+}
+
+function _paths(client, plat, env) {
+  const platform = (client.platforms || {})[plat]
+  if (!platform || !Array.isArray(platform.cfgPaths)) return []
+  const hosts = Array.isArray(platform.hosts) && platform.hosts.length ? platform.hosts : [null]
+  const out = []
+  for (const raw of platform.cfgPaths) {
+    for (const h of hosts) {
+      const withHost = h === null ? raw : raw.replace(/\{host\}/g, h)
+      if (withHost.includes('{host}')) continue
+      for (const f of _glob(_expand(withHost, env))) if (!out.includes(f)) out.push(f)
+    }
+  }
+  return out
+}
+
+function _writeAtomic(file, data) {
+  const tmp = file + '.lmcp-tmp'
+  fs.writeFileSync(tmp, JSON.stringify(data, null, 2) + '\n', 'utf8')
+  fs.renameSync(tmp, file)
+}
+
+/**
+ * @param {object} catalog  el catálogo servido (`clients[]`).
+ * @param {object} [opts]   platform, home, appData, localAppData (para probar sin tocar el disco real).
+ * @returns {{removed: {client:string,file:string}[], left: {client:string,file?:string,reason:string}[]}}
+ */
+function unconfigureClients(catalog, opts = {}) {
+  const home = opts.home || os.homedir()
+  const platform = opts.platform || process.platform
+  const env = {
+    home,
+    appData: opts.appData || process.env.APPDATA || path.join(home, 'AppData', 'Roaming'),
+    localAppData: opts.localAppData || process.env.LOCALAPPDATA || path.join(home, 'AppData', 'Local'),
+  }
+  const plat = platform === 'darwin' ? 'macos' : platform === 'win32' ? 'windows' : null
+  const removed = []
+  const left = []
+  if (!plat || !catalog || !Array.isArray(catalog.clients)) return { removed, left }
+  for (const c of catalog.clients) {
+    const files = _paths(c, plat, env).filter((f) => { try { return fs.statSync(f).isFile() } catch { return false } })
+    for (const file of files) {
+      const key = KEY_BY_SCHEMA[c.cfgSchema]
+      if (!key) { left.push({ client: c.id, file, reason: 'schema ' + c.cfgSchema }); continue }
+      let data
+      try { data = JSON.parse(fs.readFileSync(file, 'utf8')) } catch {
+        left.push({ client: c.id, file, reason: 'not plain JSON' }); continue
+      }
+      const block = data && typeof data === 'object' ? data[key] : null
+      if (!block || typeof block !== 'object' || !(ENTRY in block)) continue
+      delete block[ENTRY]
+      try { _writeAtomic(file, data); removed.push({ client: c.id, file }) } catch (e) {
+        left.push({ client: c.id, file, reason: e.message })
+      }
+    }
+  }
+  return { removed, left }
+}
+
+module.exports = { unconfigureClients }

package/user-agent.js

@@ -0,0 +1,40 @@
+'use strict'
+// Every outbound HTTP request from npx carries `User-Agent: LMCP-npm/<version> (<platform>)`.
+// Node sends none by default, and an empty-UA download of a binary from a fresh process looks
+// like malware to a security gateway. Drop-in `https`/`http` wrappers: same signatures,
+// the header is added unless the caller already set one. Resolve `request`/`get` at call time.
+const https = require('https')
+const http = require('http')
+
+let VERSION = '0'
+try { VERSION = require('./package.json').version || '0' } catch {}
+
+function userAgent (platform = process.platform) {
+  return `LMCP-npm/${VERSION} (${platform})`
+}
+
+function conUA (opts) {
+  const o = { ...(opts || {}) }
+  const h = { ...(o.headers || {}) }
+  if (!Object.keys(h).some((k) => k.toLowerCase() === 'user-agent')) h['User-Agent'] = userAgent()
+  o.headers = h
+  return o
+}
+
+function envolver (mod) {
+  return {
+    request (opts, cb) {
+      if (typeof opts === 'string' || opts instanceof URL) return mod.request(opts, conUA({}), cb)
+      return mod.request(conUA(opts), cb)
+    },
+    get (url, opts, cb) {
+      if (typeof url === 'string' || url instanceof URL) {
+        if (typeof opts === 'function') return mod.get(url, conUA({}), opts)
+        return mod.get(url, conUA(opts), cb)
+      }
+      return mod.get(conUA(url), typeof opts === 'function' ? opts : cb)
+    }
+  }
+}
+
+module.exports = { userAgent, conUA, https: envolver(https), http: envolver(http) }