local-mcp 3.0.92 → 3.0.96

package/README.md

@@ -1,6 +1,6 @@
 # LMCP
 
-> Give your AI assistant native access to Mac apps — 113 tools for Mail, Calendar, Contacts, iMessage, Teams, Slack, WhatsApp, OneDrive, Notes, OmniFocus, Safari, Word, Excel, PowerPoint, Stocks, NordVPN, and more. Everything runs locally. Your data never leaves your machine.
+> Give your AI assistant native access to Mac apps — 107 tools for Mail, Calendar, Contacts, iMessage, Teams, Slack, WhatsApp, OneDrive, Notes, OmniFocus, Safari, Word, Excel, PowerPoint, Stocks, NordVPN, and more. Everything runs locally. Your data never leaves your machine.
 
 [![npm](https://img.shields.io/npm/v/local-mcp)](https://www.npmjs.com/package/local-mcp)
 [![macOS 12+](https://img.shields.io/badge/macOS-12%2B-blue)](https://local-mcp.com?ref=npm)
@@ -60,9 +60,8 @@ LMCP runs a native MCP server that bridges your Mac apps to any AI client:
 | **Finder** | Search files via Spotlight, list directory contents |
 | **Safari** | Bookmarks, open tabs, click/type/fill forms, run JavaScript |
 | **NordVPN** | Status, server recommendations, diagnostics |
-| **M365 Directory** | Search org directory, people insights — requires Microsoft 365 account |
 
-## 113 MCP Tools
+## 107 MCP Tools
 
 Email (9): `list_accounts` `list_emails` `read_email` `send_email` `reply_email` `search_emails` `move_email` `save_attachment` `create_email_folder`
 
@@ -100,8 +99,6 @@ Safari (13): `list_safari_bookmarks` `safari_list_tabs` `safari_read_tab` `safar
 
 NordVPN (3): `nordvpn_status` `nordvpn_servers` `nordvpn_diagnose`
 
-M365 Directory (5): `connect_m365_account` `disconnect_m365_account` `search_m365_directory` `get_m365_person` `list_m365_people_insights`
-
 System (7): `run_diagnostics` `update_local_mcp` `update_self_diagnosis` `daily_brief` `report_problem` `request_feature` `request_integration`
 
 ## Safety

package/download.js

@@ -15,7 +15,10 @@ const { execFileSync } = require('child_process')
 const BACKEND_URL = 'https://office-mcp-production.up.railway.app'
 const CACHE_DIR   = path.join(os.homedir(), '.local', 'share', 'local-mcp', 'bin')
 const TRAY_DIR    = path.join(os.homedir(), '.local', 'share', 'local-mcp', 'tray')  // metadata dir
-const TRAY_APP    = '/Applications/LocalMCPTray.app'
+// Install to ~/Applications (user-owned) to avoid macOS App Management TCC prompt.
+// /Applications requires kTCCServiceAppManagement permission which shows "node would like
+// to access data from other apps" on every tray update — confusing and unnecessary.
+const TRAY_APP    = path.join(os.homedir(), 'Applications', 'LocalMCPTray.app')
 
 function _getMachineId() {
   const { execSync } = require('child_process')
@@ -227,6 +230,12 @@ async function ensureTray() {
     try { execFileSync('rm', ['-rf', oldTrayApp], { stdio: 'pipe' }) } catch { /* ignorar */ }
   }
 
+  // Migrar instalación vieja de /Applications → ~/Applications (evita diálogo App Management)
+  const systemTrayApp = '/Applications/LocalMCPTray.app'
+  if (fs.existsSync(systemTrayApp) && trayApp !== systemTrayApp) {
+    try { execFileSync('rm', ['-rf', systemTrayApp], { stdio: 'pipe' }) } catch { /* ignorar */ }
+  }
+
   // Ya instalado y actualizado
   if (fs.existsSync(trayApp) && fs.existsSync(verFile)) {
     if (fs.readFileSync(verFile, 'utf8').trim() === version) return trayApp
@@ -253,8 +262,12 @@ async function ensureTray() {
     try { execFileSync('rm', ['-rf', trayApp], { stdio: 'pipe' }) } catch { /* ignorar */ }
   }
 
-  process.stderr.write(`  Instalando tray en /Applications...\n`)
-  execFileSync('tar', ['-xzf', tarPath, '-C', '/Applications'], { stdio: 'pipe' })
+  // Crear ~/Applications si no existe (ubicación estándar para apps de usuario)
+  const userAppsDir = path.join(os.homedir(), 'Applications')
+  fs.mkdirSync(userAppsDir, { recursive: true })
+
+  process.stderr.write(`  Instalando tray en ~/Applications...\n`)
+  execFileSync('tar', ['-xzf', tarPath, '-C', userAppsDir], { stdio: 'pipe' })
   fs.unlinkSync(tarPath)
 
   if (!fs.existsSync(trayApp)) {
@@ -311,72 +324,71 @@ function _writeTrayLaunchAgent(trayApp) {
 }
 
 /**
- * Descarga el co-proceso m365-proxy si no está instalado o es una versión diferente.
- * El binary se instala en ~/.local/share/local-mcp/bin/m365-proxy
- * @returns {Promise<string|null>} Ruta al binary, o null si falla
+ * Downloads the slack-proxy co-process if not installed or on a different version.
+ * Binary is installed at ~/.local/share/local-mcp/bin/slack-proxy
+ * @returns {Promise<string|null>} Path to the binary, or null if it fails
  */
-async function ensureM365Proxy() {
+async function ensureSlackProxy() {
   const info = await getLatestBinary()
   const version = info.version
   const arch = process.arch === 'arm64' ? 'darwin-arm64' : 'darwin-x64'
-  const binPath = path.join(CACHE_DIR, 'm365-proxy')
-  const verFile = path.join(CACHE_DIR, '.m365-proxy-version')
+  const binPath = path.join(CACHE_DIR, 'slack-proxy')
+  const verFile = path.join(CACHE_DIR, '.slack-proxy-version')
 
-  // Ya instalado y actualizado
+  // Already installed and up to date
   if (fs.existsSync(binPath) && fs.existsSync(verFile)) {
     if (fs.readFileSync(verFile, 'utf8').trim() === version) return binPath
   }
 
-  const url = `https://download.local-mcp.com/m365-proxy-${version}-${arch}.tar.gz`
-  process.stderr.write(`\nDescargando m365-proxy v${version}...\n`)
+  const url = `https://download.local-mcp.com/slack-proxy-${version}-${arch}.tar.gz`
+  process.stderr.write(`\nDownloading slack-proxy v${version}...\n`)
 
   fs.mkdirSync(CACHE_DIR, { recursive: true })
-  const tarPath = path.join(CACHE_DIR, `m365-proxy-${version}.tar.gz`)
+  const tarPath = path.join(CACHE_DIR, `slack-proxy-${version}.tar.gz`)
 
   try {
     await downloadFile(url, tarPath)
     const stat = fs.statSync(tarPath)
-    if (stat.size < 1000) { fs.unlinkSync(tarPath); throw new Error(`Descarga incompleta (${stat.size} bytes)`) }
+    if (stat.size < 1000) { fs.unlinkSync(tarPath); throw new Error(`Incomplete download (${stat.size} bytes)`) }
 
     execFileSync('tar', ['-xzf', tarPath, '-C', CACHE_DIR], { stdio: 'pipe' })
     fs.unlinkSync(tarPath)
 
-    if (!fs.existsSync(binPath)) throw new Error('m365-proxy no encontrado tras extraer')
+    if (!fs.existsSync(binPath)) throw new Error('slack-proxy not found after extraction')
     fs.chmodSync(binPath, 0o755)
-    try { execFileSync('codesign', ['--force', '--sign', '-', '--identifier', 'com.local-mcp.m365-proxy', binPath], { stdio: 'pipe' }) } catch { /* no crítico */ }
+    try { execFileSync('codesign', ['--force', '--sign', '-', '--identifier', 'com.local-mcp.slack-proxy', binPath], { stdio: 'pipe' }) } catch { /* non-critical */ }
 
     fs.writeFileSync(verFile, version, 'utf8')
-    process.stderr.write(`  m365-proxy instalado en ${binPath}\n`)
+    process.stderr.write(`  slack-proxy installed at ${binPath}\n`)
     return binPath
   } catch (err) {
     try { if (fs.existsSync(tarPath)) fs.unlinkSync(tarPath) } catch {}
-    process.stderr.write(`  (m365-proxy no disponible: ${err.message})\n`)
+    process.stderr.write(`  (slack-proxy not available: ${err.message})\n`)
     return null
   }
 }
 
 /**
- * Downloads the slack-proxy co-process if not installed or on a different version.
- * Binary is installed at ~/.local/share/local-mcp/bin/slack-proxy
+ * Downloads local-mcp-helper on first install only.
+ * CRITICAL: never replaces an existing helper binary — the helper owns
+ * Calendar/Contacts/Reminders TCC grants via its cdhash. Replacing the
+ * binary silently resets those grants and users would have to re-authorize.
  * @returns {Promise<string|null>} Path to the binary, or null if it fails
  */
-async function ensureSlackProxy() {
+async function ensureHelper() {
+  const binPath = path.join(CACHE_DIR, 'local-mcp-helper')
+
+  // Already installed — never replace. Stable cdhash = stable TCC grants.
+  if (fs.existsSync(binPath)) return binPath
+
   const info = await getLatestBinary()
   const version = info.version
   const arch = process.arch === 'arm64' ? 'darwin-arm64' : 'darwin-x64'
-  const binPath = path.join(CACHE_DIR, 'slack-proxy')
-  const verFile = path.join(CACHE_DIR, '.slack-proxy-version')
-
-  // Already installed and up to date
-  if (fs.existsSync(binPath) && fs.existsSync(verFile)) {
-    if (fs.readFileSync(verFile, 'utf8').trim() === version) return binPath
-  }
-
-  const url = `https://download.local-mcp.com/slack-proxy-${version}-${arch}.tar.gz`
-  process.stderr.write(`\nDownloading slack-proxy v${version}...\n`)
+  const url = `https://download.local-mcp.com/local-mcp-helper-${version}-${arch}.tar.gz`
+  process.stderr.write(`\nDownloading local-mcp-helper v${version}...\n`)
 
   fs.mkdirSync(CACHE_DIR, { recursive: true })
-  const tarPath = path.join(CACHE_DIR, `slack-proxy-${version}.tar.gz`)
+  const tarPath = path.join(CACHE_DIR, `local-mcp-helper-${version}.tar.gz`)
 
   try {
     await downloadFile(url, tarPath)
@@ -386,18 +398,21 @@ async function ensureSlackProxy() {
     execFileSync('tar', ['-xzf', tarPath, '-C', CACHE_DIR], { stdio: 'pipe' })
     fs.unlinkSync(tarPath)
 
-    if (!fs.existsSync(binPath)) throw new Error('slack-proxy not found after extraction')
+    if (!fs.existsSync(binPath)) throw new Error('local-mcp-helper not found after extraction')
     fs.chmodSync(binPath, 0o755)
-    try { execFileSync('codesign', ['--force', '--sign', '-', '--identifier', 'com.local-mcp.slack-proxy', binPath], { stdio: 'pipe' }) } catch { /* non-critical */ }
+    // Do NOT codesign: the pre-built binary's cdhash must remain exactly as
+    // distributed. Codesigning a fresh binary produces the same cdhash only
+    // when the content is identical, but we want the CI-signed cdhash to be
+    // the canonical identity used in TCC grants.
 
-    fs.writeFileSync(verFile, version, 'utf8')
-    process.stderr.write(`  slack-proxy installed at ${binPath}\n`)
+    fs.writeFileSync(path.join(CACHE_DIR, '.helper-version'), version, 'utf8')
+    process.stderr.write(`  local-mcp-helper installed at ${binPath}\n`)
     return binPath
   } catch (err) {
     try { if (fs.existsSync(tarPath)) fs.unlinkSync(tarPath) } catch {}
-    process.stderr.write(`  (slack-proxy not available: ${err.message})\n`)
+    process.stderr.write(`  (local-mcp-helper not available: ${err.message})\n`)
     return null
   }
 }
 
-module.exports = { ensureBinary, ensureRuntime, ensureTray, ensureTeamsProxy, ensureM365Proxy, ensureSlackProxy, CACHE_DIR, TRAY_DIR }
+module.exports = { ensureBinary, ensureRuntime, ensureTray, ensureTeamsProxy, ensureSlackProxy, ensureHelper, CACHE_DIR, TRAY_DIR }

package/index.js

@@ -136,10 +136,10 @@ async function main() {
         : ''
       if (cachedVersion && semverGte(cachedVersion, pkg.version)) {
         // Cached binary is same or newer — use fast path, no download needed
-        const { ensureTray, ensureTeamsProxy, ensureM365Proxy } = require('./download')
+        const { ensureTray, ensureTeamsProxy, ensureHelper } = require('./download')
         ensureTray().catch(() => {})
         ensureTeamsProxy().catch(() => {})
-        ensureM365Proxy().catch(() => {})
+        ensureHelper().catch(() => {})
         const child = spawn(stableBin, [], { stdio: 'inherit', env: process.env })
         child.on('error', () => process.exit(1))
         child.on('exit', (code) => process.exit(code ?? 0))
@@ -158,12 +158,12 @@ async function main() {
   }
 
   // Slow path: download/repair binary
-  const { ensureRuntime, ensureTray, ensureTeamsProxy, ensureM365Proxy } = require('./download')
+  const { ensureRuntime, ensureTray, ensureTeamsProxy, ensureHelper } = require('./download')
 
-  // Actualizar tray + teams-proxy + m365-proxy en background
+  // Update tray + proxies in background. Helper is downloaded only on first install.
   ensureTray().catch(() => {})
   ensureTeamsProxy().catch(() => {})
-  ensureM365Proxy().catch(() => {})
+  ensureHelper().catch(() => {})
 
   let runtime
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "local-mcp",
-  "version": "3.0.92",
+  "version": "3.0.96",
   "description": "LMCP — connect Claude Desktop, Cursor, Windsurf to Mail, Calendar, Contacts, Teams, OneDrive on macOS. Privacy-first: all data stays on your Mac.",
   "main": "index.js",
   "bin": {