Add scripts/lmcp-install-macos.sh + LMCP_TOKEN env fallback

lmcp.lua: if opts.auth_token and opts.conf are both unset, fall back to
the LMCP_TOKEN environment variable. Empty string treated as unset.
This is the primitive launchd/systemd drop-ins need — no conf file
bookkeeping on hosts that don't already use one.

scripts/lmcp-install-macos.sh: macOS installer via Homebrew. Drops the
Lua library files into $(brew --prefix)/share/lua/5.4/, mints (or
reuses) a Bearer token stored at $(brew --prefix)/etc/lmcp/token,
installs a ~/Library/LaunchAgents/ plist with LMCP_TOKEN baked in,
launchctl-loads it, and smoke-tests. Prints the Claude Code ~/.claude.json
snippet at the end.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

lmcp.lua

@@ -33,12 +33,17 @@ function lmcp.new(name, opts)
     self.port = opts.port or 8080
     self.tools = {}
     self._session_id = nil
-    -- Auth: explicit opt > conf file > nil (no auth)
+    -- Auth: explicit opt > conf file > LMCP_TOKEN env > nil (no auth)
     if opts.auth_token then
         self._auth_token = opts.auth_token
     elseif opts.conf then
         local conf = read_conf(opts.conf)
         self._auth_token = conf['.godparticle']
+    else
+        local env_token = os.getenv("LMCP_TOKEN")
+        if env_token and env_token ~= "" then
+            self._auth_token = env_token
+        end
     end
     return self
 end

scripts/lmcp-install-macos.sh

@@ -0,0 +1,129 @@
+#!/bin/bash
+# Install lmcp on macOS via Homebrew.
+#
+# Idempotent. Pulls lua + luasocket from brew, copies lmcp library files
+# into brew's share/lua/5.4/ tree, mints a Bearer token (or reuses an
+# existing one at $(brew --prefix)/etc/lmcp/token), installs a LaunchAgent,
+# starts the service, and prints the token for Claude Code MCP config.
+#
+# Usage (from lmcp repo root):
+#   ./scripts/lmcp-install-macos.sh
+#
+# Uninstall:
+#   launchctl unload ~/Library/LaunchAgents/de.reauktion.marfrit.lmcp.plist
+#   rm ~/Library/LaunchAgents/de.reauktion.marfrit.lmcp.plist
+#   rm $(brew --prefix)/etc/lmcp/token
+
+set -euo pipefail
+
+PREFIX=$(brew --prefix)
+REPO=${REPO:-$(cd "$(dirname "$0")/.." && pwd)}
+LABEL="de.reauktion.marfrit.lmcp"
+PLIST="$HOME/Library/LaunchAgents/$LABEL.plist"
+TOKEN_FILE="$PREFIX/etc/lmcp/token"
+PORT="${LMCP_PORT:-8080}"
+NAME="${LMCP_NAME:-$(hostname -s)-tools}"
+
+for f in lmcp.lua json.lua server.lua example_server.lua; do
+    [ -f "$REPO/$f" ] || { echo "error: $REPO/$f not found — run from lmcp repo root or set REPO="; exit 1; }
+done
+
+echo "==> brew install lua + luasocket"
+brew install --quiet lua luasocket
+
+LUA="$PREFIX/bin/lua"
+[ -x "$LUA" ] || { echo "error: $LUA not executable after brew install"; exit 1; }
+
+echo "==> install library files into $PREFIX/share/lua/5.4/"
+install -d "$PREFIX/share/lua/5.4"
+install -m 644 "$REPO/lmcp.lua"   "$PREFIX/share/lua/5.4/lmcp.lua"
+install -m 644 "$REPO/json.lua"   "$PREFIX/share/lua/5.4/json.lua"
+install -m 644 "$REPO/server.lua" "$PREFIX/share/lua/5.4/server.lua"
+install -m 755 "$REPO/example_server.lua" "$PREFIX/bin/lmcp-example"
+
+# Token: retain existing, otherwise mint 32 bytes of hex.
+if [ -r "$TOKEN_FILE" ]; then
+    TOKEN=$(cat "$TOKEN_FILE")
+    echo "==> reusing token from $TOKEN_FILE"
+else
+    install -d -m 700 "$(dirname "$TOKEN_FILE")"
+    TOKEN=$(openssl rand -hex 32)
+    umask 077
+    printf '%s\n' "$TOKEN" > "$TOKEN_FILE"
+    chmod 600 "$TOKEN_FILE"
+    echo "==> minted new token, stored at $TOKEN_FILE (0600)"
+fi
+
+echo "==> write LaunchAgent $PLIST"
+mkdir -p "$HOME/Library/LaunchAgents"
+cat > "$PLIST" <<PLIST
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>$LABEL</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>$LUA</string>
+        <string>$PREFIX/share/lua/5.4/server.lua</string>
+    </array>
+    <key>EnvironmentVariables</key>
+    <dict>
+        <key>LMCP_PORT</key>
+        <string>$PORT</string>
+        <key>LMCP_NAME</key>
+        <string>$NAME</string>
+        <key>LMCP_TOKEN</key>
+        <string>$TOKEN</string>
+    </dict>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>KeepAlive</key>
+    <true/>
+    <key>StandardOutPath</key>
+    <string>/tmp/lmcp.log</string>
+    <key>StandardErrorPath</key>
+    <string>/tmp/lmcp.err</string>
+</dict>
+</plist>
+PLIST
+chmod 600 "$PLIST"  # plist contains token
+
+echo "==> (re)load LaunchAgent"
+launchctl unload "$PLIST" 2>/dev/null || true
+launchctl load "$PLIST"
+
+sleep 1
+echo "==> smoke test (unauth expected 401, Bearer expected 200)"
+unauth=$(curl -s -o /dev/null -w '%{http_code}' -X POST "http://127.0.0.1:$PORT/mcp" \
+     -H 'Content-Type: application/json' \
+     -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' || echo "000")
+auth=$(curl -s -X POST "http://127.0.0.1:$PORT/mcp" \
+     -H "Authorization: Bearer $TOKEN" \
+     -H 'Content-Type: application/json' \
+     -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' || true)
+
+if [ "$unauth" = "401" ] && echo "$auth" | grep -q '"tools"'; then
+    echo "OK — lmcp listening on :$PORT as $NAME, Bearer-gated"
+else
+    echo "smoke test failed (unauth=$unauth, auth body below)"
+    echo "$auth" | head -c 500; echo
+    tail -20 /tmp/lmcp.err 2>/dev/null || true
+    exit 1
+fi
+
+cat <<INFO
+
+Token: $TOKEN
+
+Add to Claude Code ~/.claude.json on the client machine:
+
+    "$NAME": {
+        "type": "http",
+        "url": "http://$(hostname -s).local:$PORT/mcp",
+        "headers": { "Authorization": "Bearer $TOKEN" }
+    }
+
+(Use .fritz.box, .local, or the LAN IP depending on where the client lives.)
+INFO

server.lua

@@ -194,6 +194,60 @@ server:tool("write_file", "Write content to a file.", {
     return string.format("Written %d bytes to %s", #a.content, a.path)
 end)
 
+server:tool("edit_file", "Replace exact text in a file (literal match). Fails unless old_string is unique, unless replace_all=true.", {
+    type = "object",
+    properties = {
+        path = { type = "string", description = "Path to file" },
+        old_string = { type = "string", description = "Exact text to replace (literal, no regex)" },
+        new_string = { type = "string", description = "Replacement text" },
+        replace_all = { type = "boolean", description = "Replace every occurrence (default: false)", default = false },
+    },
+    required = { "path", "old_string", "new_string" },
+}, function(a)
+    if type(a.path) ~= "string" or a.path == "" then return "Error: path required" end
+    if type(a.old_string) ~= "string" then return "Error: old_string required" end
+    if type(a.new_string) ~= "string" then return "Error: new_string required" end
+    if a.old_string == "" then return "Error: old_string cannot be empty" end
+    if a.old_string == a.new_string then return "Error: new_string must differ from old_string" end
+
+    local f = io.open(a.path, 'rb')
+    if not f then return "Error: could not read " .. a.path end
+    local content = f:read('*a'); f:close()
+
+    local count, pos = 0, 1
+    while pos <= #content do
+        local i = content:find(a.old_string, pos, true)
+        if not i then break end
+        count = count + 1
+        pos = i + #a.old_string
+    end
+
+    if count == 0 then
+        return "Error: old_string not found in " .. a.path
+    end
+    if count > 1 and not a.replace_all then
+        return string.format("Error: old_string matches %d times in %s (use replace_all=true or provide more surrounding context to disambiguate)", count, a.path)
+    end
+
+    local parts, p, replaced = {}, 1, 0
+    while true do
+        local i = content:find(a.old_string, p, true)
+        if not i then break end
+        parts[#parts+1] = content:sub(p, i-1)
+        parts[#parts+1] = a.new_string
+        p = i + #a.old_string
+        replaced = replaced + 1
+        if not a.replace_all then break end
+    end
+    parts[#parts+1] = content:sub(p)
+
+    local w = io.open(a.path, 'wb')
+    if not w then return "Error: could not write " .. a.path end
+    w:write(table.concat(parts)); w:close()
+
+    return string.format("Edited %s: %d replacement(s)", a.path, replaced)
+end)
+
 server:tool("list_dir", "List directory contents.", {
     type = "object",
     properties = { path = { type = "string", default = "." } },