scripts/lmcp-install-macos.sh: fix for real-world Homebrew

Original draft assumed `brew install lua luasocket` works. It doesn't:
luasocket isn't a brew formula (install via luarocks), and default `lua`
is 5.5 while the rest of the fleet is on 5.4. Fix tested on riemann
(Intel Mac, macOS 14.8.3):

- Pin to lua@5.4 (keg-only brew formula) — matches fleet library paths.
- Install luasocket via luarocks into the user-local rocks tree.
- Source brew shellenv ourselves so non-login bash shells can find brew.
- Bake LUA_PATH / LUA_CPATH into the LaunchAgent plist so the service
  resolves `require 'socket'` from ~/.luarocks/.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

lmcp.lua

@@ -33,12 +33,17 @@ function lmcp.new(name, opts)
     self.port = opts.port or 8080
     self.tools = {}
     self._session_id = nil
-    -- Auth: explicit opt > conf file > nil (no auth)
+    -- Auth: explicit opt > conf file > LMCP_TOKEN env > nil (no auth)
     if opts.auth_token then
         self._auth_token = opts.auth_token
     elseif opts.conf then
         local conf = read_conf(opts.conf)
         self._auth_token = conf['.godparticle']
+    else
+        local env_token = os.getenv("LMCP_TOKEN")
+        if env_token and env_token ~= "" then
+            self._auth_token = env_token
+        end
     end
     return self
 end

scripts/lmcp-install-macos.sh

@@ -0,0 +1,157 @@
+#!/bin/bash
+# Install lmcp on macOS via Homebrew.
+#
+# Pins to lua@5.4 (keg-only brew formula) to keep library paths aligned
+# with the rest of the fleet (Arch/ALARM, Debian). Installs luasocket via
+# luarocks into the user-local rocks tree (~/.luarocks/) and bakes the
+# required LUA_PATH / LUA_CPATH into the LaunchAgent plist so the service
+# can `require 'socket'`.
+#
+# Usage (from lmcp repo root):
+#   ./scripts/lmcp-install-macos.sh
+#
+# Uninstall:
+#   launchctl unload ~/Library/LaunchAgents/de.reauktion.marfrit.lmcp.plist
+#   rm ~/Library/LaunchAgents/de.reauktion.marfrit.lmcp.plist
+#   rm $(brew --prefix)/etc/lmcp/token
+
+set -euo pipefail
+
+# brew is only on PATH in login shells by default; source its env explicitly
+# so this works under a plain non-login bash too.
+if ! command -v brew >/dev/null 2>&1; then
+    for candidate in /opt/homebrew/bin/brew /usr/local/bin/brew; do
+        if [ -x "$candidate" ]; then
+            eval "$("$candidate" shellenv)"
+            break
+        fi
+    done
+fi
+command -v brew >/dev/null 2>&1 || { echo "error: Homebrew not found"; exit 1; }
+
+REPO=${REPO:-$(cd "$(dirname "$0")/.." && pwd)}
+for f in lmcp.lua json.lua server.lua example_server.lua; do
+    [ -f "$REPO/$f" ] || { echo "error: $REPO/$f not found — run from lmcp repo root or set REPO="; exit 1; }
+done
+
+echo "==> brew install lua@5.4 luarocks"
+brew install --quiet lua@5.4 luarocks
+
+LUA54_PREFIX=$(brew --prefix lua@5.4)
+LUA54=$LUA54_PREFIX/bin/lua5.4
+BREW_PREFIX=$(brew --prefix)
+[ -x "$LUA54" ] || { echo "error: $LUA54 missing after brew install"; exit 1; }
+
+echo "==> luarocks install luasocket (user-local, pinned to lua@5.4)"
+luarocks --lua-version 5.4 --lua-dir "$LUA54_PREFIX" install --local luasocket
+
+LR_PATH=$(luarocks --lua-version 5.4 --lua-dir "$LUA54_PREFIX" path --lr-path)
+LR_CPATH=$(luarocks --lua-version 5.4 --lua-dir "$LUA54_PREFIX" path --lr-cpath)
+DEFAULT_LUA_P="$BREW_PREFIX/share/lua/5.4/?.lua;$BREW_PREFIX/share/lua/5.4/?/init.lua;$BREW_PREFIX/lib/lua/5.4/?.lua;$BREW_PREFIX/lib/lua/5.4/?/init.lua;./?.lua;./?/init.lua"
+DEFAULT_LUA_CP="$BREW_PREFIX/lib/lua/5.4/?.so;./?.so"
+FULL_LUA_P="$DEFAULT_LUA_P;$LR_PATH"
+FULL_LUA_CP="$DEFAULT_LUA_CP;$LR_CPATH"
+
+echo "==> install library files into $BREW_PREFIX/share/lua/5.4/"
+install -d "$BREW_PREFIX/share/lua/5.4"
+install -m 644 "$REPO/lmcp.lua"   "$BREW_PREFIX/share/lua/5.4/lmcp.lua"
+install -m 644 "$REPO/json.lua"   "$BREW_PREFIX/share/lua/5.4/json.lua"
+install -m 644 "$REPO/server.lua" "$BREW_PREFIX/share/lua/5.4/server.lua"
+install -m 755 "$REPO/example_server.lua" "$BREW_PREFIX/bin/lmcp-example"
+
+# Token: retain existing, mint new otherwise
+TOKEN_FILE="$BREW_PREFIX/etc/lmcp/token"
+install -d -m 755 "$BREW_PREFIX/etc/lmcp"
+if [ -r "$TOKEN_FILE" ]; then
+    TOKEN=$(cat "$TOKEN_FILE")
+    echo "==> reusing token from $TOKEN_FILE"
+else
+    TOKEN=$(openssl rand -hex 32)
+    umask 077
+    printf '%s\n' "$TOKEN" > "$TOKEN_FILE"
+    chmod 600 "$TOKEN_FILE"
+    echo "==> minted new token, stored at $TOKEN_FILE (0600)"
+fi
+
+LABEL="de.reauktion.marfrit.lmcp"
+PLIST="$HOME/Library/LaunchAgents/$LABEL.plist"
+PORT="${LMCP_PORT:-8080}"
+NAME="${LMCP_NAME:-$(hostname -s)-tools}"
+
+echo "==> write LaunchAgent $PLIST"
+mkdir -p "$HOME/Library/LaunchAgents"
+cat > "$PLIST" <<PLIST
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>$LABEL</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>$LUA54</string>
+        <string>$BREW_PREFIX/share/lua/5.4/server.lua</string>
+    </array>
+    <key>EnvironmentVariables</key>
+    <dict>
+        <key>LMCP_PORT</key>
+        <string>$PORT</string>
+        <key>LMCP_NAME</key>
+        <string>$NAME</string>
+        <key>LMCP_TOKEN</key>
+        <string>$TOKEN</string>
+        <key>LUA_PATH</key>
+        <string>$FULL_LUA_P</string>
+        <key>LUA_CPATH</key>
+        <string>$FULL_LUA_CP</string>
+    </dict>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>KeepAlive</key>
+    <true/>
+    <key>StandardOutPath</key>
+    <string>/tmp/lmcp.log</string>
+    <key>StandardErrorPath</key>
+    <string>/tmp/lmcp.err</string>
+</dict>
+</plist>
+PLIST
+chmod 600 "$PLIST"  # plist contains token
+
+echo "==> (re)load LaunchAgent"
+launchctl unload "$PLIST" 2>/dev/null || true
+launchctl load "$PLIST"
+
+sleep 2
+echo "==> smoke test (unauth expected 401, Bearer expected 200)"
+unauth=$(curl -s -o /dev/null -w '%{http_code}' --max-time 3 -X POST "http://127.0.0.1:$PORT/mcp" \
+     -H 'Content-Type: application/json' \
+     -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' || echo "000")
+auth=$(curl -s --max-time 3 -X POST "http://127.0.0.1:$PORT/mcp" \
+     -H "Authorization: Bearer $TOKEN" \
+     -H 'Content-Type: application/json' \
+     -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' || true)
+
+if [ "$unauth" = "401" ] && echo "$auth" | grep -q '"tools"'; then
+    echo "OK — lmcp listening on :$PORT as $NAME, Bearer-gated"
+else
+    echo "smoke test failed (unauth=$unauth, auth body below)"
+    echo "$auth" | head -c 500; echo
+    tail -20 /tmp/lmcp.err 2>/dev/null || true
+    exit 1
+fi
+
+cat <<INFO
+
+Token: $TOKEN
+
+Add to Claude Code ~/.claude.json on the client machine:
+
+    "$NAME": {
+        "type": "http",
+        "url": "http://$(hostname -s).fritz.box:$PORT/mcp",
+        "headers": { "Authorization": "Bearer $TOKEN" }
+    }
+
+(Use .fritz.box, .local, or the LAN IP depending on where the client lives.)
+INFO

server.lua

@@ -194,6 +194,60 @@ server:tool("write_file", "Write content to a file.", {
     return string.format("Written %d bytes to %s", #a.content, a.path)
 end)
 
+server:tool("edit_file", "Replace exact text in a file (literal match). Fails unless old_string is unique, unless replace_all=true.", {
+    type = "object",
+    properties = {
+        path = { type = "string", description = "Path to file" },
+        old_string = { type = "string", description = "Exact text to replace (literal, no regex)" },
+        new_string = { type = "string", description = "Replacement text" },
+        replace_all = { type = "boolean", description = "Replace every occurrence (default: false)", default = false },
+    },
+    required = { "path", "old_string", "new_string" },
+}, function(a)
+    if type(a.path) ~= "string" or a.path == "" then return "Error: path required" end
+    if type(a.old_string) ~= "string" then return "Error: old_string required" end
+    if type(a.new_string) ~= "string" then return "Error: new_string required" end
+    if a.old_string == "" then return "Error: old_string cannot be empty" end
+    if a.old_string == a.new_string then return "Error: new_string must differ from old_string" end
+
+    local f = io.open(a.path, 'rb')
+    if not f then return "Error: could not read " .. a.path end
+    local content = f:read('*a'); f:close()
+
+    local count, pos = 0, 1
+    while pos <= #content do
+        local i = content:find(a.old_string, pos, true)
+        if not i then break end
+        count = count + 1
+        pos = i + #a.old_string
+    end
+
+    if count == 0 then
+        return "Error: old_string not found in " .. a.path
+    end
+    if count > 1 and not a.replace_all then
+        return string.format("Error: old_string matches %d times in %s (use replace_all=true or provide more surrounding context to disambiguate)", count, a.path)
+    end
+
+    local parts, p, replaced = {}, 1, 0
+    while true do
+        local i = content:find(a.old_string, p, true)
+        if not i then break end
+        parts[#parts+1] = content:sub(p, i-1)
+        parts[#parts+1] = a.new_string
+        p = i + #a.old_string
+        replaced = replaced + 1
+        if not a.replace_all then break end
+    end
+    parts[#parts+1] = content:sub(p)
+
+    local w = io.open(a.path, 'wb')
+    if not w then return "Error: could not write " .. a.path end
+    w:write(table.concat(parts)); w:close()
+
+    return string.format("Edited %s: %d replacement(s)", a.path, replaced)
+end)
+
 server:tool("list_dir", "List directory contents.", {
     type = "object",
     properties = { path = { type = "string", default = "." } },