v1.1.2

Security:
- Add Bearer Token auth for Streamable HTTP mode (--host, --token flags)
- Require token when binding to non-loopback address

Bug Fixes:
- Fix @mention false positives by excluding /@ pattern (macOS & Windows)
- Improve macOS activateLine stability with retry mechanism (up to 3 retries)
- Improve macOS selectChat reliability with window existence check and error handling

--

安全性強化：
- Streamable HTTP 模式新增 Bearer Token 驗證（--host、--token 參數）
- 綁定非 loopback 位址時強制要求提供 Token

Bug 修復：
- 修正 @mention 解析誤判，排除 /@ 格式（macOS & Windows）
- 修正 macOS activateLine 穩定性，新增重試機制（最多 3 次）
- 修正 macOS selectChat 穩定性，新增 window 存在性檢查與錯誤處理

Author: dtwang

README.md

@@ -123,12 +123,18 @@ LINE Desktop MCP 是一個基於 Model Context Protocol 的整合工具，讓 AI
 **啟動 Streamable HTTP 模式：**
 
 ```bash
+# 本機使用（僅 localhost）
 npx line-desktop-mcp@latest --http-mode --port 3000
+
+# 開放外部連線（需搭配 token）
+npx line-desktop-mcp@latest --http-mode --host 0.0.0.0 --port 3000 --token YOUR_SECRET
 ```
 
 **參數說明：**
 - `--http-mode`：啟用 Streamable HTTP 模式，使用 HTTP streaming 而非 stdio
 - `--port <port>`：指定 HTTP 伺服器的 port（預設：3000）
+- `--host <host>`：指定綁定的網路介面（預設：`127.0.0.1`）
+- `--token <secret>`：設定 Bearer Token 驗證密鑰。當 `--host` 設為非 loopback 位址時為必填，以確保安全性
 
 **MCP 端點配置：**
 
@@ -323,12 +329,18 @@ In addition to the default stdio mode, this project also supports running via St
 **Start Streamable HTTP Mode:**
 
 ```bash
+# Local use (localhost only)
 npx line-desktop-mcp@latest --http-mode --port 3000
+
+# Allow external connections (token required)
+npx line-desktop-mcp@latest --http-mode --host 0.0.0.0 --port 3000 --token YOUR_SECRET
 ```
 
 **Parameters:**
 - `--http-mode`: Enable Streamable HTTP mode, using HTTP streaming instead of stdio
 - `--port <port>`: Specify the HTTP server port (default: 3000)
+- `--host <host>`: Specify the network interface to bind (default: `127.0.0.1`)
+- `--token <secret>`: Set Bearer Token authentication secret. Required when `--host` is set to a non-loopback address for security
 
 **MCP Endpoint Configuration:**
 

src/automation/macos-line-automation.js

@@ -93,6 +93,26 @@ export class MacOSLineAutomation {
       tell application "${this.appleEsc(this.lineAppName)}"
         activate
       end tell
+
+      -- 檢查是否成功成為前景
+      tell application "System Events"
+          repeat with i from 1 to 3
+              if frontmost of process "${this.appleEsc(this.lineAppName)}" is true then
+                  exit repeat
+              else
+                  delay 0.5
+                  tell application "${this.appleEsc(this.lineAppName)}" to activate
+              end if
+          end repeat
+      end tell
+
+      -- 檢查是否超過重試次數
+      tell application "System Events"
+          if frontmost of process "${this.appleEsc(this.lineAppName)}" is false then
+              error "無法將 LINE 置於前景。"
+          end if
+      end tell
+
     `;
     try {
       await execAppleScript(script);
@@ -111,10 +131,39 @@ export class MacOSLineAutomation {
 
          set the clipboard to "${this.appleEsc(chatName)}"
 
-          -- 叫出搜尋用點擊
-            -- 依你原始路徑抓元素clea
-          set theSearch to text field 1 of splitter group 1 of window 1
-          
+          -- 點擊『聊天』Icon
+          try
+          set the lineWin to window 1 
+          on error errMsg number errNum
+              if errNum is -1719 then
+                  return false
+              else
+                  error errMsg number errNum
+              end if
+          end try
+
+          -- 取得位置與大小（全域座標）
+          set {xPosition, yPosition} to position of lineWin
+          set {xSize, ySize} to size of lineWin
+
+          set cx to xPosition + 32
+          set cy to yPosition + 110
+
+          ${this.cliclickShellClick('cx', 'cy')}
+
+          delay ${this.delayMid}
+
+          -- 點擊『搜尋』textbox
+          try
+          set theSearch to text field 1 of splitter group 1 of window 1 
+          on error errMsg number errNum
+              if errNum is -1719 then
+                  return false
+              else
+                  error errMsg number errNum
+              end if
+          end try
+
           -- 取得位置與大小（全域座標）
           set {xPosition, yPosition} to position of theSearch
           set {xSize, ySize} to size of theSearch
@@ -267,6 +316,7 @@ export class MacOSLineAutomation {
     let currentPart = '';
 
     // Use regex to split by @mentions pattern
+    /*
     const parts = message.split(/(@\S+\s)/g);
     
     for (let i = 0; i < parts.length; i++) {
@@ -284,7 +334,27 @@ export class MacOSLineAutomation {
         currentPart += part;
       }
     }
+    */
+    
+    // Use regex to split by @mentions pattern (已排除 /@ 這個格式)
+    const parts = message.split(/((?<!\/)@\S+\s)/g);
 
+    for (let i = 0; i < parts.length; i++) {
+      const part = parts[i];
+      if (part.match(/^(?<!\/)@\S+\s$/)) {
+        // If we have accumulated text before this @mention, add it as a separate part
+        if (currentPart) {
+          messageParts.push(currentPart);
+          currentPart = '';
+        }
+        // Add the @mention as its own part
+        messageParts.push(part);
+      } else {
+        // Accumulate non-@mention text
+        currentPart += part;
+      }
+    }
+
     // Add any remaining text
     if (currentPart) {
       messageParts.push(currentPart);

src/automation/windows-line-automation.js

@@ -236,6 +236,7 @@ ${script}
     const messageParts = [];
     let currentPart = '';
 
+    /*
     const parts = message.split(/(@\S+\s)/g);
 
     for (let i = 0; i < parts.length; i++) {
@@ -250,7 +251,28 @@ ${script}
         currentPart += part;
       }
     }
+    */
+    
+    // Use regex to split by @mentions pattern (已排除 /@ 這個格式)
+    const parts = message.split(/((?<!\/)@\S+\s)/g);
+    
+    for (let i = 0; i < parts.length; i++) {
+      const part = parts[i];
+      if (part.match(/^(?<!\/)@\S+\s$/)) {
+        // If we have accumulated text before this @mention, add it as a separate part
+        if (currentPart) {
+          messageParts.push(currentPart);
+          currentPart = '';
+        }
+        // Add the @mention as its own part
+        messageParts.push(part);
+      } else {
+        // Accumulate non-@mention text
+        currentPart += part;
+      }
+    }
 
+    // Add any remaining text
     if (currentPart) {
       messageParts.push(currentPart);
     }

src/server.js

@@ -435,7 +435,7 @@ class LineDesktopMCPServer {
   }
 
 
-  async run(useSSE = false, port = 3000) {
+  async run(useSSE = false, port = 3000, host = '127.0.0.1', token = null) {
     if (useSSE) {
       // 使用 Streamable HTTP 模式（符合 MCP 2025-06-18 規範）
       const app = express();
@@ -454,6 +454,23 @@ class LineDesktopMCPServer {
 
       app.use(express.json());
 
+      // Bearer token 驗證中間件
+      if (token) {
+        app.use('/mcp', (req, res, next) => {
+          const authHeader = req.headers['authorization'];
+          if (!authHeader || authHeader !== `Bearer ${token}`) {
+            console.error(`[AUTH] Rejected request from ${req.ip} - invalid or missing token`);
+            res.status(401).json({
+              jsonrpc: '2.0',
+              error: { code: -32001, message: 'Unauthorized: invalid or missing Bearer token' },
+              id: null
+            });
+            return;
+          }
+          next();
+        });
+      }
+      
       // MCP 端點路徑
       const endpoint = '/mcp';
 
@@ -555,11 +572,13 @@ class LineDesktopMCPServer {
       });
 
 
-      app.listen(port, '0.0.0.0', () => {
+      app.listen(port, host, () => {
         console.error(`LINE Desktop MCP Server running on Streamable HTTP mode`);
-        console.error(`  Local:   http://127.0.0.1:${port}${endpoint}`);
-        console.error(`  Network: http://0.0.0.0:${port}${endpoint}`);
-        console.error(`  Health:  http://127.0.0.1:${port}/health`);
+        console.error(`  Listening: http://${host}:${port}${endpoint}`);
+        console.error(`  Health:    http://${host}:${port}/health`);
+        if (token) {
+          console.error(`  Auth:      Bearer token required`);
+        }
         console.error(`Ready to accept connections...`);
       });
     } else {
@@ -576,7 +595,9 @@ function parseArgs() {
   const args = process.argv.slice(2);
   const config = {
     sseMode: false,
-    port: 3000
+    port: 3000,
+    host: '127.0.0.1',
+    token: null
   };
 
   for (let i = 0; i < args.length; i++) {
@@ -585,6 +606,12 @@ function parseArgs() {
     } else if (args[i] === '--port' && i + 1 < args.length) {
       config.port = parseInt(args[i + 1], 10);
       i++; // 跳過下一個參數
+    } else if (args[i] === '--host' && i + 1 < args.length) {
+      config.host = args[i + 1];
+      i++;
+    } else if (args[i] === '--token' && i + 1 < args.length) {
+      config.token = args[i + 1];
+      i++;
     }
   }
 
@@ -596,11 +623,21 @@ await firstRunSetup();
 
 // 解析命令列參數並啟動伺服器
 const config = parseArgs();
+
+// 安全檢查：非 loopback 綁定必須提供 token
+if (config.sseMode && config.host !== '127.0.0.1' && config.host !== 'localhost') {
+  if (!config.token) {
+    console.error('ERROR: Binding to a non-loopback address requires --token <secret> for authentication.');
+    console.error('  Example: npx line-desktop-mcp --http-mode --host 0.0.0.0 --port 3000 --token MY_SECRET');
+    process.exit(1);
+  }
+}
+
 const server = new LineDesktopMCPServer();
 
 if (config.sseMode) {
-  console.error(`Starting server in  Streamable HTTP  mode on port ${config.port}`);
-  server.run(true, config.port).catch(console.error);
+  console.error(`Starting server in  Streamable HTTP  mode on ${config.host}:${config.port}`);
+  server.run(true, config.port, config.host, config.token).catch(console.error);
 } else {
   console.error('Starting server in stdio mode');
   server.run(false).catch(console.error);