lnwjud

What is lnwjud?

lnwjud is a Windows-first local development gateway that exposes trusted local capabilities through the Model Context Protocol (MCP). It is designed for AI-assisted software development where the agent needs more than a text-only chat: it may need to inspect a repository, search code, edit files, review Git state, run project commands, manage owned processes, inspect Windows UI state, automate a managed browser, work with WSL, or call an additional local MCP server.

The runtime stays on the Windows machine. Local filesystem paths, processes, SQLite state, credentials, and capability backends are owned by lnwjud on that machine. Remote AI clients only receive the MCP requests and results that travel through the connection mode you choose.

For ChatGPT web and other supported OpenAI surfaces, lnwjud supports the official OpenAI Secure MCP Tunnel. The tunnel is outbound-only: tunnel-client runs beside lnwjud, reaches OpenAI over outbound HTTPS, forwards MCP work to lnwjud's Desktop loopback HTTP MCP, and returns the response without opening a public inbound port on the Windows machine.

Current version: v4.10.0

The v4.10.0 release target and runtime contract contain 218 configurable MCP tools, with 212 advertised by default because the six codex_* delegation tools are opt-in. The earlier 184-tool snapshot remains only as the compatibility baseline used by the v4 architecture; new v4 gateway capabilities are additive.

What's new in v4.10.0

• Replaces blanket mutation prompts with a typed, action-level policy. Full Access runs ordinary read/write/edit/replace/execute, Git, shell/process, Codex, Office/UI and remote mutations without confirmation; prompts are reserved for detected deletion/data-loss operations, destructive rewrites, and explicit Active Project escapes, while hard-blocked machine-level actions remain denied.
• Binds local mutations to the host-selected Active Project. A request-supplied workspace ID cannot widen authority. Full Access keeps ordinary work non-interactive, while destructive delete_file, Git, shell, and WSL families may use saved auto-approval only for exact targets proven inside the Active Project; broad, critical, ambiguous, or escaped forms still ask or fail closed.
• Makes file replacement reversible: existing text writes/patches/edits create checkpoints, Office/DOCX/PowerPoint binary replacements create byte-for-byte Recovery Trash backups, and restoring a replacement backup first preserves the current version as an Undo item.
• Makes direct file operations recoverable without making Full Access noisy: Safe/Balanced retain conservative replacement rules, while Full can write_file, apply_patch, edit, copy, move, and replace ordinary targets without prompts. Existing content is checkpointed/backed up where supported, and deletion remains limited to one file or one empty directory.
• Applies the same profile-aware mutation classifier across Git, shell/WSL, process/Codex, Office, scheduler, HTTP mutations, browser/UI actions, and Windows-native side effects, so Full does not receive duplicate backend prompts for ordinary work. Destructive actions are never automatically retried.
• Adds a Recovery Center that shows the real local Recovery Trash path, deleted items, pre-replacement binary backups, checkpoints, and rollback IDs. Critical-path deletion remains guarded; ordinary Full-profile edits/replacements use recovery/checkpoint protections without an extra prompt.
• Synchronizes the live catalog at 218 configurable tools / 212 advertised by default, including the recovery/checkpoint tools, and makes README catalog drift a generated release-check failure.

What's new in v4.9.1

• Adds first-class project lifecycle management in the Desktop Projects page: active projects can be archived, archived projects can be restored, and project registrations can be removed with a two-step confirmation.
• Treats archived workspaces as inactive trust-boundary entries: they remain in SQLite for management/history labels but are excluded from normal runtime/MCP workspace lookup until restored.
• Makes project removal registration-only. Removing a project from lnwjud does not delete its directory, files, Git repository, audit history, or checkpoints; system/machine-root workspaces are protected from archive/remove actions.
• Repairs selected-workspace state after archive/removal, stops the workspace index watcher, blocks lifecycle changes while tracked Desktop work is active, and restores an archived registration instead of creating a duplicate when the same path is added again.
• Keeps Home/Git selectors limited to active workspaces while Projects, Work Log, and Live Logs retain the management/history context needed to understand archived workspaces.

What's new in v4.9.0

• Adds real multi-workspace / multi-session operation on one lnwjud installation: Desktop workspace selection no longer restarts the MCP listener, HTTP/STDIO sessions have stable ownership boundaries, and process/Codex/shell/WSL/task handles are isolated by session and workspace.
• Makes destructive authorization request-scoped instead of relying on the Desktop-selected project, while keeping destructive auto-approval disabled by default, preserving Protected Critical Files, and supporting recoverable delete/restore.
• Makes shared activity and durable runtime state safe for concurrent owners with per-owner activity leases, session-namespaced state, atomic writes, inter-process locking, shared plugin/worktree ledgers, and fail-closed checkpoint persistence under I/O contention.
• Propagates workspace/session metadata through audit, Work Log, Live Logs, and process feeds; adds workspace/session filters, badges, scoped clear controls, and filtered log export without splitting global settings.
• Adds real two-session/two-workspace release acceptance and release-gate coverage, including parallel build/test/background/Git workflows, handle isolation, updater safety, packaging, and Windows installer verification.
• Fixes Work Log attribution for shell calls from clients with an older/stale schema: a registered workspace is inferred from cwd for logging only, and the task workspace is retained for later wait/status/logs/result/cancel activity without weakening permission or path policy.

What's new in v4.8.5

• Adds two user-configurable wait controls under Settings → Tools & Timeouts. MCP Poll / Tool Wait is adjustable from 5–60 seconds with a 5-second default, while Foreground Shell Wait is adjustable from 5–60 seconds with a 60-second default. Both limits are validated by the desktop IPC boundary and persisted in the local SQLite settings store.
• v4.8.5 originally applied both wait settings to the Desktop HTTP runtime and the then-shared direct STDIO / Secure Tunnel runtime. In v4.10.0 Secure Tunnel moved to the Desktop HTTP MCP; standalone/headless STDIO keeps its own runtime policy while shell and MCP polling continue to read the configured wait values.
• Uses the same configurable MCP poll window for experimental tasks/result and advertised task pollInterval, while preserving the durable background-task contract: reaching the wait limit never kills the command running on the machine.
• Strengthens agent guidance for long-running work: after one or two checks still report running, preserve the task ID and return control instead of tight-polling inside one ChatGPT turn. This reduces message-delivery timeouts without losing the background build, test, install, or packaging task.

What's new in v4.8.4

• Makes MCP command execution non-blocking by policy: shell and wsl_exec run requests are normalized to durable background execution and return a task handle immediately, while MCP wait polling is capped at 5 seconds. Long builds, tests, installs, and packaging jobs therefore keep running on the machine instead of holding one ChatGPT/MCP tool request open until it times out.
• Keeps the core ShellCapabilityBackend independent from that transport policy. Direct/internal foreground callers retain the 60-second synchronous wait ceiling; regression coverage verifies a foreground command running beyond 5 seconds still returns its terminal result normally.
• Bounds experimental MCP Tasks tasks/result to a short ~5-second request window. Non-terminal tasks direct clients back to tasks/get polling, while durable task state, logs, cancellation, and later result retrieval continue across runtime runs.
• Clarifies immediate-return process_start and project_* contracts, updates the live catalog to 214 configurable tools (208 advertised by default because the six codex_* delegation tools are opt-in), and synchronizes the README, architecture, packaging, and release metadata for v4.8.4.
• Documents the separately co