[houko]

Summary

Kando can now be driven from outside its window: a kando command line, an MCP server for AI agents, and WebMCP tools on kando.yldm.ai.

Control socket (apps/kando/remote, state_remote.go, remote_api.go)

The running app listens on kando.sock beside its settings (KANDO_SOCKET overrides), newline-delimited JSON like MyGo's automation plugin. Methods: status, films.list, films.get, subtitles.get, jobs.list, jobs.add, jobs.cancel, sites.search, app.show.

• App state is read and changed only on the UI thread (remote.OnUI). Files are read on the connection's goroutine. A request whose deadline passed before the UI thread reached it never runs, so a timed-out jobs.add queues nothing.
• jobs.add goes through the same precheck, newJob and queueAdd as 开始处理, and reports each skipped source with the library's own wording.
• The socket is 0600 in a folder that must belong to the user and not be group or world writable. Listen only replaces a dead socket, never a regular file.
• Clients start the app when it is not running: open -g on macOS, -n when KANDO_SOCKET names another copy's socket; the executable itself elsewhere. The app now takes MyGo's single-instance lock, so a second launch brings the window forward instead of opening a second copy that writes the same library.json.

kando command line (apps/kando/cli)

The app's own executable, run with a command: status, list, show, subtitles (srt/text/json, --original/--translation), jobs, add (--wait), cancel, sites, open, mcp, version, help; --json on every app command.

• With no arguments, macOS launch arguments, a file path or a URL, it opens the window as before. Anything else is a command, and a typo is a usage error rather than a window.
• Exit codes 0/1/2. Third-party text (titles, subtitles, errors) is stripped of terminal control characters.
• On Windows it attaches to the parent console, as MyGo builds a GUI-subsystem executable.
• Linux packages now link kando on PATH ("linux": {"command": "kando"} in mygo.json).

kando mcp (apps/kando/mcpserver)

A stdio MCP server built on the official SDK github.com/modelcontextprotocol/go-sdk v1.8.0 (new dependency, approved). Nine tools: kando_status, kando_list_films, kando_get_film, kando_get_subtitles, kando_add_videos, kando_list_jobs, kando_cancel_job, kando_search_sites, kando_open.

• Typed inputs and outputs, with read-only, destructive and idempotent annotations.
• App errors come back as tool errors the agent can read (not_ready: 先在「语音识别」里选一个模型).
• The instructions and descriptions say titles and subtitles are third-party data, not instructions, and that add and cancel act on the user's computer.

Settings › General: 命令行与 MCP

• 安装 links kando to the app in /usr/local/bin, /opt/homebrew/bin or ~/.local/bin, without sudo. It replaces only links to a Kando (this app, a Kando.app, /opt/kando/kando, the install-script copy), never another program's kando.
• It refuses while Kando runs from a read-only disk image or an App Translocation copy, and asks to move it to Applications first.
• 拷贝配置 copies the mcpServers JSON, and 拷贝命令 the claude mcp add command. Both are in five languages.

WebMCP on kando.yldm.ai (apps/site)

The page registers four tools through navigator.modelContext when the browser has it:

• search_supported_sites, over the app's catalog, fetched lazily;
• get_download, the right file of the latest release for the visitor's system;
• get_started;
• list_features.

The landing page also gets a feature card for the command line, MCP and WebMCP.

Docs

A "Command line and MCP" section in the five READMEs, and the README screenshots of Settings › General are retaken.

Screenshots

Settings › General, scrolled to the new card (before / after, and after with the command installed and the config copied):

README screenshot, en (before / after):

Verification

• go test ./apps/kando/... ./packages/core/... ./packages/media/... ./apps/site/..., go vet, go tool mygo vet, go tool mygo i18n check, shellcheck, and Linux/Windows cross-builds all pass.
• New tests cover:
  • every socket method;
  • stale and foreign files at the socket path, and an unsafe socket folder;
  • client recovery after a timeout, and OnUI skipping work whose deadline passed;
  • every CLI command, flag, exit code and the window-or-command decision;
  • each MCP tool through the SDK's in-memory transport;
  • the symlink installer refusing npm and Homebrew links and temporary locations;
  • the WebMCP script under node with a fake navigator.modelContext.
• Real app, isolated HOME and socket: a built Kando.app was started by kando status itself (1.5 s). sites, list, jobs --json, add (not ready: no speech model) and a typo (exit 2) behaved as documented. An MCP client over CommandTransport listed the nine tools and called four of them against that app.
• WebMCP: headless Chrome 156 with the CDP WebMCP domain saw the four tools and their schemas registered by webmcp.js on the built site.
• Not covered by hand: a full download → transcription → translation started from the CLI (the isolated HOME had no speech model or EveryAPI login), and the Windows console attach (cross-compiled only).