@remcp/remcp 0.2.105 → 0.2.107

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/remcp",
-  "version": "0.2.105",
+  "version": "0.2.107",
   "description": "ReMCP device client: pair a computer with ReMCP and run the outbound-only agent that hosts the local MCP runtime.",
   "type": "module",
   "license": "MIT",

package/src/agent-update.mjs

@@ -1,4 +1,4 @@
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, lstatSync, readFileSync, realpathSync } from 'node:fs';
 import path from 'node:path';
 import process from 'node:process';
 import { spawn, spawnSync } from 'node:child_process';
@@ -29,15 +29,28 @@ function globalNodeModules() {
   return String(result.stdout || '').trim();
 }
 
+function resolveRuntimeEntry(base, runtime) {
+  const packageRoot = path.resolve(base, ...runtime.packageName.split('/'));
+  const candidate = path.resolve(packageRoot, ...runtime.entry.split(/[\\/]+/));
+  const relative = path.relative(packageRoot, candidate);
+  if (!relative || relative.startsWith('..') || path.isAbsolute(relative)) throw new Error('Runtime entry resolves outside its package');
+  if (!existsSync(candidate)) return null;
+  const realPackageRoot = realpathSync(packageRoot);
+  const realCandidate = realpathSync(candidate);
+  const realRelative = path.relative(realPackageRoot, realCandidate);
+  if (realRelative.startsWith('..') || path.isAbsolute(realRelative) || !lstatSync(realCandidate).isFile()) throw new Error('Runtime entry is not a regular package file');
+  return realCandidate;
+}
+
 export function localRuntimeEntry(runtimeValue) {
   const runtime = normalizeRuntime(runtimeValue);
   const localModules = packageLocalNodeModules();
   if (localModules) {
-    const sibling = path.join(localModules, ...runtime.packageName.split('/'), ...runtime.entry.split(/[\\/]+/));
-    if (existsSync(sibling)) return sibling;
+    const sibling = resolveRuntimeEntry(localModules, runtime);
+    if (sibling) return sibling;
   }
-  const candidate = path.join(globalNodeModules(), ...runtime.packageName.split('/'), ...runtime.entry.split(/[\\/]+/));
-  if (!existsSync(candidate)) throw new Error('ReMCP local runtime is not installed. Run `remcp install`.');
+  const candidate = resolveRuntimeEntry(globalNodeModules(), runtime);
+  if (!candidate) throw new Error('ReMCP local runtime is not installed. Run `remcp install`.');
   return candidate;
 }
 

package/src/agent.mjs

@@ -47,10 +47,12 @@ const RUNTIME_TOOLS_RETRY_MAX_MS = 30_000;
 // timeout while the device keeps working invisibly.
 const CALL_TIMEOUT_MARGIN_MS = 10_000;
 
-function normalizedServerUrl(value) {
+function normalizedServerUrl(value, { allowInsecure = false } = {}) {
   const url = new URL(String(value || ''));
   if (url.protocol !== 'https:' && url.protocol !== 'http:') throw new Error('serverUrl must use http or https');
   if (url.username || url.password) throw new Error('serverUrl must not embed credentials');
+  const loopback = ['localhost', '127.0.0.1', '::1', '[::1]'].includes(url.hostname.toLowerCase());
+  if (url.protocol === 'http:' && !loopback && !allowInsecure) throw new Error('Remote serverUrl must use https');
   url.hash = '';
   url.search = '';
   return url.href.replace(/\/$/, '');
@@ -88,7 +90,7 @@ function deviceMetrics(extra = {}) {
 }
 
 export async function runAgent(options) {
-  const serverUrl = normalizedServerUrl(options.serverUrl);
+  const serverUrl = normalizedServerUrl(options.serverUrl, { allowInsecure: options.allowInsecureTransport === true || process.env.REMCP_ALLOW_INSECURE_TRANSPORT === 'true' });
   const deviceToken = String(options.deviceToken || '');
   const deviceId = String(options.deviceId || '');
   const deviceName = String(options.deviceName || os.hostname());
@@ -524,7 +526,7 @@ export async function runAgent(options) {
     try {
       // This request contains no local file payload; the config-derived URL is the explicitly paired relay.
       // codeql[js/file-access-to-http]
-      const response = await fetch(`${serverUrl}/api/agent/version`, { signal: AbortSignal.timeout(UPDATE_CHECK_TIMEOUT_MS) });
+      const response = await fetch(`${serverUrl}/api/agent/version`, { redirect: 'error', signal: AbortSignal.timeout(UPDATE_CHECK_TIMEOUT_MS) });
       if (!response.ok) return;
       const advertised = await response.json();
       const minimum = advertised.minimum;

package/src/cli/connect.mjs

@@ -29,6 +29,18 @@ export function openInBrowser(url) {
   } catch {}
 }
 
+export function assertSecureServerUrl(value, { allowInsecure = false } = {}) {
+  let url;
+  try { url = new URL(String(value || '')); } catch { throw new Error('server must be a valid URL'); }
+  if (!['https:', 'http:'].includes(url.protocol)) throw new Error('server must use http or https');
+  if (url.username || url.password) throw new Error('server must not embed credentials');
+  const loopback = ['localhost', '127.0.0.1', '::1', '[::1]'].includes(url.hostname.toLowerCase());
+  if (url.protocol === 'http:' && !loopback && !allowInsecure) throw new Error('Remote server must use https');
+  url.hash = '';
+  url.search = '';
+  return url.href.replace(/\/$/, '');
+}
+
 const TRANSIENT_FETCH_RETRY_DELAY_MS = 150;
 
 async function fetchWithTransientRetry(url, options) {
@@ -48,7 +60,9 @@ async function fetchWithTransientRetry(url, options) {
 // browser while signed in, and this process collects the credential by polling. The device never
 // sees a browser session or an account password.
 export async function pairWithDeviceCode(server, flags) {
+  server = assertSecureServerUrl(server, { allowInsecure: flags?.['allow-insecure-transport'] === true });
   const authorization = await fetchWithTransientRetry(`${server}/oauth/device_authorization`, {
+    redirect: 'error',
     method: 'POST',
     headers: { 'content-type': 'application/json' },
     body: JSON.stringify({
@@ -73,6 +87,7 @@ export async function pairWithDeviceCode(server, flags) {
     await sleep(intervalMs);
     const response = await fetchWithTransientRetry(`${server}/oauth/token`, {
       method: 'POST',
+      redirect: 'error',
       headers: { 'content-type': 'application/x-www-form-urlencoded' },
       body: new URLSearchParams({
         grant_type: 'urn:ietf:params:oauth:grant-type:device_code',

package/src/cli/service.mjs

@@ -33,6 +33,7 @@ function npmGlobalInstallArgs(specs, { preferOnline = false } = {}) {
     ...(preferOnline ? ['--prefer-online'] : []),
     '--no-audit',
     '--no-fund',
+    '--ignore-scripts',
     '--loglevel=error',
   ];
 }

package/src/cli/update.mjs

@@ -9,6 +9,7 @@ import { isRuntimeSpecFor, normalizeRuntime } from '../runtime.mjs';
 import { PACKAGE_NAME, VERSION } from '../version.mjs';
 
 import { loadConfig, saveConfig } from './config.mjs';
+import { assertSecureServerUrl } from './connect.mjs';
 import { installedVersion } from './doctor.mjs';
 import { linuxServiceFile, macServiceFile, officialOrigin } from './env.mjs';
 import { currentInstallationInfo, ensureMacCliCommand, ensureServiceIfRecorded, installationVersionsAtCliPath, npmGlobalUpdate, persistentServiceExpected, rememberCurrentInstallation, restartPersistentServiceIfInstalled, serviceInstallationInfo, syncKnownInstallations } from './service.mjs';
@@ -48,11 +49,15 @@ export async function resolveUpdateTargets({
   env = process.env,
   fetchImpl = globalThis.fetch,
 }) {
+  const validatedServerUrl = assertSecureServerUrl(cfg.serverUrl, {
+    allowInsecure: cfg.allowInsecureTransport === true || flags['allow-insecure-transport'] === true || env.REMCP_ALLOW_INSECURE_TRANSPORT === 'true',
+  });
+  const validatedCfg = { ...cfg, serverUrl: validatedServerUrl };
   const requestedRuntime = typeof flags.runtime === 'string' ? flags.runtime.trim() : '';
   const requestedClient = typeof flags.client === 'string' ? flags.client.trim() : '';
   const latestClient = `${PACKAGE_NAME}@latest`;
   const currentClient = `${PACKAGE_NAME}@${VERSION}`;
-  const trusted = runtimeTrustAllowed(cfg, flags, env);
+  const trusted = runtimeTrustAllowed(validatedCfg, flags, env);
 
   let clientSpec = latestClient;
   if (requestedClient) {
@@ -63,28 +68,28 @@ export async function resolveUpdateTargets({
   if (requestedRuntime) {
     // Only `<configured package>@<semver>` is installable: an alias, a git/URL/file spec, a tag or
     // a range would run code the user never agreed to.
-    if (!isRuntimeSpecFor(cfg.runtime.packageName, requestedRuntime)) {
-      throw new Error(`--runtime must be ${cfg.runtime.packageName}@<version>`);
+    if (!isRuntimeSpecFor(validatedCfg.runtime.packageName, requestedRuntime)) {
+      throw new Error(`--runtime must be ${validatedCfg.runtime.packageName}@<version>`);
     }
     if (!trusted) {
-      throw new Error(`This machine was paired without trusting ${cfg.serverUrl} to choose a runtime version. Re-run with --trust-runtime if you trust that server.`);
+      throw new Error(`This machine was paired without trusting ${validatedCfg.serverUrl} to choose a runtime version. Re-run with --trust-runtime if you trust that server.`);
     }
     const runtimeSpec = normalizeRuntime({
       kind: 'npm',
-      packageName: cfg.runtime.packageName,
+      packageName: validatedCfg.runtime.packageName,
       packageSpec: requestedRuntime,
-      entry: cfg.runtime.entry,
+      entry: validatedCfg.runtime.entry,
     }).packageSpec;
-    if (requestedClient && !releasePairMatches(clientSpec, cfg.runtime.packageName, runtimeSpec)) {
+    if (requestedClient && !releasePairMatches(clientSpec, validatedCfg.runtime.packageName, runtimeSpec)) {
       throw new Error('The client and first-party runtime must use the same exact release version.');
     }
-    if (!requestedClient && cfg.runtime.packageName === '@remcp/runtime' && specVersion(cfg.runtime.packageName, runtimeSpec) !== VERSION) {
+    if (!requestedClient && validatedCfg.runtime.packageName === '@remcp/runtime' && specVersion(validatedCfg.runtime.packageName, runtimeSpec) !== VERSION) {
       throw new Error(`--runtime without --client must match the running client version ${VERSION}`);
     }
     return {
       clientSpec: requestedClient ? clientSpec : currentClient,
       runtimeSpec,
-      persistRuntime: runtimeSpec !== cfg.runtime.packageSpec,
+      persistRuntime: runtimeSpec !== validatedCfg.runtime.packageSpec,
       installable: true,
       source: requestedClient ? 'explicit-pair' : 'explicit-runtime',
       warning: '',
@@ -100,7 +105,7 @@ export async function resolveUpdateTargets({
   if (!trusted) {
     return {
       clientSpec,
-      runtimeSpec: cfg.runtime.packageSpec,
+      runtimeSpec: validatedCfg.runtime.packageSpec,
       persistRuntime: false,
       installable: true,
       source: 'configured',
@@ -109,15 +114,16 @@ export async function resolveUpdateTargets({
   }
 
   try {
-    const versionUrl = new URL('/api/agent/version', cfg.serverUrl).toString();
+    const versionUrl = new URL('/api/agent/version', validatedCfg.serverUrl).toString();
     const response = await fetchImpl(versionUrl, {
       headers: { accept: 'application/json' },
+      redirect: 'error',
       signal: AbortSignal.timeout(UPDATE_DISCOVERY_TIMEOUT_MS),
     });
     if (!response?.ok) {
       return {
         clientSpec: currentClient,
-        runtimeSpec: cfg.runtime.packageSpec,
+        runtimeSpec: validatedCfg.runtime.packageSpec,
         persistRuntime: false,
         installable: false,
         source: 'configured',
@@ -130,11 +136,11 @@ export async function resolveUpdateTargets({
     const advertisedClient = exactClientSpec(advertised?.cli);
     const clientCandidate = requestedClient || advertisedClient;
     if (!advertisedClient
-      || !releasePairMatches(advertisedClient, cfg.runtime.packageName, runtimeCandidate)
+      || !releasePairMatches(advertisedClient, validatedCfg.runtime.packageName, runtimeCandidate)
       || (requestedClient && requestedClient !== advertisedClient)) {
       return {
         clientSpec: currentClient,
-        runtimeSpec: cfg.runtime.packageSpec,
+        runtimeSpec: validatedCfg.runtime.packageSpec,
         persistRuntime: false,
         installable: false,
         source: 'configured',
@@ -144,14 +150,14 @@ export async function resolveUpdateTargets({
 
     const runtimeSpec = normalizeRuntime({
       kind: 'npm',
-      packageName: cfg.runtime.packageName,
+      packageName: validatedCfg.runtime.packageName,
       packageSpec: runtimeCandidate,
-      entry: cfg.runtime.entry,
+      entry: validatedCfg.runtime.entry,
     }).packageSpec;
     return {
       clientSpec: clientCandidate,
       runtimeSpec,
-      persistRuntime: runtimeSpec !== cfg.runtime.packageSpec,
+      persistRuntime: runtimeSpec !== validatedCfg.runtime.packageSpec,
       installable: true,
       source: 'server',
       warning: '',
@@ -159,7 +165,7 @@ export async function resolveUpdateTargets({
   } catch (error) {
     return {
       clientSpec: currentClient,
-      runtimeSpec: cfg.runtime.packageSpec,
+      runtimeSpec: validatedCfg.runtime.packageSpec,
       persistRuntime: false,
       installable: false,
       source: 'configured',

package/src/cli.mjs

@@ -8,7 +8,7 @@ import { PACKAGE_NAME, VERSION } from './version.mjs';
 import { probeFilesystemAccess } from './fs-access.mjs';
 
 import { ensureMachineId, loadConfig, readJsonFile, saveConfig, setTelemetry, telemetryState, writeJsonFile } from './cli/config.mjs';
-import { assertRuntimeTrust, pairWithDeviceCode } from './cli/connect.mjs';
+import { assertRuntimeTrust, assertSecureServerUrl, pairWithDeviceCode } from './cli/connect.mjs';
 import { diagnoseLocalRuntime, installedVersion, runtimeAllowedRoots } from './cli/doctor.mjs';
 import { configFile, npm, officialOrigin, runtimeConfigFile } from './cli/env.mjs';
 import { currentInstallationInfo, ensureMacCliCommand, installPersistentAgent, persistentServiceState, rememberCurrentInstallation, restartPersistentServiceIfInstalled, serviceInstallationInfo, uninstallPersistentService } from './cli/service.mjs';
@@ -49,16 +49,19 @@ export async function main(argv = process.argv.slice(2)) {
     // Like the desktop-app flow this mirrors: with no flags the command talks to the official
     // server, prints a code, opens the browser to approve it, and pairs. `--code` keeps working for
     // the workspace-generated command and for CI, and `--server` for self-hosted deployments.
-    const server = String(flags.server || officialOrigin).replace(/\/$/, '');
+    const server = assertSecureServerUrl(flags.server || officialOrigin, { allowInsecure: flags['allow-insecure-transport'] === true });
     const code = String(flags.code || '').replace(/\s+/g, '').toUpperCase();
     assertRuntimeTrust(server, flags);
+
     let paired;
     let deviceInitiated = false;
     if (code) {
       const response = await fetch(`${server}/api/pair/claim`, {
         method: 'POST',
-        headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({ code, machineId: ensureMachineId(), name: String(flags.name || os.hostname()), hostname: os.hostname(), platform: process.platform, arch: process.arch }),
+        redirect: 'error',
+         headers: { 'content-type': 'application/json' },
+         body: JSON.stringify({ code, machineId: ensureMachineId(), name: String(flags.name || os.hostname()), hostname: os.hostname(), platform: process.platform, arch: process.arch }),
+
       });
       if (!response.ok) throw new Error(`Pairing failed (${response.status}): ${await response.text()}`);
       paired = await response.json();
@@ -81,6 +84,8 @@ export async function main(argv = process.argv.slice(2)) {
       // Remember whether this machine's owner trusted the server to name a runtime version. The
       // auto-updater must not widen that decision on its own later.
       trustRuntime: Boolean(flags['trust-runtime']) || new URL(server).origin === officialOrigin,
+      allowInsecureTransport: flags['allow-insecure-transport'] === true,
+
     };
     saveConfig(config);
     const accountEmail = String(paired.account?.email || '');
@@ -194,11 +199,12 @@ export async function main(argv = process.argv.slice(2)) {
 
   if (command === 'status' || command === 'doctor') {
     const cfg = rememberCurrentInstallation(loadConfig());
+    const server = assertSecureServerUrl(cfg.serverUrl, { allowInsecure: cfg.allowInsecureTransport === true || process.env.REMCP_ALLOW_INSECURE_TRANSPORT === 'true' });
     const [health, advertised] = await Promise.all([
-      fetchConfiguredServer(`${cfg.serverUrl}/health?fresh=${Date.now()}`, { cache:'no-store' })
+      fetchConfiguredServer(`${server}/health?fresh=${Date.now()}`, { cache:'no-store', redirect:'error' })
         .then(async response => ({ reachable:response.ok && (await response.json().catch(() => null))?.ok === true }))
         .catch(error => ({ reachable:false, error:error.message })),
-      fetchConfiguredServer(`${cfg.serverUrl}/api/agent/version?fresh=${Date.now()}`, { cache:'no-store' })
+      fetchConfiguredServer(`${server}/api/agent/version?fresh=${Date.now()}`, { cache:'no-store', redirect:'error' })
         .then(response => response.ok ? response.json() : null)
         .catch(() => null),
     ]);

package/src/runtime.mjs

@@ -1,6 +1,6 @@
 import path from 'node:path';
 
-const PACKAGE_NAME = /^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+$/i;
+const PACKAGE_NAME = /^(?:@[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?\/[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?|[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?)$/i;
 // A runtime spec is a plain published version of one package. Anything else — an npm alias
 // (`npm:@other/pkg`), a git/https/file spec, a tag, or a version range — is a way to make a device
 // install and execute code the user never agreed to, so only `name@x.y.z[-pre][+build]` is accepted.
@@ -13,7 +13,9 @@ export function normalizeRuntime(value) {
   const entry = String(value.entry || '');
   if (!PACKAGE_NAME.test(packageName)) throw new Error('Pairing server returned an invalid runtime package name');
   if (!isRuntimeSpecFor(packageName, packageSpec)) throw new Error(`Runtime package spec must be ${packageName}@<version>`);
-  if (!entry || path.isAbsolute(entry) || entry.split(/[\\/]+/).includes('..')) throw new Error('Pairing server returned an invalid runtime entry');
+   const entryParts = entry.split(/[\\/]+/);
+   if (!entry || entry.includes('\0') || path.isAbsolute(entry) || entryParts.some(part => !part || part === '.' || part === '..')) throw new Error('Pairing server returned an invalid runtime entry');
+
   return { kind: 'npm', packageName, packageSpec, entry };
 }