@remcp/remcp 0.2.15 → 0.2.19

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/remcp",
-  "version": "0.2.15",
+  "version": "0.2.19",
   "description": "ReMCP device client: pair a computer with ReMCP and run the outbound-only agent that hosts the local MCP runtime.",
   "type": "module",
   "license": "MIT",
@@ -18,7 +18,7 @@
     "README.md"
   ],
   "scripts": {
-    "check": "node --check bin/remcp.mjs && node --check src/cli.mjs && node --check src/agent.mjs && node --check src/runtime.mjs && node --check src/version.mjs",
+    "check": "node --check bin/remcp.mjs && node --check src/cli.mjs && node --check src/agent.mjs && node --check src/runtime.mjs && node --check src/version.mjs && node --check src/npm.mjs",
     "test": "node --test test/*.test.mjs"
   },
   "dependencies": {

package/src/agent.mjs

@@ -17,6 +17,9 @@ const UPDATE_CHECK_INTERVAL_MS = 6 * 60 * 60 * 1000;
 const UPDATE_CHECK_TIMEOUT_MS = 5000;
 // A version that failed to install is retried after this cooldown instead of on every reconnect.
 const UPDATE_RETRY_COOLDOWN_MS = 30 * 60 * 1000;
+// How long a handing-over agent waits for its replacement to take the device over before it keeps
+// running itself. Long enough for a fresh process to install nothing, connect and be registered.
+const REPLACEMENT_HANDOVER_TIMEOUT_MS = 20_000;
 const METRICS_INTERVAL_MS = 60_000;
 const TELEMETRY_QUEUE_LIMIT = 500;
 const TELEMETRY_BATCH_LIMIT = 100;
@@ -109,7 +112,7 @@ export function updateDecision({ advertised, cliVersion, runtimeVersion, runtime
 // Applies a freshly installed version. Exiting is what a supervisor needs; without one the new CLI is
 // started in this process' place. Either way the agent stops holding a stale runtime, which is what
 // makes an update actually take effect on a machine that no service manager watches.
-async function restartToApplyUpdate(cli, stopAgent, markStopping, onRuntimeRepaired) {
+async function restartToApplyUpdate(cli, stopAgent, markStopping, onRuntimeRepaired, isStopping) {
   try {
     const installed = globalInstalledVersion();
     if (installed && !isNewer(installed, VERSION)) {
@@ -130,6 +133,15 @@ async function restartToApplyUpdate(cli, stopAgent, markStopping, onRuntimeRepai
     console.log(`ReMCP ${installed || 'a newer version'} installed and verified (${reported}); restarting to apply it.`);
     if (!supervisorRestart()) {
       spawn(process.execPath, [cli, 'start'], { detached: true, stdio: 'ignore', env: { ...process.env } }).unref();
+      // Stepping aside is only safe once the replacement really holds the device: the relay closes
+      // this socket with 1012 ('replaced') the moment another agent takes the machine over, and that
+      // close is what stops this process. Without the wait, a replacement that cannot start left the
+      // machine connected in `/health` and offline everywhere else, with nobody left to retry.
+      await new Promise(resolve => setTimeout(resolve, REPLACEMENT_HANDOVER_TIMEOUT_MS));
+      if (!isStopping()) {
+        console.error(`The replacement agent did not take over within ${Math.round(REPLACEMENT_HANDOVER_TIMEOUT_MS / 1000)}s; keeping ${VERSION} running. Retry with: remcp update`);
+        return;
+      }
     }
     markStopping();
     await stopAgent().catch(() => {});
@@ -158,9 +170,27 @@ function globalInstalledVersion() {
   }
 }
 
-function supervisorRestart() {
-  if (process.env.INVOCATION_ID || process.env.JOURNAL_STREAM) return 'systemd';
-  try { if (existsSync('/.dockerenv')) return 'docker'; } catch {}
+// True when this process is the one a service manager owns: launchd and systemd's system manager run
+// a unit's main process as a child of PID 1, and `systemd --user` runs it as a child of the user
+// manager. Anything else — a terminal, a shell inside another unit, a CI runner job — has nobody
+// waiting to start the agent again.
+function parentIsServiceManager() {
+  if (process.ppid === 1) return true;
+  if (process.platform === 'win32') return false;
+  try { return readFileSync(`/proc/${process.ppid}/comm`, 'utf8').trim() === 'systemd'; } catch { return false; }
+}
+
+// What starts the agent again after it exits to apply an update, or null when it has to start its own
+// replacement. systemd sets INVOCATION_ID and JOURNAL_STREAM for a unit and every child of that unit
+// inherits them, so a `remcp start` run from a shell inside a service (a CI runner, a systemd-run
+// scope, another agent) believed a supervisor would bring it back: the update exited into nothing and
+// the workspace showed the machine offline until someone started the agent by hand. Only the unit's
+// own main process is restarted, so that is what the check requires.
+//
+// Injectable for tests: the verdict must not depend on the machine that runs them.
+export function supervisorRestart({ platform = process.platform, dockerenv = existsSync('/.dockerenv'), parentOurs = parentIsServiceManager() } = {}) {
+  if (parentOurs) return platform === 'darwin' ? 'launchd' : 'systemd';
+  if (dockerenv) return 'docker';
   return null;
 }
 
@@ -500,7 +530,7 @@ export async function runAgent(options) {
             runtimeError = error instanceof Error ? error.message : String(error);
           }
           if (!runtimeDown && !stopping) await startRuntime();
-        });
+        }, () => stopping);
       });
       child.on('error', error => {
         updateInFlight = false;

package/src/cli.mjs

@@ -2,9 +2,9 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import process from 'node:process';
-import { spawnSync } from 'node:child_process';
+import { spawn, spawnSync } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
-import { localRuntimeEntry, runAgent } from './agent.mjs';
+import { localRuntimeEntry, runAgent, supervisorRestart } from './agent.mjs';
 import { npmVersion, resolveNpm } from './npm.mjs';
 import { isRuntimeSpecFor, normalizeRuntime } from './runtime.mjs';
 import { PACKAGE_NAME, VERSION } from './version.mjs';
@@ -217,6 +217,63 @@ function ensureServiceIfRecorded(config) {
   }
 }
 
+// Opens the approval page in the person's browser. A machine that nobody is looking at only gets the
+// printed URL, so every failure here is silent and non-fatal.
+function openInBrowser(url) {
+  try {
+    const command = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'cmd' : 'xdg-open';
+    const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
+    const child = spawn(command, args, { stdio: 'ignore', detached: true });
+    child.on('error', () => {});
+    child.unref();
+  } catch {}
+}
+
+const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
+
+// Device authorization (RFC 8628): the computer asks for a code, the person approves it in the
+// browser while signed in, and this process collects the credential by polling. The device never
+// sees a browser session or an account password.
+async function pairWithDeviceCode(server, flags) {
+  const authorization = await fetch(`${server}/oauth/device_authorization`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({
+      name: String(flags.name || os.hostname()),
+      hostname: os.hostname(),
+      platform: process.platform,
+      arch: process.arch,
+      machineId: ensureMachineId(),
+    }),
+  });
+  if (!authorization.ok) throw new Error(`Pairing failed (${authorization.status}): ${await authorization.text()}`);
+  const grant = await authorization.json();
+  const approvalUrl = grant.verification_uri_complete || grant.verification_uri;
+  console.log(`Approve this computer in your browser: ${approvalUrl}`);
+  console.log(`Pairing code: ${grant.user_code}  (expires in ${Math.max(1, Math.round(Number(grant.expires_in || 600) / 60))} minutes)`);
+  openInBrowser(approvalUrl);
+  const deadline = Date.now() + (Number(grant.expires_in) || 600) * 1000;
+  const intervalMs = Math.max(1, Number(grant.interval) || 5) * 1000;
+  while (Date.now() < deadline) {
+    await sleep(intervalMs);
+    const response = await fetch(`${server}/oauth/token`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/x-www-form-urlencoded' },
+      body: new URLSearchParams({
+        grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+        device_code: String(grant.device_code || ''),
+      }).toString(),
+    });
+    const data = await response.json().catch(() => ({}));
+    if (response.ok && data.device_token) return data;
+    if (data.error === 'authorization_pending' || data.error === 'slow_down') continue;
+    if (data.error === 'access_denied') throw new Error('That pairing request was denied in the browser. Run the command again if it was not you.');
+    if (data.error === 'expired_token') break;
+    throw new Error(`Pairing failed (${response.status}): ${JSON.stringify(data)}`);
+  }
+  throw new Error('The pairing code expired before it was approved. Run the command again.');
+}
+
 function restartPersistentServiceIfInstalled() {
   const platform = servicePlatform();
   if (platform === 'linux' && fs.existsSync(linuxServiceFile)) {
@@ -241,15 +298,9 @@ function restartPersistentServiceIfInstalled() {
 // The agent the user installed with `remcp install` is the one this CLI manages. A machine can also
 // be supervised by its own systemd unit, by Docker, or by a terminal, and in those cases installing
 // a new version is not enough: the running process keeps the old code until something restarts it.
-// systemd marks every unit process with INVOCATION_ID and Docker leaves /.dockerenv, so those two
-// cases can be handed over by exiting (the supervisor starts the new build); anything else gets an
-// explicit instruction instead of a silent exit that would take the device offline.
-function supervisorRestart() {
-  if (process.env.INVOCATION_ID || process.env.JOURNAL_STREAM) return 'systemd';
-  try { if (fs.existsSync('/.dockerenv')) return 'docker'; } catch {}
-  return null;
-}
-
+// `supervisorRestart` (agent.mjs) answers which of those is true, and only reports a service manager
+// when it really owns this process: a terminal gets an explicit instruction instead of a silent exit
+// that would take the device offline.
 // One real handshake with the local runtime, plus everything needed to explain a failure: where the
 // entry resolved, whether the package is installed, the node that would run it, and the exact error.
 async function diagnoseLocalRuntime(cfg) {
@@ -351,21 +402,30 @@ export async function main(argv = process.argv.slice(2)) {
   }
 
   if (command === 'connect') {
-    const server = String(flags.server || '').replace(/\/$/, '');
+    // Like the desktop-app flow this mirrors: with no flags the command talks to the official
+    // server, prints a code, opens the browser to approve it, and pairs. `--code` keeps working for
+    // the workspace-generated command and for CI, and `--server` for self-hosted deployments.
+    const server = String(flags.server || officialOrigin).replace(/\/$/, '');
     const code = String(flags.code || '').replace(/\s+/g, '').toUpperCase();
-    if (!server || !code) throw new Error('--server and --code are required');
     assertRuntimeTrust(server, flags);
-    const response = await fetch(`${server}/api/pair/claim`, {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ code, machineId: ensureMachineId(), name: String(flags.name || os.hostname()), hostname: os.hostname(), platform: process.platform, arch: process.arch }),
-    });
-    if (!response.ok) throw new Error(`Pairing failed (${response.status}): ${await response.text()}`);
-    const paired = await response.json();
+    let paired;
+    let deviceInitiated = false;
+    if (code) {
+      const response = await fetch(`${server}/api/pair/claim`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ code, machineId: ensureMachineId(), name: String(flags.name || os.hostname()), hostname: os.hostname(), platform: process.platform, arch: process.arch }),
+      });
+      if (!response.ok) throw new Error(`Pairing failed (${response.status}): ${await response.text()}`);
+      paired = await response.json();
+    } else {
+      deviceInitiated = true;
+      paired = await pairWithDeviceCode(server, flags);
+    }
     const config = {
       serverUrl: server,
-      deviceId: paired.deviceId,
-      deviceToken: paired.deviceToken,
+      deviceId: paired.deviceId || paired.device_id,
+      deviceToken: paired.deviceToken || paired.device_token,
       deviceName: String(flags.name || os.hostname()),
       runtime: normalizeRuntime(paired.runtime),
       machineId: ensureMachineId(),
@@ -375,7 +435,27 @@ export async function main(argv = process.argv.slice(2)) {
     };
     saveConfig(config);
     console.log(`Paired ${os.hostname()} with ${server}`);
-    if (flags.install) installPersistentAgent(config);
+    if (flags.install) {
+      installPersistentAgent(config);
+      return;
+    }
+    // Only the command that asked for its own code keeps running: someone who ran `remcp connect` on
+    // a fresh machine expects the connection to be live when the command finishes. A workspace code
+    // keeps its old meaning (pair, then `remcp start` or `--install`).
+    if (!deviceInitiated) return;
+    // Nobody supervises this machine yet, so the agent runs in this window: Ctrl+C disconnects it,
+    // which is the behaviour people expect from a command they just ran themselves.
+    console.log('ReMCP is connected. Keep this window open, or run `remcp install` for a background service. Press Ctrl+C to stop.');
+    const telemetry = telemetryState();
+    await runAgent({
+      ...config,
+      autoUpdate: config.autoUpdate !== false,
+      trustRuntime: config.trustRuntime === true,
+      telemetryEnabled: telemetry.enabled,
+      installReported: telemetry.installReported,
+      installSpec: `${PACKAGE_NAME}@${VERSION}`,
+      persistState: patch => saveConfig({ ...config, ...patch }),
+    });
     return;
   }
 

package/src/npm.mjs

@@ -43,15 +43,19 @@ export function npmCandidates({ nodePath = process.execPath, home = os.homedir()
 
 // Resolves how to run npm. `source` is reported by `remcp doctor` and logged at agent startup so a
 // machine where npm cannot be found is obvious before an update is needed.
-export function resolveNpm({ nodePath = process.execPath, home = os.homedir(), platform = process.platform } = {}) {
+//
+// `exists` is injectable so a test can describe a machine with no npm at all instead of asking the
+// machine running the test: the Linux candidate list carries fixed prefixes (/usr, /usr/local) that
+// a CI runner or a developer laptop usually does have, which made that case untestable there.
+export function resolveNpm({ nodePath = process.execPath, home = os.homedir(), platform = process.platform, exists = existsSync } = {}) {
   const override = String(process.env.REMCP_NPM || '').trim();
   if (override) return { command: override, args: [], source: `REMCP_NPM=${override}` };
   const { cli, binaries } = npmCandidates({ nodePath, home, platform });
   for (const candidate of cli) {
-    if (existsSync(candidate)) return { command: nodePath, args: [candidate], source: `node ${candidate}` };
+    if (exists(candidate)) return { command: nodePath, args: [candidate], source: `node ${candidate}` };
   }
   for (const candidate of binaries) {
-    if (existsSync(candidate)) return { command: candidate, args: [], source: candidate };
+    if (exists(candidate)) return { command: candidate, args: [], source: candidate };
   }
   return { command: platform === 'win32' ? 'npm.cmd' : 'npm', args: [], source: 'PATH' };
 }