@remcp/remcp 0.2.152 → 0.2.154

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/remcp",
-  "version": "0.2.152",
+  "version": "0.2.154",
   "description": "ReMCP device client: pair a computer with ReMCP and run the outbound-only agent that hosts the local MCP runtime.",
   "type": "module",
   "license": "MIT",
@@ -18,7 +18,7 @@
     "README.md"
   ],
   "scripts": {
-    "check": "node --check bin/remcp.mjs && node --check src/agent-update.mjs && node --check src/agent.mjs && node --check src/cli.mjs && node --check src/cli/config.mjs && node --check src/cli/connect.mjs && node --check src/cli/doctor.mjs && node --check src/cli/env.mjs && node --check src/cli/npm-global.mjs && node --check src/cli/service-inventory.mjs && node --check src/cli/service.mjs && node --check src/cli/shell.mjs && node --check src/cli/update.mjs && node --check src/fs-access.mjs && node --check src/npm.mjs && node --check src/runtime.mjs && node --check src/version.mjs",
+    "check": "node --check bin/remcp.mjs && node --check src/agent-responder.mjs && node --check src/agent-update-monitor.mjs && node --check src/agent-update.mjs && node --check src/agent-utilities.mjs && node --check src/agent.mjs && node --check src/cli.mjs && node --check src/cli/config.mjs && node --check src/cli/connect.mjs && node --check src/cli/doctor.mjs && node --check src/cli/env.mjs && node --check src/cli/npm-global.mjs && node --check src/cli/service-inventory.mjs && node --check src/cli/service.mjs && node --check src/cli/shell.mjs && node --check src/cli/update.mjs && node --check src/fs-access.mjs && node --check src/npm.mjs && node --check src/runtime.mjs && node --check src/version.mjs",
     "test": "node --test test/*.test.mjs"
   },
   "dependencies": {

package/src/agent-responder.mjs

@@ -0,0 +1,35 @@
+import os from 'node:os';
+import { VERSION } from './version.mjs';
+import { sendRelayMessage } from './agent-utilities.mjs';
+
+export function createAgentResponder({ inFlight, onPendingChange, getRuntimeState }) {
+  async function respond(ws, message) {
+    onPendingChange(1);
+    // The relay forwards a cancel when the MCP client goes away. Without it a cancelled tool call
+    // kept running on the machine (a delete still deleted), because nothing told the runtime.
+    const controller = new AbortController();
+    inFlight.set(message.id, controller);
+    const { mcp, runtimeDown, runtimeVersion, runtimeRestarts, callTimeoutMs } = getRuntimeState();
+    try {
+      let result;
+      if (message.method === 'ping') {
+        result = { ok: true, hostname: os.hostname(), platform: process.platform, arch: process.arch, uptimeSeconds: Math.floor(os.uptime()), agentVersion: VERSION, runtimeVersion, runtimeRestarts };
+      } else if (!runtimeDown && mcp) {
+        const options = { timeout: callTimeoutMs, signal: controller.signal };
+        if (message.method === 'tools/list') result = await mcp.listTools(undefined, options);
+        else if (message.method === 'tools/call') result = await mcp.callTool(message.params, undefined, options);
+        else throw new Error(`Unsupported relay method: ${message.method}`);
+      } else {
+        throw new Error('The ReMCP local runtime is restarting. Retry in a few seconds.');
+      }
+      sendRelayMessage(ws, { type: 'response', id: message.id, result });
+    } catch (error) {
+      const cancelled = controller.signal.aborted;
+      sendRelayMessage(ws, { type: 'response', id: message.id, error: { message: cancelled ? 'Cancelled: the client stopped waiting for this call.' : error instanceof Error ? error.message : String(error) } });
+    } finally {
+      inFlight.delete(message.id);
+      onPendingChange(-1);
+    }
+  }
+  return respond;
+}

package/src/agent-update-monitor.mjs

@@ -0,0 +1,141 @@
+import { existsSync } from 'node:fs';
+import { spawn } from 'node:child_process';
+import process from 'node:process';
+import { VERSION } from './version.mjs';
+import { globalCliEntry, globalInstalledVersion, isNewer, restartToApplyUpdate, updateDecision, updateInvocationArgs } from './agent-update.mjs';
+
+export const UPDATE_CHECK_INTERVAL_MS = 6 * 60 * 60 * 1000;
+const UPDATE_CHECK_TIMEOUT_MS = 5000;
+const POST_CONNECT_UPDATE_RECHECK_DELAYS_MS = Object.freeze([60_000, 5 * 60_000, 15 * 60_000]);
+const POST_CONNECT_UPDATE_RECHECK_JITTER_MS = 30_000;
+const UPDATE_RETRY_COOLDOWN_MS = 30 * 60 * 1000;
+
+export function createAgentUpdateMonitor({ options, serverUrl, queueEvent, getRuntimeState, onStopRequested, restartRuntime, isStopping, stop }) {
+  const postConnectUpdateRecheckDelaysMs = (Array.isArray(options.updateRecheckDelaysMs)
+    ? options.updateRecheckDelaysMs : POST_CONNECT_UPDATE_RECHECK_DELAYS_MS)
+    .map(Number).filter(delay => Number.isFinite(delay) && delay >= 0 && delay < UPDATE_CHECK_INTERVAL_MS).slice(0, 3);
+  const postConnectUpdateRecheckJitterMs = Number.isFinite(Number(options.updateRecheckJitterMs))
+    ? Math.max(0, Math.min(60_000, Number(options.updateRecheckJitterMs)))
+    : POST_CONNECT_UPDATE_RECHECK_JITTER_MS;
+  let postConnectUpdateTimers = [];
+
+  // Auto-update: the server publishes the versions an agent should be running. A newer
+  // release is installed in the background and the service restart picks it up; a failed
+  // or skipped update leaves the current version running, so an old agent keeps working.
+  //
+  // The update must be idempotent across reconnects: a flapping relay used to start one
+  // `npm install -g` per reconnect, so a machine could run several installers (and service
+  // restarts) at once. One attempt per advertised version, and never two at the same time.
+  let updateInFlight = false;
+  let lastAttemptedVersion = '';
+  let lastAttemptAt = 0;
+  let lastUpdateCheckError = '';
+  let lastUpdateCheckErrorAt = 0;
+
+  function clearPostConnectUpdateChecks() {
+    for (const timer of postConnectUpdateTimers) clearTimeout(timer);
+    postConnectUpdateTimers = [];
+  }
+
+  function schedulePostConnectUpdateChecks() {
+    clearPostConnectUpdateChecks();
+    if (options.autoUpdate === false) return;
+    for (const delay of postConnectUpdateRecheckDelaysMs) {
+      const jitter = postConnectUpdateRecheckJitterMs > 0
+        ? Math.floor(Math.random() * (postConnectUpdateRecheckJitterMs + 1))
+        : 0;
+      const timer = setTimeout(() => {
+        postConnectUpdateTimers = postConnectUpdateTimers.filter(candidate => candidate !== timer);
+        void checkForUpdate();
+      }, delay + jitter);
+      timer.unref?.();
+      postConnectUpdateTimers.push(timer);
+    }
+  }
+
+  async function checkForUpdate() {
+    if (options.autoUpdate === false) return;
+    if (updateInFlight) return;
+    try {
+      // This request contains no local file payload; the config-derived URL is the explicitly paired relay.
+      // codeql[js/file-access-to-http]
+      const response = await fetch(`${serverUrl}/api/agent/version`, { redirect: 'error', signal: AbortSignal.timeout(UPDATE_CHECK_TIMEOUT_MS) });
+      if (!response.ok) return;
+      const advertised = await response.json();
+      const minimum = advertised.minimum;
+      if (minimum && isNewer(minimum, VERSION)) {
+        console.error(`ReMCP ${VERSION} is older than the minimum supported agent ${minimum}; update with: remcp update`);
+      }
+      const { runtimeVersion, runtimeDown } = getRuntimeState();
+      const decision = updateDecision({ advertised, cliVersion: VERSION, runtimeVersion, runtimePackageName: options.runtime?.packageName, runtimeDown });
+      if (!decision.needed) return;
+      const target = decision.target;
+      queueEvent({ event: 'agent_update', at: Date.now(), reason: `${decision.reason}:${target}`.slice(0, 32), success: true });
+      const cli = globalCliEntry();
+      if (!cli || !existsSync(cli)) {
+        console.error(`ReMCP ${target} is available; run: remcp update`);
+        return;
+      }
+      // A version that already failed to install is retried only after a cooldown, so a broken
+      // release cannot turn into an install loop.
+      const attemptKey = `${target}|${decision.runtime}`;
+      if (attemptKey === lastAttemptedVersion && Date.now() - lastAttemptAt < UPDATE_RETRY_COOLDOWN_MS) return;
+      lastAttemptedVersion = attemptKey;
+      lastAttemptAt = Date.now();
+      updateInFlight = true;
+      console.log(`Updating ReMCP to ${target}${decision.runtime ? ` with ${decision.runtime}` : ''} (${decision.reason})…`);
+      // Keep the updater pinned to the exact release pair this trusted server advertised. That
+      // prevents a newer public npm tag from getting ahead of production during a public-first rollout.
+      const updateArgs = updateInvocationArgs(decision, options.trustRuntime === true);
+      const child = spawn(process.execPath, [cli, ...updateArgs], {
+        detached: true,
+        // The updater's own output is the only record of why an install failed, so it is piped back
+        // into this agent's log instead of being discarded.
+        stdio: ['ignore', 'pipe', 'pipe'],
+        env: { ...process.env },
+      });
+      const forward = chunk => {
+        const line = String(chunk).trim();
+        if (line) console.error(`remcp update: ${line}`);
+      };
+      child.stdout?.on('data', forward);
+      child.stderr?.on('data', forward);
+      child.on('exit', code => {
+        updateInFlight = false;
+        // The updater installs the packages and then restarts the service this agent runs in, so it is
+        // routinely killed by that restart and exits with a signal (`code` is null). That is success,
+        // not failure: the installed version is the proof. Without this check the agent kept
+        // reinstalling every few seconds — each cycle taking the device offline and making every tool
+        // call in that window fail in 1-3 ms ("Device is offline").
+        const targetVersion = String(target).split('@').pop();
+        const installedNow = globalInstalledVersion();
+        const installedTarget = installedNow && targetVersion && !isNewer(targetVersion, installedNow);
+        if (code !== 0 && !installedTarget) {
+          console.error(`remcp update exited with ${code}; keeping ${VERSION} and retrying after the cooldown.`);
+          return;
+        }
+        if (code !== 0) {
+          console.error(`remcp update was terminated (${code}) after installing ${installedNow}; applying it.`);
+        }
+        void restartToApplyUpdate(cli, stop, onStopRequested, restartRuntime, isStopping);
+      });
+      child.on('error', error => {
+        updateInFlight = false;
+        console.error(`remcp update could not start: ${error.message}`);
+      });
+      child.unref();
+    } catch (error) {
+      // Update discovery must never take the agent offline, but swallowing the exception made FNM/
+      // launchd failures impossible to diagnose. Log only when the reason changes or every 30 min.
+      const message = error instanceof Error ? error.message : String(error);
+      const now = Date.now();
+      if (message !== lastUpdateCheckError || now - lastUpdateCheckErrorAt >= UPDATE_RETRY_COOLDOWN_MS) {
+        console.error(`ReMCP auto-update check failed: ${message}`);
+        lastUpdateCheckError = message;
+        lastUpdateCheckErrorAt = now;
+      }
+      queueEvent({ event:'agent_update', at:now, reason:'check-failed', success:false, errorClass:error?.name || 'Error' });
+    }
+  }
+  return { checkForUpdate, clearPostConnectUpdateChecks, schedulePostConnectUpdateChecks };
+}

package/src/agent-utilities.mjs

@@ -0,0 +1,50 @@
+import os from 'node:os';
+import { VERSION } from './version.mjs';
+
+export function normalizedServerUrl(value, { allowInsecure = false } = {}) {
+  const url = new URL(String(value || ''));
+  if (url.protocol !== 'https:' && url.protocol !== 'http:') throw new Error('serverUrl must use http or https');
+  if (url.username || url.password) throw new Error('serverUrl must not embed credentials');
+  const loopback = ['localhost', '127.0.0.1', '::1', '[::1]'].includes(url.hostname.toLowerCase());
+  if (url.protocol === 'http:' && !loopback && !allowInsecure) throw new Error('Remote serverUrl must use https');
+  url.hash = '';
+  url.search = '';
+  return url.href.replace(/\/$/, '');
+}
+
+export function sendRelayMessage(socket, message) {
+  if (socket?.readyState !== 1) return false;
+  // The authenticated relay is ReMCP's explicit data boundary: model-requested tool results are
+  // intentionally returned to the paired workspace and never to an arbitrary third-party URL.
+  // codeql[js/file-access-to-http]
+  socket.send(JSON.stringify(message));
+  return true;
+}
+
+export function jitter(ms) {
+  return Math.round(ms * (0.75 + Math.random() * 0.5));
+}
+
+export function boundedReconnectDelay(value, fallbackMs = 150) {
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed)) return fallbackMs;
+  return Math.max(100, Math.min(60_000, Math.floor(parsed)));
+}
+
+// Device health is sampled locally and is the only thing ReMCP stores about the machine
+// beyond its name, platform and last-seen time. No process list, no file names.
+export function deviceMetrics(extra = {}) {
+  const load = os.loadavg?.()[0] ?? 0;
+  const totalMem = os.totalmem();
+  const freeMem = os.freemem();
+  return {
+    uptimeSeconds: Math.round(os.uptime()),
+    agentUptimeSeconds: Math.round(process.uptime()),
+    rssBytes: process.memoryUsage().rss,
+    load1: Number.isFinite(load) ? Number(load.toFixed(2)) : 0,
+    cpuCount: os.cpus?.().length ?? 0,
+    freeMemoryRatio: totalMem > 0 ? Number((freeMem / totalMem).toFixed(3)) : 0,
+    agentVersion: VERSION,
+    ...extra,
+  };
+}

package/src/agent.mjs

@@ -1,32 +1,16 @@
 import os from 'node:os';
-import { existsSync } from 'node:fs';
 import process from 'node:process';
-import { spawn } from 'node:child_process';
 import WebSocket from 'ws';
 import { Client } from '@modelcontextprotocol/client';
 import { StdioClientTransport } from '@modelcontextprotocol/client/stdio';
 import { VERSION } from './version.mjs';
-import {
-  globalCliEntry,
-  globalInstalledVersion,
-  isNewer,
-  localRuntimeEntry,
-  restartToApplyUpdate,
-  supervisorRestart,
-  updateDecision,
-  updateInvocationArgs,
-} from './agent-update.mjs';
+import { localRuntimeEntry } from './agent-update.mjs';
 
 export { localRuntimeEntry, supervisorRestart, updateDecision } from './agent-update.mjs';
+import { normalizedServerUrl, sendRelayMessage, jitter, boundedReconnectDelay, deviceMetrics } from './agent-utilities.mjs';
+import { createAgentUpdateMonitor, UPDATE_CHECK_INTERVAL_MS } from './agent-update-monitor.mjs';
+import { createAgentResponder } from './agent-responder.mjs';
 
-const UPDATE_CHECK_INTERVAL_MS = 6 * 60 * 60 * 1000;
-const UPDATE_CHECK_TIMEOUT_MS = 5000;
-// A deployment can briefly leave one HA replica advertising the previous release. Recheck a few
-// times after a stable connection instead of making that unlucky first answer stick for six hours.
-const POST_CONNECT_UPDATE_RECHECK_DELAYS_MS = Object.freeze([60_000, 5 * 60_000, 15 * 60_000]);
-const POST_CONNECT_UPDATE_RECHECK_JITTER_MS = 30_000;
-// A version that failed to install is retried after this cooldown instead of on every reconnect.
-const UPDATE_RETRY_COOLDOWN_MS = 30 * 60 * 1000;
 const METRICS_INTERVAL_MS = 5 * 60_000;
 const TELEMETRY_QUEUE_LIMIT = 500;
 const TELEMETRY_BATCH_LIMIT = 100;
@@ -47,54 +31,6 @@ const RUNTIME_TOOLS_RETRY_MAX_MS = 30_000;
 // timeout while the device keeps working invisibly.
 const CALL_TIMEOUT_MARGIN_MS = 10_000;
 
-function normalizedServerUrl(value, { allowInsecure = false } = {}) {
-  const url = new URL(String(value || ''));
-  if (url.protocol !== 'https:' && url.protocol !== 'http:') throw new Error('serverUrl must use http or https');
-  if (url.username || url.password) throw new Error('serverUrl must not embed credentials');
-  const loopback = ['localhost', '127.0.0.1', '::1', '[::1]'].includes(url.hostname.toLowerCase());
-  if (url.protocol === 'http:' && !loopback && !allowInsecure) throw new Error('Remote serverUrl must use https');
-  url.hash = '';
-  url.search = '';
-  return url.href.replace(/\/$/, '');
-}
-
-function sendRelayMessage(socket, message) {
-  if (socket?.readyState !== 1) return false;
-  // The authenticated relay is ReMCP's explicit data boundary: model-requested tool results are
-  // intentionally returned to the paired workspace and never to an arbitrary third-party URL.
-  // codeql[js/file-access-to-http]
-  socket.send(JSON.stringify(message));
-  return true;
-}
-
-function jitter(ms) {
-  return Math.round(ms * (0.75 + Math.random() * 0.5));
-}
-
-function boundedReconnectDelay(value, fallbackMs = 150) {
-  const parsed = Number(value);
-  if (!Number.isFinite(parsed)) return fallbackMs;
-  return Math.max(100, Math.min(60_000, Math.floor(parsed)));
-}
-
-// Device health is sampled locally and is the only thing ReMCP stores about the machine
-// beyond its name, platform and last-seen time. No process list, no file names.
-function deviceMetrics(extra = {}) {
-  const load = os.loadavg?.()[0] ?? 0;
-  const totalMem = os.totalmem();
-  const freeMem = os.freemem();
-  return {
-    uptimeSeconds: Math.round(os.uptime()),
-    agentUptimeSeconds: Math.round(process.uptime()),
-    rssBytes: process.memoryUsage().rss,
-    load1: Number.isFinite(load) ? Number(load.toFixed(2)) : 0,
-    cpuCount: os.cpus?.().length ?? 0,
-    freeMemoryRatio: totalMem > 0 ? Number((freeMem / totalMem).toFixed(3)) : 0,
-    agentVersion: VERSION,
-    ...extra,
-  };
-}
-
 export async function runAgent(options) {
   const serverUrl = normalizedServerUrl(options.serverUrl, { allowInsecure: options.allowInsecureTransport === true || process.env.REMCP_ALLOW_INSECURE_TRANSPORT === 'true' });
   const deviceToken = String(options.deviceToken || '');
@@ -106,22 +42,12 @@ export async function runAgent(options) {
   const telemetryEnabled = options.telemetryEnabled !== false;
   const metricsIntervalMs = Math.max(60_000, Number(options.metricsIntervalMs || process.env.REMCP_AGENT_METRICS_INTERVAL_MS) || METRICS_INTERVAL_MS);
   const persistState = typeof options.persistState === 'function' ? options.persistState : () => {};
-  const postConnectUpdateRecheckDelaysMs = (Array.isArray(options.updateRecheckDelaysMs)
-    ? options.updateRecheckDelaysMs
-    : POST_CONNECT_UPDATE_RECHECK_DELAYS_MS)
-    .map(Number)
-    .filter(delay => Number.isFinite(delay) && delay >= 0 && delay < UPDATE_CHECK_INTERVAL_MS)
-    .slice(0, 3);
-  const postConnectUpdateRecheckJitterMs = Number.isFinite(Number(options.updateRecheckJitterMs))
-    ? Math.max(0, Math.min(60_000, Number(options.updateRecheckJitterMs)))
-    : POST_CONNECT_UPDATE_RECHECK_JITTER_MS;
   let stopping = false;
   let revoked = false;
   const inFlight = new Map();
   let activeSocket;
   let reconnects = 0;
   let reconnectTimer = null;
-  let postConnectUpdateTimers = [];
   // Set when a replica asks this agent to move before it is replaced; the close handler reads it.
   let askedToReconnect = false;
   let requestedReconnectDelayMs = 0;
@@ -397,33 +323,31 @@ export async function runAgent(options) {
     scheduleReconnect(delay);
   }
 
-  async function respond(ws, message) {
-    pendingRequests += 1;
-    // The relay forwards a cancel when the MCP client goes away. Without it a cancelled tool call
-    // kept running on the machine (a delete still deleted), because nothing told the runtime.
-    const controller = new AbortController();
-    inFlight.set(message.id, controller);
-    try {
-      let result;
-      if (message.method === 'ping') {
-        result = { ok: true, hostname: os.hostname(), platform: process.platform, arch: process.arch, uptimeSeconds: Math.floor(os.uptime()), agentVersion: VERSION, runtimeVersion, runtimeRestarts };
-      } else if (!runtimeDown && mcp) {
-        const options = { timeout: callTimeoutMs, signal: controller.signal };
-        if (message.method === 'tools/list') result = await mcp.listTools(undefined, options);
-        else if (message.method === 'tools/call') result = await mcp.callTool(message.params, undefined, options);
-        else throw new Error(`Unsupported relay method: ${message.method}`);
-      } else {
-        throw new Error('The ReMCP local runtime is restarting. Retry in a few seconds.');
+  const respond = createAgentResponder({
+    inFlight,
+    onPendingChange: delta => { pendingRequests = Math.max(0, pendingRequests + delta); },
+    getRuntimeState: () => ({ mcp, runtimeDown, runtimeVersion, runtimeRestarts, callTimeoutMs }),
+  });
+  const { checkForUpdate, clearPostConnectUpdateChecks, schedulePostConnectUpdateChecks } = createAgentUpdateMonitor({
+    options, serverUrl, queueEvent,
+    getRuntimeState: () => ({ runtimeVersion, runtimeDown }),
+    onStopRequested: () => { stopping = true; },
+    isStopping: () => stopping,
+    stop,
+    restartRuntime: async () => {
+      // Rebuild the supervised runtime against the freshly installed exact release.
+      runtimeRestartDelay = RUNTIME_RESTART_BASE_MS;
+      runtimeDown = false;
+      runtimeError = '';
+      try {
+        runtimeEntry = localRuntimeEntry(options.runtime);
+      } catch (error) {
+        runtimeDown = true;
+        runtimeError = error instanceof Error ? error.message : String(error);
       }
-      sendRelayMessage(ws, { type: 'response', id: message.id, result });
-    } catch (error) {
-      const cancelled = controller.signal.aborted;
-      sendRelayMessage(ws, { type: 'response', id: message.id, error: { message: cancelled ? 'Cancelled: the client stopped waiting for this call.' : error instanceof Error ? error.message : String(error) } });
-    } finally {
-      inFlight.delete(message.id);
-      pendingRequests = Math.max(0, pendingRequests - 1);
-    }
-  }
+      if (!runtimeDown && !stopping) await startRuntime();
+    },
+  });
 
   function connect() {
     if (stopping) return;
@@ -536,136 +460,6 @@ export async function runAgent(options) {
     ws.on('error', error => console.error(`ReMCP relay: ${error.message}`));
   }
 
-  // Auto-update: the server publishes the versions an agent should be running. A newer
-  // release is installed in the background and the service restart picks it up; a failed
-  // or skipped update leaves the current version running, so an old agent keeps working.
-  //
-  // The update must be idempotent across reconnects: a flapping relay used to start one
-  // `npm install -g` per reconnect, so a machine could run several installers (and service
-  // restarts) at once. One attempt per advertised version, and never two at the same time.
-  let updateInFlight = false;
-  let lastAttemptedVersion = '';
-  let lastAttemptAt = 0;
-  let lastUpdateCheckError = '';
-  let lastUpdateCheckErrorAt = 0;
-
-  function clearPostConnectUpdateChecks() {
-    for (const timer of postConnectUpdateTimers) clearTimeout(timer);
-    postConnectUpdateTimers = [];
-  }
-
-  function schedulePostConnectUpdateChecks() {
-    clearPostConnectUpdateChecks();
-    if (options.autoUpdate === false) return;
-    for (const delay of postConnectUpdateRecheckDelaysMs) {
-      const jitter = postConnectUpdateRecheckJitterMs > 0
-        ? Math.floor(Math.random() * (postConnectUpdateRecheckJitterMs + 1))
-        : 0;
-      const timer = setTimeout(() => {
-        postConnectUpdateTimers = postConnectUpdateTimers.filter(candidate => candidate !== timer);
-        void checkForUpdate();
-      }, delay + jitter);
-      timer.unref?.();
-      postConnectUpdateTimers.push(timer);
-    }
-  }
-
-  async function checkForUpdate() {
-    if (options.autoUpdate === false) return;
-    if (updateInFlight) return;
-    try {
-      // This request contains no local file payload; the config-derived URL is the explicitly paired relay.
-      // codeql[js/file-access-to-http]
-      const response = await fetch(`${serverUrl}/api/agent/version`, { redirect: 'error', signal: AbortSignal.timeout(UPDATE_CHECK_TIMEOUT_MS) });
-      if (!response.ok) return;
-      const advertised = await response.json();
-      const minimum = advertised.minimum;
-      if (minimum && isNewer(minimum, VERSION)) {
-        console.error(`ReMCP ${VERSION} is older than the minimum supported agent ${minimum}; update with: remcp update`);
-      }
-      const decision = updateDecision({ advertised, cliVersion: VERSION, runtimeVersion, runtimePackageName: options.runtime?.packageName, runtimeDown });
-      if (!decision.needed) return;
-      const target = decision.target;
-      queueEvent({ event: 'agent_update', at: Date.now(), reason: `${decision.reason}:${target}`.slice(0, 32), success: true });
-      const cli = globalCliEntry();
-      if (!cli || !existsSync(cli)) {
-        console.error(`ReMCP ${target} is available; run: remcp update`);
-        return;
-      }
-      // A version that already failed to install is retried only after a cooldown, so a broken
-      // release cannot turn into an install loop.
-      const attemptKey = `${target}|${decision.runtime}`;
-      if (attemptKey === lastAttemptedVersion && Date.now() - lastAttemptAt < UPDATE_RETRY_COOLDOWN_MS) return;
-      lastAttemptedVersion = attemptKey;
-      lastAttemptAt = Date.now();
-      updateInFlight = true;
-      console.log(`Updating ReMCP to ${target}${decision.runtime ? ` with ${decision.runtime}` : ''} (${decision.reason})…`);
-      // Keep the updater pinned to the exact release pair this trusted server advertised. That
-      // prevents a newer public npm tag from getting ahead of production during a public-first rollout.
-      const updateArgs = updateInvocationArgs(decision, options.trustRuntime === true);
-      const child = spawn(process.execPath, [cli, ...updateArgs], {
-        detached: true,
-        // The updater's own output is the only record of why an install failed, so it is piped back
-        // into this agent's log instead of being discarded.
-        stdio: ['ignore', 'pipe', 'pipe'],
-        env: { ...process.env },
-      });
-      const forward = chunk => {
-        const line = String(chunk).trim();
-        if (line) console.error(`remcp update: ${line}`);
-      };
-      child.stdout?.on('data', forward);
-      child.stderr?.on('data', forward);
-      child.on('exit', code => {
-        updateInFlight = false;
-        // The updater installs the packages and then restarts the service this agent runs in, so it is
-        // routinely killed by that restart and exits with a signal (`code` is null). That is success,
-        // not failure: the installed version is the proof. Without this check the agent kept
-        // reinstalling every few seconds — each cycle taking the device offline and making every tool
-        // call in that window fail in 1-3 ms ("Device is offline").
-        const targetVersion = String(target).split('@').pop();
-        const installedNow = globalInstalledVersion();
-        const installedTarget = installedNow && targetVersion && !isNewer(targetVersion, installedNow);
-        if (code !== 0 && !installedTarget) {
-          console.error(`remcp update exited with ${code}; keeping ${VERSION} and retrying after the cooldown.`);
-          return;
-        }
-        if (code !== 0) {
-          console.error(`remcp update was terminated (${code}) after installing ${installedNow}; applying it.`);
-        }
-        void restartToApplyUpdate(cli, stop, () => { stopping = true; }, async () => {
-          // The packages are installed now: clear the failure, reset the backoff and start again.
-          runtimeRestartDelay = RUNTIME_RESTART_BASE_MS;
-          runtimeDown = false;
-          runtimeError = '';
-          try {
-            runtimeEntry = localRuntimeEntry(options.runtime);
-          } catch (error) {
-            runtimeDown = true;
-            runtimeError = error instanceof Error ? error.message : String(error);
-          }
-          if (!runtimeDown && !stopping) await startRuntime();
-        }, () => stopping);
-      });
-      child.on('error', error => {
-        updateInFlight = false;
-        console.error(`remcp update could not start: ${error.message}`);
-      });
-      child.unref();
-    } catch (error) {
-      // Update discovery must never take the agent offline, but swallowing the exception made FNM/
-      // launchd failures impossible to diagnose. Log only when the reason changes or every 30 min.
-      const message = error instanceof Error ? error.message : String(error);
-      const now = Date.now();
-      if (message !== lastUpdateCheckError || now - lastUpdateCheckErrorAt >= UPDATE_RETRY_COOLDOWN_MS) {
-        console.error(`ReMCP auto-update check failed: ${message}`);
-        lastUpdateCheckError = message;
-        lastUpdateCheckErrorAt = now;
-      }
-      queueEvent({ event:'agent_update', at:now, reason:'check-failed', success:false, errorClass:error?.name || 'Error' });
-    }
-  }
-
   scheduleMetricsSample();
   const telemetryFlushTimer = setInterval(flushTelemetry, TELEMETRY_SEND_INTERVAL_MS);
   telemetryFlushTimer.unref?.();