@remcp/remcp 0.2.186 → 0.2.187

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/remcp",
-  "version": "0.2.186",
+  "version": "0.2.187",
   "description": "ReMCP device client: pair a computer with ReMCP and run the outbound-only agent that hosts the local MCP runtime.",
   "type": "module",
   "license": "MIT",

package/src/cli/service.mjs

@@ -3,7 +3,7 @@ import { persistentServiceExpected, persistentServiceState, releasePairPresentAt
 export { servicePlatform, globalPrefix, globalCliPath, npmGlobalInstall, npmGlobalUpdate, npmGlobalUpdateForNode };
 export { persistentServiceExpected, persistentServiceState, releasePairPresentAtCli, installationVersionsAtCliPath, serviceInstallationInfo, currentInstallationInfo, rememberCurrentInstallation, syncKnownInstallations };
 // Installing, repairing and removing the background agent: one supervisor per platform, plus the
-// write-access tweaks a fresh install needs. Nothing here is reachable from a model or an MCP tool.
+// write-access tweaks a fresh install needs. Service maintenance follows local OS permissions.
 import fs from 'node:fs';
 import path from 'node:path';
 import process from 'node:process';
@@ -209,10 +209,22 @@ export function ensureServiceIfRecorded(config) {
   }
 }
 
-export function restartPersistentServiceIfInstalled(config) {
+export function deferredLinuxAgentRestartArgs(pid) {
+  if (!Number.isSafeInteger(pid) || pid <= 0) throw new Error('Invalid process identifier');
+  return ['--user', '--on-active=3s', `--unit=remcp-agent-settings-${pid}`,
+    'systemctl', '--user', 'restart', 'remcp-agent.service'];
+}
+
+export function restartPersistentServiceIfInstalled(config, { deferLinux = false } = {}) {
   if (!persistentServiceExpected(config)) return null;
   const platform = servicePlatform();
   if (platform === 'linux' && fs.existsSync(linuxServiceFile)) {
+    // Only owner-confirmed remote policy changes defer their restart. Ordinary
+    // installs and updates preserve their existing synchronous supervisor contract.
+    if (deferLinux) {
+      run('systemd-run', deferredLinuxAgentRestartArgs(process.pid));
+      return 'remcp-agent.service (restart scheduled)';
+    }
     run('systemctl', ['--user', 'daemon-reload']);
     run('systemctl', ['--user', 'restart', 'remcp-agent.service']);
     return 'remcp-agent.service';

package/src/cli.mjs

@@ -34,7 +34,7 @@ function parse(argv) {
 }
 
 function printHelp() {
-  console.log(`ReMCP ${VERSION}\n\nCommands:\n  remcp start\n  remcp status\n  remcp doctor\n  remcp update\n  remcp install\n  remcp uninstall\n  remcp uninstall --purge\n  remcp telemetry [status|on|off]\n  remcp godmode [status|on|off]\n  remcp --version\n\nPairing commands are generated in the ReMCP workspace.\n\nUsage metrics are opt-out (tool names, timings, outcomes only, sent to your own ReMCP\naccount through the paired agent). Disable them at any time with: remcp telemetry off\n\nUnrestricted mode (remcp godmode on) lifts the access roots and the command guardrails for this\ncomputer only. It is deliberately not reachable from a model or an MCP tool.`);
+  console.log(`ReMCP ${VERSION}\n\nCommands:\n  remcp start\n  remcp status\n  remcp doctor\n  remcp update\n  remcp install\n  remcp uninstall\n  remcp uninstall --purge\n  remcp telemetry [status|on|off]\n  remcp godmode [status|on|off]\n  remcp --version\n\nPairing commands are generated in the ReMCP workspace.\n\nUsage metrics are opt-out (tool names, timings, outcomes only, sent to your own ReMCP\naccount through the paired agent). Disable them at any time with: remcp telemetry off\n\nUnrestricted mode (remcp godmode on) lifts the access roots and the command guardrails for this\ncomputer only. The MCP configuration tool cannot enable it; protect remote terminal access.`);
 }
 
 export async function main(argv = process.argv.slice(2)) {
@@ -167,9 +167,10 @@ export async function main(argv = process.argv.slice(2)) {
   }
 
   // The switch that lifts every guardrail: no access roots, no command blocklist, no catastrophic
-  // command protection. It lives here, on the machine, because a model that could turn it on would
-  // turn any prompt injection into root. The runtime refuses to set it through MCP
-  // (`set_config_value` lists what it accepts, and this is not on the list).
+  // command protection. The runtime refuses to set it through MCP's configuration
+  // tool; the device owner can deliberately change it through the CLI or the
+  // authenticated Workspace with explicit confirmation. Remote shell access
+  // remains powerful and must be protected by the account and OS permissions.
   if (command === 'godmode' || command === 'unrestricted') {
     const action = String(positional[0] || 'status').toLowerCase();
     if (action === 'status') {
@@ -187,7 +188,11 @@ export async function main(argv = process.argv.slice(2)) {
     if (!['on', 'off', 'enable', 'disable'].includes(action)) throw new Error('Usage: remcp godmode [status|on|off]');
     const enabled = action === 'on' || action === 'enable';
     writeJsonFile(runtimeConfigFile, { ...readJsonFile(runtimeConfigFile), unrestricted: enabled });
-    const restarted = restartPersistentServiceIfInstalled(loadConfig(false));
+    // The authenticated Workspace supplies this explicit flag to allow the
+    // remote command to finish before its agent schedules a Linux restart.
+    // Local CLI and normal update operations retain synchronous semantics.
+    const restarted = restartPersistentServiceIfInstalled(loadConfig(false),
+      { deferLinux: flags['defer-restart'] === true });
     if (enabled) {
       console.error('Unrestricted mode is ON for this computer: every path and every command is allowed, including sudo. Anything the model is asked to do -- and anything a prompt injection asks it to do -- can now change this machine. Turn it off with `remcp godmode off` when you are done.');
     } else {