@remcp/remcp 0.2.193 → 0.2.195

package/README.md

@@ -16,6 +16,16 @@ it keeps the ReMCP runtime under `%LOCALAPPDATA%\ReMCP`. Generated one-time comm
 runtime, and registers a user service (systemd on Linux, LaunchAgent on macOS, Scheduled Task on
 Windows).
 
+## Scan to pair with a phone
+
+Run `remcp connect` in an interactive terminal to display a short-lived pairing code,
+a link, and a compact QR that opens the same ReMCP approval page on your phone.
+Sign in on your phone if needed, check the computer name, then explicitly approve.
+The QR contains only the one-time code in the existing device URL: it does **not**
+authorize the device on its own. The code expires and cannot be reused after approval.
+If your terminal cannot display a QR, use the printed link or code. Add `--no-qr`
+to suppress the QR; a custom non-HTTPS or cross-origin URL never gets one.
+
 ## Commands
 
 ```text

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/remcp",
-  "version": "0.2.193",
+  "version": "0.2.195",
   "description": "ReMCP device client: pair a computer with ReMCP and run the outbound-only agent that hosts the local MCP runtime.",
   "type": "module",
   "license": "MIT",
@@ -18,11 +18,12 @@
     "README.md"
   ],
   "scripts": {
-    "check": "node --check bin/remcp.mjs && node --check src/agent-network-probe-client.mjs && node --check src/agent-relay-connection.mjs && node --check src/agent-responder.mjs && node --check src/agent-runtime-capabilities.mjs && node --check src/agent-update-monitor.mjs && node --check src/agent-update.mjs && node --check src/agent-utilities.mjs && node --check src/agent.mjs && node --check src/cli.mjs && node --check src/cli/config.mjs && node --check src/cli/connect.mjs && node --check src/cli/doctor.mjs && node --check src/cli/env.mjs && node --check src/cli/npm-global.mjs && node --check src/cli/service-inventory.mjs && node --check src/cli/service-macos.mjs && node --check src/cli/service-paths.mjs && node --check src/cli/service.mjs && node --check src/cli/shell.mjs && node --check src/cli/update.mjs && node --check src/cli/windows-supervisor.mjs && node --check src/fs-access.mjs && node --check src/npm.mjs && node --check src/runtime.mjs && node --check src/version.mjs",
+    "check": "node --check bin/remcp.mjs && node --check src/agent-network-probe-client.mjs && node --check src/agent-relay-connection.mjs && node --check src/agent-responder.mjs && node --check src/agent-runtime-capabilities.mjs && node --check src/agent-update-monitor.mjs && node --check src/agent-update.mjs && node --check src/agent-utilities.mjs && node --check src/agent.mjs && node --check src/cli.mjs && node --check src/cli/config.mjs && node --check src/cli/connect.mjs && node --check src/cli/doctor.mjs && node --check src/cli/env.mjs && node --check src/cli/npm-global.mjs && node --check src/cli/pairing-qr.mjs && node --check src/cli/service-inventory.mjs && node --check src/cli/service-macos.mjs && node --check src/cli/service-paths.mjs && node --check src/cli/service.mjs && node --check src/cli/shell.mjs && node --check src/cli/update.mjs && node --check src/cli/windows-supervisor.mjs && node --check src/fs-access.mjs && node --check src/npm.mjs && node --check src/runtime.mjs && node --check src/version.mjs",
     "test": "node --test test/*.test.mjs"
   },
   "dependencies": {
     "@modelcontextprotocol/client": "^2.3.1",
+    "uqr": "0.1.3",
     "ws": "^8.21.3"
   },
   "repository": {

package/src/cli/connect.mjs

@@ -7,6 +7,7 @@ import { spawn } from 'node:child_process';
 import { ensureMachineId } from './config.mjs';
 import { officialOrigin } from './env.mjs';
 import { sleep } from './shell.mjs';
+import { printPairingQr } from './pairing-qr.mjs';
 
 // Keep the server-provided approval URL as data all the way to the OS. In particular, do not route it
 // through `cmd /c start` on Windows: cmd reparses metacharacters such as `&`, so a custom pairing
@@ -78,6 +79,7 @@ export async function pairWithDeviceCode(server, flags) {
   const approvalUrl = grant.verification_uri_complete || grant.verification_uri;
   console.log(`Approve this computer in your browser: ${approvalUrl}`);
   console.log(`Pairing code: ${grant.user_code}  (expires in ${Math.max(1, Math.round(Number(grant.expires_in || 600) / 60))} minutes)`);
+  if (flags?.['no-qr'] !== true) printPairingQr({ server, approvalUrl, userCode: grant.user_code });
   openInBrowser(approvalUrl);
   console.log('Waiting for approval… (Ctrl+C to cancel)');
   const deadline = Date.now() + (Number(grant.expires_in) || 600) * 1000;

package/src/cli/pairing-qr.mjs

@@ -0,0 +1,43 @@
+import { renderUnicodeCompact } from 'uqr';
+
+const USER_CODE_PATTERN = /^[A-Z2-9]{4}-[A-Z2-9]{4}$/;
+
+// A QR is a shortcut to the existing device review screen, not a login token.
+// Only encode the same-origin HTTPS /device URL containing this exact short-lived code.
+export function formatPairingQr({ server, approvalUrl, userCode, output = process.stdout, env = process.env }) {
+  if (!output?.isTTY || env.TERM === 'dumb' || env.NO_COLOR) return null;
+  if (!USER_CODE_PATTERN.test(String(userCode))) return null;
+
+  let origin;
+  let url;
+  try {
+    origin = new URL(server);
+    url = new URL(approvalUrl);
+  } catch { return null; }
+  if (origin.protocol !== 'https:' || url.protocol !== 'https:' || url.origin !== origin.origin ||
+    url.username || url.password || url.hash || url.pathname !== '/device' ||
+    url.searchParams.size !== 1 || url.searchParams.get('user_code') !== userCode) return null;
+
+  // Each pair of QR rows fits into one terminal line. Use explicit light/dark ANSI
+  // colors so the quiet zone remains scannable regardless of terminal theme.
+  let qr;
+  try { qr = renderUnicodeCompact(url.href, { ecc: 'M', border: 3 }); }
+  catch { return null; }
+  const columns = Number.isFinite(output.columns) && output.columns > 0 ? output.columns : 80;
+  const rows = qr.split('\n');
+  if (rows.some(row => [...row].length + 2 > columns)) return null;
+  // The library paints a dark lower half outside odd-sized matrices.
+  // Restore the white bottom quiet zone so phone cameras can detect it.
+  const last = rows.length - 1;
+  rows[last] = rows[last].replaceAll('▀', '█');
+  return rows.map(row => `\x1b[97;40m${row}\x1b[0m`).join('\n');
+}
+
+export function printPairingQr({ server, approvalUrl, userCode, output = process.stdout, env = process.env }) {
+  const qr = formatPairingQr({ server, approvalUrl, userCode, output, env });
+  if (!qr) return false;
+  output.write('Scan with your phone to review this computer:\n');
+  output.write(qr + '\n');
+  output.write('Check the computer name before approving.\n');
+  return true;
+}

package/src/cli.mjs

@@ -34,7 +34,7 @@ function parse(argv) {
 }
 
 function printHelp() {
-  console.log(`ReMCP ${VERSION}\n\nCommands:\n  remcp start\n  remcp status\n  remcp doctor\n  remcp update\n  remcp install\n  remcp uninstall\n  remcp uninstall --purge\n  remcp telemetry [status|on|off]\n  remcp godmode [status|on|off]\n  remcp --version\n\nPairing commands are generated in the ReMCP workspace.\n\nUsage metrics are opt-out (tool names, timings, outcomes only, sent to your own ReMCP\naccount through the paired agent). Disable them at any time with: remcp telemetry off\n\nUnrestricted mode (remcp godmode on) lifts the access roots and the command guardrails for this\ncomputer only. The MCP configuration tool cannot enable it; protect remote terminal access.`);
+  console.log(`ReMCP ${VERSION}\n\nCommands:\n  remcp connect [--no-qr]\n  remcp start\n  remcp status\n  remcp doctor\n  remcp update\n  remcp install\n  remcp uninstall\n  remcp uninstall --purge\n  remcp telemetry [status|on|off]\n  remcp godmode [status|on|off]\n  remcp --version\n\nPairing commands are generated in the ReMCP workspace.\n\nUsage metrics are opt-out (tool names, timings, outcomes only, sent to your own ReMCP\naccount through the paired agent). Disable them at any time with: remcp telemetry off\n\nUnrestricted mode (remcp godmode on) lifts the access roots and the command guardrails for this\ncomputer only. The MCP configuration tool cannot enable it; protect remote terminal access.`);
 }
 
 export async function main(argv = process.argv.slice(2)) {