@remcp/remcp 0.2.196 → 0.2.198

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/remcp",
-  "version": "0.2.196",
+  "version": "0.2.198",
   "description": "ReMCP device client: pair a computer with ReMCP and run the outbound-only agent that hosts the local MCP runtime.",
   "type": "module",
   "license": "MIT",
@@ -18,7 +18,7 @@
     "README.md"
   ],
   "scripts": {
-    "check": "node --check bin/remcp.mjs && node --check src/agent-network-probe-client.mjs && node --check src/agent-relay-connection.mjs && node --check src/agent-responder.mjs && node --check src/agent-runtime-capabilities.mjs && node --check src/agent-update-monitor.mjs && node --check src/agent-update.mjs && node --check src/agent-utilities.mjs && node --check src/agent.mjs && node --check src/cli.mjs && node --check src/cli/config.mjs && node --check src/cli/connect.mjs && node --check src/cli/doctor.mjs && node --check src/cli/env.mjs && node --check src/cli/npm-global.mjs && node --check src/cli/pairing-qr.mjs && node --check src/cli/service-inventory.mjs && node --check src/cli/service-macos.mjs && node --check src/cli/service-paths.mjs && node --check src/cli/service.mjs && node --check src/cli/shell.mjs && node --check src/cli/update.mjs && node --check src/cli/windows-supervisor.mjs && node --check src/fs-access.mjs && node --check src/npm.mjs && node --check src/runtime.mjs && node --check src/version.mjs",
+    "check": "node --check bin/remcp.mjs && node --check src/agent-deploy-reconnect.mjs && node --check src/agent-network-probe-client.mjs && node --check src/agent-relay-connection.mjs && node --check src/agent-responder.mjs && node --check src/agent-runtime-capabilities.mjs && node --check src/agent-update-monitor.mjs && node --check src/agent-update.mjs && node --check src/agent-utilities.mjs && node --check src/agent.mjs && node --check src/cli.mjs && node --check src/cli/config.mjs && node --check src/cli/connect.mjs && node --check src/cli/doctor.mjs && node --check src/cli/env.mjs && node --check src/cli/npm-global.mjs && node --check src/cli/pairing-qr.mjs && node --check src/cli/service-inventory.mjs && node --check src/cli/service-macos.mjs && node --check src/cli/service-paths.mjs && node --check src/cli/service.mjs && node --check src/cli/shell.mjs && node --check src/cli/update.mjs && node --check src/cli/windows-supervisor.mjs && node --check src/fetch-update-manifest.mjs && node --check src/fs-access.mjs && node --check src/npm.mjs && node --check src/runtime.mjs && node --check src/version.mjs",
     "test": "node --test test/*.test.mjs"
   },
   "dependencies": {

package/src/agent-deploy-reconnect.mjs

@@ -0,0 +1,26 @@
+/**
+ * Bound repeated relay-deployment reconnects while preserving fast recovery from
+ * a single short interruption. State is per agent connection, never global.
+ *
+ * The gateway's requested minimum is honored; a burst of sub-10s sessions
+ * progressively backs off so dozens of agents cannot spin on a deploy loop.
+ */
+export function nextDeployReconnect({
+  requestedDelayMs = 150,
+  rapidDisconnects = 0,
+  connectionUptimeMs = 0,
+} = {}) {
+  const input = Number(requestedDelayMs);
+  const requested = Number.isFinite(input)
+    ? Math.max(100, Math.min(60_000, Math.floor(input)))
+    : 150;
+  const stable = Number(connectionUptimeMs) >= 10_000;
+  const prior = Number.isSafeInteger(rapidDisconnects) && rapidDisconnects >= 0
+    ? rapidDisconnects : 0;
+  const count = stable ? 0 : Math.min(8, prior + 1);
+  const adaptive = count <= 1 ? 0 : Math.min(8_000, 250 * 2 ** Math.min(6, count - 2));
+  return {
+    delayMs: Math.max(requested, adaptive),
+    rapidDisconnects: count,
+  };
+}

package/src/agent-relay-connection.mjs

@@ -4,11 +4,11 @@ import process from 'node:process';
 import WebSocket from 'ws';
 import { VERSION } from './version.mjs';
 import { boundedReconnectDelay, jitter, sendRelayMessage } from './agent-utilities.mjs';
+import { nextDeployReconnect } from './agent-deploy-reconnect.mjs';
 
 const RECONNECT_BASE_MS = 2_000;
 const RECONNECT_FIRST_MS = 500;
 const RECONNECT_MAX_MS = 60_000;
-
 // Higher-level agent owns runtime supervision/telemetry; this controller owns only relay transport.
 export function createAgentRelayConnection({
   agentUrl, serverUrl, deviceToken, deviceId, deviceName,
@@ -21,6 +21,9 @@ export function createAgentRelayConnection({
   let reconnectTimer = null;
   let askedToReconnect = false;
   let requestedReconnectDelayMs = 0;
+  let requestedReconnectReason = '';
+  let connectedAt = 0;
+  let rapidDeployDisconnects = 0;
   function scheduleReconnect(delay) {
     if (isStopping() || revoked || reconnectTimer) return;
     // Keep the upper-bound guard in control flow immediately before the timer sink. CodeQL's
@@ -88,6 +91,7 @@ export function createAgentRelayConnection({
     });
     setSocket(ws);
     ws.on('open', () => {
+      connectedAt = Date.now();
       if (reconnectTimer) {
         clearTimeout(reconnectTimer);
         reconnectTimer = null;
@@ -117,6 +121,8 @@ export function createAgentRelayConnection({
       if (message?.type === 'reconnect') {
         askedToReconnect = true;
         requestedReconnectDelayMs = boundedReconnectDelay(message.delayMs, 150);
+        requestedReconnectReason = ['deploy', 'credentials', 'capacity'].includes(message.reason)
+          ? message.reason : 'transient';
         return;
       }
       if (message?.type === 'request') void respond(ws, message);
@@ -129,33 +135,35 @@ export function createAgentRelayConnection({
       clearPostConnectUpdateChecks();
       for (const controller of inFlight.values()) controller.abort();
       if (isStopping()) return;
-      // 1013 ('reconnect') is what a replica sends before it is replaced by a deployment. The machine
-      // is not down, it is moving: reconnect at once and forget the backoff, so the person and the
-      // model see nothing at all.
-      if (code === 1013 || askedToReconnect) {
-        const delayMs = requestedReconnectDelayMs || 150;
-        askedToReconnect = false;
-        requestedReconnectDelayMs = 0;
-        setReconnects(0);
-        console.log(`ReMCP relay is being redeployed; reconnecting in ${delayMs}ms.`);
-        scheduleReconnect(delayMs);
-        return;
-      }
+      // A replacement owner or revoked device takes precedence over a reconnect hint.
       if (code === 1008 || revoked) {
-        // The relay closes with 1008 when the device was revoked. Retrying forever would
-        // hide that from the person at the computer.
         console.error('ReMCP access for this device was revoked. Pair the machine again from the ReMCP workspace: remcp connect --server <url> --code <code> --install');
         return;
       }
       if (code === 1012) {
-        // 1012 ('service restart') is what the relay sends when another agent process took over this
-        // device. Staying alive would keep a second runtime and a reconnect loop, so this process
-        // stops and leaves the device to the agent that owns the connection.
         console.error('Another ReMCP agent connected for this device; this process will stop. Run one agent per machine (a service manager or the remcp start command).');
         markStopping();
         void stop().finally(() => setTimeout(() => process.exit(0), 100));
         return;
       }
+      if (code === 1013 || askedToReconnect) {
+        // 1013 covers transient overload and relay-store failures, not just deployment.
+        // Preserve a fast first handover while bounding repeated short-lived sessions.
+        const reconnect = nextDeployReconnect({
+          requestedDelayMs: requestedReconnectDelayMs || 150,
+          rapidDisconnects: rapidDeployDisconnects,
+          connectionUptimeMs: connectedAt ? Date.now() - connectedAt : 0,
+        });
+        rapidDeployDisconnects = reconnect.rapidDisconnects;
+        const reason = requestedReconnectReason || 'transient';
+        askedToReconnect = false;
+        requestedReconnectReason = '';
+        requestedReconnectDelayMs = 0;
+        setReconnects(0);
+        console.log(`ReMCP relay reconnect (${reason}); retrying in ${reconnect.delayMs}ms.`);
+        scheduleReconnect(reconnect.delayMs);
+        return;
+      }
       scheduleBackoffReconnect();
     });
     ws.on('error', error => console.error(`ReMCP relay: ${error.message}`));

package/src/agent-update-monitor.mjs

@@ -2,10 +2,13 @@ import { existsSync } from 'node:fs';
 import { spawn } from 'node:child_process';
 import process from 'node:process';
 import { VERSION } from './version.mjs';
+import { fetchUpdateManifest } from './fetch-update-manifest.mjs';
 import { globalCliEntry, globalInstalledVersion, isNewer, restartToApplyUpdate, updateDecision, updateInvocationArgs } from './agent-update.mjs';
 
 export const UPDATE_CHECK_INTERVAL_MS = 6 * 60 * 60 * 1000;
-const UPDATE_CHECK_TIMEOUT_MS = 5000;
+const UPDATE_CHECK_TIMEOUT_MS = 12000;
+// A flapping relay must not trigger update discovery on every successful reconnect.
+const UPDATE_CHECK_RECONNECT_GAP_MS = 30000;
 const POST_CONNECT_UPDATE_RECHECK_DELAYS_MS = Object.freeze([60_000, 5 * 60_000, 15 * 60_000]);
 const POST_CONNECT_UPDATE_RECHECK_JITTER_MS = 30_000;
 const UPDATE_RETRY_COOLDOWN_MS = 30 * 60 * 1000;
@@ -31,6 +34,7 @@ export function createAgentUpdateMonitor({ options, serverUrl, queueEvent, getRu
   let lastAttemptAt = 0;
   let lastUpdateCheckError = '';
   let lastUpdateCheckErrorAt = 0;
+  let lastDiscoveryAt = 0;
 
   function clearPostConnectUpdateChecks() {
     for (const timer of postConnectUpdateTimers) clearTimeout(timer);
@@ -46,22 +50,32 @@ export function createAgentUpdateMonitor({ options, serverUrl, queueEvent, getRu
         : 0;
       const timer = setTimeout(() => {
         postConnectUpdateTimers = postConnectUpdateTimers.filter(candidate => candidate !== timer);
-        void checkForUpdate();
+        void checkForUpdate({ scheduled: true });
       }, delay + jitter);
       timer.unref?.();
       postConnectUpdateTimers.push(timer);
     }
   }
 
-  async function checkForUpdate() {
+  async function checkForUpdate({ scheduled = false } = {}) {
     if (options.autoUpdate === false) return;
     if (updateInFlight) return;
+    const minimumGap = Number.isFinite(Number(options.updateCheckMinGapMs))
+      ? Math.max(0, Math.min(UPDATE_CHECK_RECONNECT_GAP_MS, Number(options.updateCheckMinGapMs)))
+      : UPDATE_CHECK_RECONNECT_GAP_MS;
+    const now = Date.now();
+    // Scheduled bounded convergence polls are distinct from reconnect-triggered discovery.
+    // Do not starve release-pause/Redis-recovery checks behind the reconnect storm cooldown.
+    if (!scheduled && lastDiscoveryAt && now - lastDiscoveryAt < minimumGap) return;
+    lastDiscoveryAt = now;
     try {
       // This request contains no local file payload; the config-derived URL is the explicitly paired relay.
       // codeql[js/file-access-to-http]
-      const response = await fetch(`${serverUrl}/api/agent/version`, { redirect: 'error', signal: AbortSignal.timeout(UPDATE_CHECK_TIMEOUT_MS) });
-      if (!response.ok) return;
-      const advertised = await response.json();
+      // Bound both connection and JSON body parsing even if platform fetch ignores AbortSignal.
+      const advertised = await fetchUpdateManifest(`${serverUrl}/api/agent/version`, {
+        timeoutMs: UPDATE_CHECK_TIMEOUT_MS,
+      });
+      if (!advertised) return;
       const minimum = advertised.minimum;
       if (minimum && isNewer(minimum, VERSION)) {
         console.error(`ReMCP ${VERSION} is older than the minimum supported agent ${minimum}; update with: remcp update`);

package/src/cli/doctor.mjs

@@ -15,6 +15,21 @@ import { npm, runtimeConfigFile } from './env.mjs';
 // that would take the device offline.
 // One real handshake with the local runtime, plus everything needed to explain a failure: where the
 // entry resolved, whether the package is installed, the node that would run it, and the exact error.
+// A stuck local MCP transport must not hold remcp doctor indefinitely.
+export async function doctorDeadline(promise, timeoutMs) {
+  let timer;
+  try {
+    return await Promise.race([
+      promise,
+      new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error('Runtime diagnostic timed out after ' + timeoutMs + 'ms')), timeoutMs);
+      }),
+    ]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
 export async function diagnoseLocalRuntime(cfg) {
   const packageName = cfg.runtime?.packageName || '';
   const diagnosis = {
@@ -54,16 +69,24 @@ export async function diagnoseLocalRuntime(cfg) {
       { name: 'remcp-doctor', version: VERSION },
       { versionNegotiation:{ mode:'auto' } },
     );
-    const stdio = new StdioClientTransport({ command: process.execPath, args: [entry], env: { ...process.env }, maxBufferSize: 4 * 1024 * 1024 });
-    const stderr = [];
-    stdio.onerror = error => stderr.push(String(error?.message || error));
-    await client.connect(stdio);
-    diagnosis.runtimeVersion = client.getServerVersion()?.version || 'unknown';
-    const tools = await client.listTools(undefined, { timeout: 20000 });
-    diagnosis.tools = tools.tools.length;
-    diagnosis.verdict = 'ok';
-    await client.close();
-    return diagnosis;
+    // Keep runtime stderr off the inherited CLI pipe: it must not block a
+    // parent test runner when a diagnostic child remains active.
+    const stdio = new StdioClientTransport({
+      command: process.execPath, args: [entry], env: { ...process.env },
+      stderr: 'pipe', maxBufferSize: 4 * 1024 * 1024,
+    });
+    stdio.stderr?.on('data', () => {}); // drain; do not log potentially sensitive output
+    try {
+      await doctorDeadline(client.connect(stdio), 20_000);
+      diagnosis.runtimeVersion = client.getServerVersion()?.version || 'unknown';
+      const tools = await doctorDeadline(client.listTools(undefined, { timeout: 20_000 }), 25_000);
+      diagnosis.tools = tools.tools.length;
+      diagnosis.verdict = 'ok';
+      return diagnosis;
+    } finally {
+      // Clean up even on a failed handshake. Never let close hang the doctor.
+      await doctorDeadline(client.close(), 6_000).catch(() => {});
+    }
   } catch (error) {
     diagnosis.verdict = 'runtime-handshake-failed';
     diagnosis.error = error instanceof Error ? error.message : String(error);

package/src/cli/service.mjs

@@ -23,9 +23,28 @@ export function quoteSystemd(value) {
   return `"${String(value).replaceAll('\\', '\\\\').replaceAll('"', '\\"')}"`;
 }
 
-function writeLinuxServiceLauncher(cliPath = globalCliPath(), nodePath = process.execPath) {
+// A systemd user's PATH may resolve system npm even when the CLI lives under nvm.
+// Pin the npm installation target to the CLI's own existing global prefix.
+export function linuxServiceLauncherText(cliPath, nodePath) {
+  if (!path.isAbsolute(cliPath) || !path.isAbsolute(nodePath) || path.basename(path.dirname(cliPath)) !== 'bin') {
+    throw new Error('Linux service needs absolute CLI and Node paths in a global bin directory');
+  }
+  const prefix = path.dirname(path.dirname(cliPath));
   const cliScript = resolvedCliScript(cliPath);
-  const launcher = `#!/bin/sh\nexec ${shellQuote(nodePath)} ${shellQuote(cliScript)} \"$@\"\n`;
+  const lines = [
+    '#!/bin/sh',
+    'NPM_CONFIG_PREFIX=' + shellQuote(prefix),
+    'export NPM_CONFIG_PREFIX',
+    'PATH=' + shellQuote(path.dirname(nodePath)) + ':"$PATH"',
+    'export PATH',
+    'exec ' + shellQuote(nodePath) + ' ' + shellQuote(cliScript) + ' "$@"',
+    '',
+  ];
+  return lines.join('\n');
+}
+
+function writeLinuxServiceLauncher(cliPath = globalCliPath(), nodePath = process.execPath) {
+  const launcher = linuxServiceLauncherText(cliPath, nodePath);
   fs.mkdirSync(path.dirname(linuxServiceLauncherFile), { recursive: true, mode: 0o700 });
   const temporary = `${linuxServiceLauncherFile}.${process.pid}.${Date.now()}.tmp`;
   fs.writeFileSync(temporary, launcher, { mode: 0o700 });

package/src/fetch-update-manifest.mjs

@@ -0,0 +1,45 @@
+/**
+ * Bounded ReMCP release discovery. The deadline covers both the HTTP response
+ * and its JSON body. AbortSignal alone does not reliably cancel stalled TCP
+ * connects on every supported Node/undici + operating-system combination.
+ *
+ * No credentials or local computer data are transmitted here: the caller
+ * supplies the trusted ReMCP relay's public version endpoint.
+ */
+export async function fetchUpdateManifest(url, {
+  fetchImpl = globalThis.fetch,
+  timeoutMs = 5_000,
+} = {}) {
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 60_000) {
+    throw new RangeError('Update manifest timeout must be 1–60000 milliseconds');
+  }
+  const controller = new AbortController();
+  let timer;
+  const deadline = new Promise((_, reject) => {
+    timer = setTimeout(() => {
+      controller.abort();
+      const error = new Error('ReMCP update manifest check exceeded its deadline');
+      error.name = 'TimeoutError';
+      reject(error);
+    }, timeoutMs);
+  });
+
+  try {
+    return await Promise.race([
+      (async () => {
+        const response = await fetchImpl(url, {
+          redirect: 'error',
+          signal: controller.signal,
+        });
+        if (!response.ok) return null;
+        return response.json();
+      })(),
+      deadline,
+    ]);
+  } finally {
+    clearTimeout(timer);
+    // Release a response connection if a late completion beats the deadline
+    // after Promise.race has already chosen the timed-out branch.
+    controller.abort();
+  }
+}