@remcp/remcp 0.2.199 → 0.2.200

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/remcp",
-  "version": "0.2.199",
+  "version": "0.2.200",
   "description": "ReMCP device client: pair a computer with ReMCP and run the outbound-only agent that hosts the local MCP runtime.",
   "type": "module",
   "license": "MIT",
@@ -18,7 +18,7 @@
     "README.md"
   ],
   "scripts": {
-    "check": "node --check bin/remcp.mjs && node --check src/agent-deploy-reconnect.mjs && node --check src/agent-network-probe-client.mjs && node --check src/agent-relay-connection.mjs && node --check src/agent-responder.mjs && node --check src/agent-runtime-capabilities.mjs && node --check src/agent-update-monitor.mjs && node --check src/agent-update.mjs && node --check src/agent-utilities.mjs && node --check src/agent.mjs && node --check src/cli.mjs && node --check src/cli/config.mjs && node --check src/cli/connect.mjs && node --check src/cli/doctor.mjs && node --check src/cli/env.mjs && node --check src/cli/npm-global.mjs && node --check src/cli/pairing-qr.mjs && node --check src/cli/service-inventory.mjs && node --check src/cli/service-macos.mjs && node --check src/cli/service-paths.mjs && node --check src/cli/service.mjs && node --check src/cli/shell.mjs && node --check src/cli/update.mjs && node --check src/cli/windows-supervisor.mjs && node --check src/fetch-update-manifest.mjs && node --check src/fs-access.mjs && node --check src/npm.mjs && node --check src/runtime.mjs && node --check src/version.mjs",
+    "check": "node --check bin/remcp.mjs && node --check src/agent-deploy-reconnect.mjs && node --check src/agent-network-probe-client.mjs && node --check src/agent-relay-connection.mjs && node --check src/agent-responder.mjs && node --check src/agent-runtime-capabilities.mjs && node --check src/agent-update-monitor.mjs && node --check src/agent-update.mjs && node --check src/agent-utilities.mjs && node --check src/agent.mjs && node --check src/cli.mjs && node --check src/cli/config.mjs && node --check src/cli/connect.mjs && node --check src/cli/doctor.mjs && node --check src/cli/env.mjs && node --check src/cli/mac-native-temperature.mjs && node --check src/cli/npm-global.mjs && node --check src/cli/pairing-qr.mjs && node --check src/cli/service-inventory.mjs && node --check src/cli/service-macos.mjs && node --check src/cli/service-paths.mjs && node --check src/cli/service.mjs && node --check src/cli/shell.mjs && node --check src/cli/update.mjs && node --check src/cli/windows-supervisor.mjs && node --check src/fetch-update-manifest.mjs && node --check src/fs-access.mjs && node --check src/npm.mjs && node --check src/runtime.mjs && node --check src/version.mjs",
     "test": "node --test test/*.test.mjs"
   },
   "dependencies": {

package/src/cli/mac-native-temperature.mjs

@@ -0,0 +1,67 @@
+// The global ReMCP installer deliberately disables npm lifecycle scripts.
+// Opt in only the reviewed, version-pinned Apple Silicon temperature addon,
+// after verifying its installed manifest and on-disk path. No sudo or shell.
+import fs from 'node:fs';
+import path from 'node:path';
+
+const SENSOR_NAME = 'macos-temperature-sensor';
+const SENSOR_VERSION = '2.1.1';
+const SCRIPT = 'node-gyp rebuild';
+const BINARY = path.join('build', 'Release', 'mac_temp_native.node');
+
+function checkedManifest(file) {
+  const stats = fs.lstatSync(file);
+  if (!stats.isFile() || stats.size > 16384) throw new Error('invalid manifest');
+  return JSON.parse(fs.readFileSync(file, 'utf8'));
+}
+
+function checkedDirectory(directory) {
+  const stats = fs.lstatSync(directory);
+  if (!stats.isDirectory() || stats.isSymbolicLink()) throw new Error('unsafe addon directory');
+}
+
+export function buildVettedMacTemperatureAddon({ runtimeRoot, resolved, runCommand, warn = console.error }) {
+  try {
+    checkedDirectory(runtimeRoot);
+    const runtime = checkedManifest(path.join(runtimeRoot, 'package.json'));
+    if (runtime.name !== '@remcp/runtime' ||
+        runtime.optionalDependencies?.[SENSOR_NAME] !== SENSOR_VERSION) return false;
+
+    const modules = path.join(runtimeRoot, 'node_modules');
+    const addonRoot = path.join(modules, SENSOR_NAME);
+    // The native module is optional; if npm omitted it, report unknown rather
+    // than reinstalling or executing a different dependency.
+    if (!fs.existsSync(addonRoot)) return false;
+    checkedDirectory(modules);
+    checkedDirectory(addonRoot);
+    const canonicalRoot = fs.realpathSync(runtimeRoot);
+    const canonicalAddon = fs.realpathSync(addonRoot);
+    if (!canonicalAddon.startsWith(canonicalRoot + path.sep)) throw new Error('addon escaped runtime');
+    const addon = checkedManifest(path.join(addonRoot, 'package.json'));
+    if (addon.name !== SENSOR_NAME || addon.version !== SENSOR_VERSION ||
+        addon.scripts?.install !== SCRIPT) throw new Error('unreviewed native addon');
+
+    const nativeBinary = path.join(addonRoot, BINARY);
+    for (const folder of [path.join(addonRoot, 'build'), path.join(addonRoot, 'build', 'Release')]) {
+      if (fs.existsSync(folder)) checkedDirectory(folder);
+    }
+    if (fs.existsSync(nativeBinary)) {
+      if (!fs.lstatSync(nativeBinary).isFile()) throw new Error('invalid native module');
+      return true;
+    }
+    // Execute precisely this verified package's known node-gyp script. Do not
+    // re-enable arbitrary transitive lifecycle scripts in global npm install.
+    runCommand(resolved.command, [
+      ...resolved.args, '--prefix', addonRoot, 'run', 'install',
+      '--foreground-scripts', '--ignore-scripts=false', '--no-audit', '--no-fund',
+    ], { timeout:90_000 });
+    if (!fs.existsSync(nativeBinary) || !fs.lstatSync(nativeBinary).isFile())
+      throw new Error('native build did not create its module');
+    return true;
+  } catch {
+    // The sensor is optional; do not roll back working ReMCP access because
+    // a Mac lacks Xcode Command Line Tools. Never leak npm command stderr.
+    warn('ReMCP: optional macOS temperature sensor unavailable; other tools remain functional.');
+    return false;
+  }
+}

package/src/cli/npm-global.mjs

@@ -4,6 +4,7 @@ import process from 'node:process';
 import { resolveNpm } from '../npm.mjs';
 import { PACKAGE_NAME } from '../version.mjs';
 import { home, npm } from './env.mjs';
+import { buildVettedMacTemperatureAddon } from './mac-native-temperature.mjs';
 import { output, run } from './shell.mjs';
 
 export function servicePlatform() {
@@ -34,6 +35,16 @@ function npmGlobalInstallArgs(specs, { preferOnline = false } = {}) {
 
 export function npmGlobalInstall(...specs) {
   run(npm.command, [...npm.args, ...npmGlobalInstallArgs(specs)]);
+  if (servicePlatform() === 'darwin' && specs.some(spec => /^@remcp\/runtime@[0-9]/.test(spec))) {
+    try {
+      buildVettedMacTemperatureAddon({
+        runtimeRoot:globalPackagePath(globalPrefix(), '@remcp/runtime'), resolved:npm, runCommand:run,
+      });
+    } catch {
+      // Native temperature is optional; a second prefix lookup cannot undo a successful CLI install.
+      console.error('ReMCP: optional macOS temperature sensor unavailable; other tools remain functional.');
+    }
+  }
 }
 
 function pathEntryExists(file) {
@@ -110,6 +121,9 @@ function transactionalMacGlobalInstall({ resolved, prefix, packageNames, specs,
     if (uniqueNames.includes(PACKAGE_NAME)) moveAside(path.join(prefix, 'bin', 'remcp'), 'bin-remcp');
 
     run(resolved.command, [...resolved.args, ...npmGlobalInstallArgs(specs, { preferOnline })]);
+    if (uniqueNames.includes('@remcp/runtime')) buildVettedMacTemperatureAddon({
+      runtimeRoot:globalPackagePath(prefix, '@remcp/runtime'), resolved, runCommand:run,
+    });
   } catch (error) {
     restore(error);
     throw error;