@remcp/remcp 0.2.207 → 0.2.208

package/README.md

@@ -63,7 +63,20 @@ Two things it deliberately does not do:
   a non-interactive command cannot type one. Nothing in this mode grants root by itself.
 
 While it is on, `get_runtime_info` reports `policy.unrestricted: true`, so the model can see it and
-say so instead of assuming the guardrails are still there.
+say so instead of assuming the guardrails are still there. The same response includes
+`osPrivilegeBoundary`, reporting effective user and `NoNewPrivs` on Linux, the user boundary on
+macOS, and the actual Windows process integrity level detected via `whoami.exe /groups`.
+If that command is unavailable, Windows elevation remains `unknown`; process integrity
+is not equivalent to blanket administrator access.
+
+The owner-managed Linux `remcp-agent.service` does not set `NoNewPrivileges=true`: sudo/polkit
+may request normal OS approval instead of being blocked by systemd. `remcp update` also removes
+this legacy line from older user units. A systemd `daemon-reload` does not change an already
+running process; activating the new privilege boundary requires an agent restart, which can stop
+running terminal sessions and child processes. This does **not** enable passwordless root.
+On macOS, launchd runs as the signed-in user, and TCC controls Full Disk Access and Accessibility.
+On Windows, the interactive scheduled task requests the highest privileges available to its
+principal; UAC and the actual process token remain authoritative.
 
 ## macOS folder permissions
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/remcp",
-  "version": "0.2.207",
+  "version": "0.2.208",
   "description": "ReMCP device client: pair a computer with ReMCP and run the outbound-only agent that hosts the local MCP runtime.",
   "type": "module",
   "license": "MIT",

package/src/cli/service.mjs

@@ -62,7 +62,7 @@ function writeLinuxServiceLauncher(cliPath = globalCliPath(), nodePath = process
 
 export function installLinuxService(cliPath = globalCliPath(), nodePath = process.execPath) {
   const launcherFile = writeLinuxServiceLauncher(cliPath, nodePath);
-  const unit = `[Unit]\nDescription=ReMCP device agent\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nType=simple\nExecStart=${quoteSystemd(launcherFile)} start --service\nRestart=always\nRestartSec=3\nNoNewPrivileges=true\n\n[Install]\nWantedBy=default.target\n`;
+  const unit = `[Unit]\nDescription=ReMCP device agent\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nType=simple\nExecStart=${quoteSystemd(launcherFile)} start --service\nRestart=always\nRestartSec=3\n\n[Install]\nWantedBy=default.target\n`;
   fs.mkdirSync(path.dirname(linuxServiceFile), { recursive: true });
   fs.writeFileSync(linuxServiceFile, unit);
   run('systemctl', ['--user', 'daemon-reload']);
@@ -279,23 +279,29 @@ export function ensureServiceIfRecorded(config) {
           const launcherFile = writeLinuxServiceLauncher(cliPath, nodePath);
           const unit = fs.readFileSync(fd, 'utf8');
           const expected = `ExecStart=${quoteSystemd(launcherFile)} start --service`;
-          if (!unit.includes(expected)) {
-            const repaired = /^ExecStart=/m.test(unit) ? unit.replace(/^ExecStart=.*$/m, expected) : '';
-            if (!repaired) {
-              reinstall = true;
-            } else {
-              const data = Buffer.from(repaired, 'utf8');
-              fs.ftruncateSync(fd, 0);
-              let offset = 0;
-              while (offset < data.length) {
-                const written = fs.writeSync(fd, data, offset, data.length - offset, offset);
-                if (!written) throw new Error('Could not finish rewriting the systemd unit');
-                offset += written;
-              }
-              fs.ftruncateSync(fd, data.length);
-              fs.fsyncSync(fd);
-              run('systemctl', ['--user', 'daemon-reload']);
+          // Legacy versions added NoNewPrivileges=true to the user agent unit.
+          // Drop that line when repairing so ordinary OS-authenticated sudo/polkit
+          // can work for the owner's session. ReMCP never becomes root by itself.
+          // Do not modify unrelated systemd services or owner-managed drop-ins.
+          let repaired = unit.replace(/^NoNewPrivileges=true\r?\n/gm, '');
+          if (!repaired.includes(expected)) {
+            repaired = /^ExecStart=/m.test(repaired)
+              ? repaired.replace(/^ExecStart=.*$/m, expected) : '';
+          }
+          if (!repaired) {
+            reinstall = true;
+          } else if (repaired !== unit) {
+            const data = Buffer.from(repaired, 'utf8');
+            fs.ftruncateSync(fd, 0);
+            let offset = 0;
+            while (offset < data.length) {
+              const written = fs.writeSync(fd, data, offset, data.length - offset, offset);
+              if (!written) throw new Error('Could not finish rewriting the systemd unit');
+              offset += written;
             }
+            fs.ftruncateSync(fd, data.length);
+            fs.fsyncSync(fd);
+            run('systemctl', ['--user', 'daemon-reload']);
           }
         } finally {
           fs.closeSync(fd);