@remcp/remcp 0.2.207 → 0.2.209

package/README.md

@@ -63,7 +63,20 @@ Two things it deliberately does not do:
   a non-interactive command cannot type one. Nothing in this mode grants root by itself.
 
 While it is on, `get_runtime_info` reports `policy.unrestricted: true`, so the model can see it and
-say so instead of assuming the guardrails are still there.
+say so instead of assuming the guardrails are still there. The same response includes
+`osPrivilegeBoundary`, reporting effective user and `NoNewPrivs` on Linux, the user boundary on
+macOS, and the actual Windows process integrity level detected via `whoami.exe /groups`.
+If that command is unavailable, Windows elevation remains `unknown`; process integrity
+is not equivalent to blanket administrator access.
+
+The owner-managed Linux `remcp-agent.service` does not set `NoNewPrivileges=true`: sudo/polkit
+may request normal OS approval instead of being blocked by systemd. `remcp update` also removes
+this legacy line from older user units. A systemd `daemon-reload` does not change an already
+running process; activating the new privilege boundary requires an agent restart, which can stop
+running terminal sessions and child processes. This does **not** enable passwordless root.
+On macOS, launchd runs as the signed-in user, and TCC controls Full Disk Access and Accessibility.
+On Windows, the interactive scheduled task requests the highest privileges available to its
+principal; UAC and the actual process token remain authoritative.
 
 ## macOS folder permissions
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/remcp",
-  "version": "0.2.207",
+  "version": "0.2.209",
   "description": "ReMCP device client: pair a computer with ReMCP and run the outbound-only agent that hosts the local MCP runtime.",
   "type": "module",
   "license": "MIT",

package/src/cli/config.mjs

@@ -2,7 +2,6 @@
 // the server uses to recognise this computer across pairings.
 import fs from 'node:fs';
 import path from 'node:path';
-import process from 'node:process';
 import { randomUUID } from 'node:crypto';
 import { normalizeRuntime } from '../runtime.mjs';
 
@@ -79,13 +78,12 @@ export function writeJsonFile(file, value) {
   fs.chmodSync(file, 0o600);
 }
 
-export function autoUpdateEnabled(config, platform = process.platform) {
-  // Linux often runs unrelated applications through the same global npm prefix. Never
-  // mutate that prefix implicitly: require `remcp auto-update on` for Linux agents.
-  // Keep the historical preference for existing explicit opt-ins and other platforms.
-  if (config?.autoUpdate === true) return true;
-  if (config?.autoUpdate === false) return false;
-  return platform !== 'linux';
+export function autoUpdateEnabled(config) {
+  // This preference controls the two first-party ReMCP npm packages only. It never
+  // upgrades the Node.js interpreter or npm itself. All supported OSes keep the
+  // historical default of automatic ReMCP releases unless the owner opts out.
+  // Updates use the verified managed service prefix, not a shared global prefix.
+  return config?.autoUpdate !== false;
 }
 
 export function flagEnabled(value) {

package/src/cli/service.mjs

@@ -62,7 +62,7 @@ function writeLinuxServiceLauncher(cliPath = globalCliPath(), nodePath = process
 
 export function installLinuxService(cliPath = globalCliPath(), nodePath = process.execPath) {
   const launcherFile = writeLinuxServiceLauncher(cliPath, nodePath);
-  const unit = `[Unit]\nDescription=ReMCP device agent\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nType=simple\nExecStart=${quoteSystemd(launcherFile)} start --service\nRestart=always\nRestartSec=3\nNoNewPrivileges=true\n\n[Install]\nWantedBy=default.target\n`;
+  const unit = `[Unit]\nDescription=ReMCP device agent\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nType=simple\nExecStart=${quoteSystemd(launcherFile)} start --service\nRestart=always\nRestartSec=3\n\n[Install]\nWantedBy=default.target\n`;
   fs.mkdirSync(path.dirname(linuxServiceFile), { recursive: true });
   fs.writeFileSync(linuxServiceFile, unit);
   run('systemctl', ['--user', 'daemon-reload']);
@@ -279,23 +279,29 @@ export function ensureServiceIfRecorded(config) {
           const launcherFile = writeLinuxServiceLauncher(cliPath, nodePath);
           const unit = fs.readFileSync(fd, 'utf8');
           const expected = `ExecStart=${quoteSystemd(launcherFile)} start --service`;
-          if (!unit.includes(expected)) {
-            const repaired = /^ExecStart=/m.test(unit) ? unit.replace(/^ExecStart=.*$/m, expected) : '';
-            if (!repaired) {
-              reinstall = true;
-            } else {
-              const data = Buffer.from(repaired, 'utf8');
-              fs.ftruncateSync(fd, 0);
-              let offset = 0;
-              while (offset < data.length) {
-                const written = fs.writeSync(fd, data, offset, data.length - offset, offset);
-                if (!written) throw new Error('Could not finish rewriting the systemd unit');
-                offset += written;
-              }
-              fs.ftruncateSync(fd, data.length);
-              fs.fsyncSync(fd);
-              run('systemctl', ['--user', 'daemon-reload']);
+          // Legacy versions added NoNewPrivileges=true to the user agent unit.
+          // Drop that line when repairing so ordinary OS-authenticated sudo/polkit
+          // can work for the owner's session. ReMCP never becomes root by itself.
+          // Do not modify unrelated systemd services or owner-managed drop-ins.
+          let repaired = unit.replace(/^NoNewPrivileges=true\r?\n/gm, '');
+          if (!repaired.includes(expected)) {
+            repaired = /^ExecStart=/m.test(repaired)
+              ? repaired.replace(/^ExecStart=.*$/m, expected) : '';
+          }
+          if (!repaired) {
+            reinstall = true;
+          } else if (repaired !== unit) {
+            const data = Buffer.from(repaired, 'utf8');
+            fs.ftruncateSync(fd, 0);
+            let offset = 0;
+            while (offset < data.length) {
+              const written = fs.writeSync(fd, data, offset, data.length - offset, offset);
+              if (!written) throw new Error('Could not finish rewriting the systemd unit');
+              offset += written;
             }
+            fs.ftruncateSync(fd, data.length);
+            fs.fsyncSync(fd);
+            run('systemctl', ['--user', 'daemon-reload']);
           }
         } finally {
           fs.closeSync(fd);

package/src/cli.mjs

@@ -1,3 +1,4 @@
+import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import process from 'node:process';
@@ -36,7 +37,20 @@ function parse(argv) {
 }
 
 function printHelp() {
-  console.log(`ReMCP ${VERSION}\n\nCommands:\n  remcp connect [--no-qr]\n  remcp start\n  remcp status\n  remcp doctor\n  remcp update\n  remcp install\n  remcp uninstall\n  remcp uninstall --purge\n  remcp telemetry [status|on|off]\n  remcp godmode [status|on|off]\n  remcp --version\n\nPairing commands are generated in the ReMCP workspace.\n\nUsage metrics are opt-out (tool names, timings, outcomes only, sent to your own ReMCP\naccount through the paired agent). Disable them at any time with: remcp telemetry off\n\nUnrestricted mode (remcp godmode on) lifts the access roots and the command guardrails for this\ncomputer only. The MCP configuration tool cannot enable it; protect remote terminal access.`);
+  console.log(`ReMCP ${VERSION}\n\nCommands:\n  remcp connect [--no-qr]\n  remcp start\n  remcp status\n  remcp doctor\n  remcp update\n  remcp auto-update [status|on|off]\n  remcp install\n  remcp uninstall\n  remcp uninstall --purge\n  remcp telemetry [status|on|off]\n  remcp godmode [status|on|off]\n  remcp --version\n\nPairing commands are generated in the ReMCP workspace.\n\nUsage metrics are opt-out (tool names, timings, outcomes only, sent to your own ReMCP\naccount through the paired agent). Disable them at any time with: remcp telemetry off\n\nUnrestricted mode (remcp godmode on) lifts the access roots and the command guardrails for this\ncomputer only. The MCP configuration tool cannot enable it; protect remote terminal access.`);
+}
+
+// The running agent snapshots update policy at startup. A saved toggle alone does not
+// change its six-hour polling loop, so reload a managed service after a policy change.
+// Defer Linux handoff to avoid terminating a remote command before it returns.
+export function applyAutoUpdatePreference(cfg, enabled, {
+  persist = saveConfig,
+  restart = restartPersistentServiceIfInstalled,
+} = {}) {
+  const changed = autoUpdateEnabled(cfg) !== enabled;
+  const updated = { ...cfg, autoUpdate: enabled };
+  persist(updated);
+  return changed ? restart(updated, { deferLinux:true }) : null;
 }
 
 export async function main(argv = process.argv.slice(2)) {
@@ -201,8 +215,15 @@ export async function main(argv = process.argv.slice(2)) {
       console.log(JSON.stringify({ autoUpdate: autoUpdateEnabled(cfg), checkIntervalHours: 6 }, null, 2));
       return;
     }
-    if (action === 'on' || action === 'enable') { saveConfig({ ...cfg, autoUpdate: true }); console.log('Auto-update enabled.'); return; }
-    if (action === 'off' || action === 'disable') { saveConfig({ ...cfg, autoUpdate: false }); console.log('Auto-update disabled. Run `remcp update` yourself when you want a new version.'); return; }
+    if (['on', 'enable', 'off', 'disable'].includes(action)) {
+      const enabled = action === 'on' || action === 'enable';
+      const changed = autoUpdateEnabled(cfg) !== enabled;
+      const restarted = applyAutoUpdatePreference(cfg, enabled);
+      console.log(enabled ? 'Auto-update enabled.' : 'Auto-update disabled. Run `remcp update` yourself when you want a new version.');
+      if (restarted) console.log(`ReMCP agent ${restarted} to apply the update policy.`);
+      else if (changed) console.log('Restart any manually managed ReMCP agent to apply the update policy.');
+      return;
+    }
     throw new Error('Usage: remcp auto-update [status|on|off]');
   }
 
@@ -284,11 +305,15 @@ export async function main(argv = process.argv.slice(2)) {
     const targetClient = String(advertised?.cliVersion || '').trim() || null;
     const targetRuntime = String(advertised?.runtime || '').trim() || null;
     const configuredRuntime = String(cfg.runtime.packageSpec || '');
+    // The history also records CLI paths from old Node.js environments. An entry for
+    // a no-longer-existing path is not an additional installed package or agent.
     const installationPaths = new Set([
       currentInstall.cliPath,
       serviceInstall.cliPath,
       ...(Array.isArray(cfg.installations) ? cfg.installations.map(item => item?.cliPath) : []),
-    ].filter(Boolean));
+    ].filter(file => typeof file === 'string' && fs.existsSync(file)).map(file => {
+      try { return fs.realpathSync(file); } catch { return file; }
+    }));
     const multipleInstallations = installationPaths.size > 1;
     const knownCliVersions = [VERSION, serviceInstall.cliVersion].filter(Boolean);
     const knownRuntimeVersions = [installedRuntime, serviceInstall.runtimeVersion].filter(Boolean);