@remcp/remcp 0.2.209 → 0.2.210

package/README.md

@@ -90,7 +90,7 @@ permission, and `remcp doctor` reports the state of each one.
 
 ## Updates
 
-The agent asks the server which versions it should run on every successful connection and every six hours, installs the exact trusted client/runtime release pair in the background, and restarts the managed service so it takes effect. The updater resolves itself and the sibling runtime from the package that is actually running instead of depending on an interactive shell PATH. When the same computer has been used from more than one Node manager (for example NVM plus Hermes/FNM/Homebrew), ReMCP keeps the canonical service installation stable and converges the known local installations on the same release pair. `remcp status` reports mixed installations instead of hiding the skew. A failed install is retried no more often than every thirty minutes and update-check failures are logged, so a broken release cannot become a silent install loop. `remcp update` does the same immediately; `remcp auto-update off` disables automatic checks.
+The agent asks the server which versions it should run on every successful connection and every six hours, installs the exact trusted client/runtime release pair in the background, and restarts the managed service so it takes effect. The updater resolves itself and the sibling runtime from the package that is actually running instead of depending on an interactive shell PATH. When a computer has several Node.js environments (for example NVM, FNM or a system installation), ReMCP updates only the canonical managed service packages. It does not upgrade Node.js, rewrite unrelated npm packages, or silently remove old ReMCP copies. `remcp status` counts package roots verified from the current CLI/service and bounded installation history; aliases and vanished paths are not extra installations. `remcp doctor` adds the exact read-only package roots, corresponding client/runtime versions, aliases and historical/cache classifications. These are **physical package copies, not a count of running agents**. Old copies are never automatically removed; verifying process, startup and script dependencies is required before an explicit owner-approved cleanup. A failed install is retried no more often than every thirty minutes and update-check failures are logged, so a broken release cannot become a silent install loop. `remcp update` does the same immediately; `remcp auto-update off` disables automatic checks.
 
 ## Computer-use routing
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/remcp",
-  "version": "0.2.209",
+  "version": "0.2.210",
   "description": "ReMCP device client: pair a computer with ReMCP and run the outbound-only agent that hosts the local MCP runtime.",
   "type": "module",
   "license": "MIT",
@@ -18,7 +18,7 @@
     "README.md"
   ],
   "scripts": {
-    "check": "node --check bin/remcp.mjs && node --check src/agent-deploy-reconnect.mjs && node --check src/agent-network-probe-client.mjs && node --check src/agent-relay-connection.mjs && node --check src/agent-responder.mjs && node --check src/agent-runtime-capabilities.mjs && node --check src/agent-update-monitor.mjs && node --check src/agent-update.mjs && node --check src/agent-utilities.mjs && node --check src/agent.mjs && node --check src/cli.mjs && node --check src/cli/config.mjs && node --check src/cli/connect.mjs && node --check src/cli/doctor.mjs && node --check src/cli/env.mjs && node --check src/cli/mac-native-temperature.mjs && node --check src/cli/npm-global.mjs && node --check src/cli/pairing-qr.mjs && node --check src/cli/service-inventory.mjs && node --check src/cli/service-macos.mjs && node --check src/cli/service-paths.mjs && node --check src/cli/service.mjs && node --check src/cli/shell.mjs && node --check src/cli/update.mjs && node --check src/cli/windows-supervisor.mjs && node --check src/cli/windows-user-supervisor.mjs && node --check src/fetch-update-manifest.mjs && node --check src/fs-access.mjs && node --check src/npm.mjs && node --check src/runtime.mjs && node --check src/version.mjs",
+    "check": "node --check bin/remcp.mjs && node --check src/agent-deploy-reconnect.mjs && node --check src/agent-network-probe-client.mjs && node --check src/agent-relay-connection.mjs && node --check src/agent-responder.mjs && node --check src/agent-runtime-capabilities.mjs && node --check src/agent-update-monitor.mjs && node --check src/agent-update.mjs && node --check src/agent-utilities.mjs && node --check src/agent.mjs && node --check src/cli.mjs && node --check src/cli/config.mjs && node --check src/cli/connect.mjs && node --check src/cli/doctor.mjs && node --check src/cli/env.mjs && node --check src/cli/installation-audit.mjs && node --check src/cli/mac-native-temperature.mjs && node --check src/cli/npm-global.mjs && node --check src/cli/pairing-qr.mjs && node --check src/cli/service-inventory.mjs && node --check src/cli/service-macos.mjs && node --check src/cli/service-paths.mjs && node --check src/cli/service.mjs && node --check src/cli/shell.mjs && node --check src/cli/update.mjs && node --check src/cli/windows-supervisor.mjs && node --check src/cli/windows-user-supervisor.mjs && node --check src/fetch-update-manifest.mjs && node --check src/fs-access.mjs && node --check src/npm.mjs && node --check src/runtime.mjs && node --check src/version.mjs",
     "test": "node --test test/*.test.mjs"
   },
   "dependencies": {

package/src/cli/installation-audit.mjs

@@ -0,0 +1,79 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+const CLIENT_PACKAGE = '@remcp/remcp';
+const MAX_HISTORY = 32;
+
+// Inventory only paths previously recorded by this owner and the two current CLI
+// entrypoints. Never crawl npm/node directories or infer running processes.
+function installedPackageAt(cliPath) {
+  if (typeof cliPath !== 'string' || !cliPath.trim() || !fs.existsSync(cliPath)) return null;
+  let resolved;
+  try { resolved = fs.realpathSync(cliPath); } catch { return null; }
+  const normalized = resolved.replaceAll('\\', '/');
+  const marker = '/node_modules/@remcp/remcp/';
+  const markerAt = normalized.lastIndexOf(marker);
+  let root = markerAt < 0 ? null : resolved.slice(0, markerAt + marker.length - 1);
+  // npm on Windows uses a .cmd shim in the global prefix instead of a link.
+  if (!root && path.basename(resolved).toLowerCase() === 'remcp.cmd') {
+    root = path.join(path.dirname(resolved), 'node_modules', '@remcp', 'remcp');
+  }
+  if (!root) return null;
+  try {
+    const manifest = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+    if (manifest.name !== CLIENT_PACKAGE || typeof manifest.version !== 'string') return null;
+    let runtimeVersion = null;
+    try {
+      const runtime = JSON.parse(fs.readFileSync(path.join(root, '..', 'runtime', 'package.json'), 'utf8'));
+      if (runtime.name === '@remcp/runtime' && typeof runtime.version === 'string') runtimeVersion = runtime.version;
+    } catch {}
+    return { root:fs.realpathSync(root), resolved, version:manifest.version, runtimeVersion };
+  } catch { return null; }
+}
+
+export function auditKnownInstallations(config, { currentCliPath, serviceCliPath } = {}) {
+  const history = Array.isArray(config?.installations) ? config.installations.slice(-MAX_HISTORY) : [];
+  const candidates = [
+    { path:currentCliPath, source:'invoked_cli' },
+    { path:serviceCliPath, source:'managed_service' },
+    ...history.map(item => ({ path:item?.cliPath, source:'saved_history' })),
+  ];
+  const packages = new Map();
+  const aliases = [];
+  let ignoredUnverified = 0;
+  for (const candidate of candidates) {
+    if (typeof candidate.path !== 'string' || !candidate.path.trim() || !fs.existsSync(candidate.path)) continue;
+    const installed = installedPackageAt(candidate.path);
+    if (!installed) { ignoredUnverified++; continue; }
+    let copy = packages.get(installed.root);
+    if (!copy) {
+      copy = { packageRoot:installed.root, version:installed.version, runtimeVersion:installed.runtimeVersion, sources:new Set(), cliPaths:new Set() };
+      packages.set(installed.root, copy);
+    }
+    copy.sources.add(candidate.source);
+    copy.cliPaths.add(candidate.path);
+    if (candidate.path !== installed.resolved && !aliases.some(a => a.path === candidate.path)) {
+      aliases.push({ path:candidate.path, resolvesTo:installed.resolved });
+    }
+  }
+  const copies = [...packages.values()].map(item => ({
+    packageRoot:item.packageRoot,
+    version:item.version,
+    runtimeVersion:item.runtimeVersion,
+    sources:[...item.sources],
+    kind:item.packageRoot.replaceAll('\\', '/').includes('/_npx/') ? 'npx_cache' : 'npm_package',
+    isInvoked:item.sources.has('invoked_cli'),
+    isManagedService:item.sources.has('managed_service'),
+    cliPaths:[...item.cliPaths],
+  }));
+  return {
+    scope:'recorded_paths_only',
+    processConcurrency:'not_measured',
+    packageCopyCount:copies.length,
+    otherCopyCount:copies.filter(item => !item.isInvoked && !item.isManagedService).length,
+    ignoredUnverifiedPathCount:ignoredUnverified,
+    aliases,
+    copies,
+    removal:'disabled; explicit owner review and process/dependency audit required',
+  };
+}

package/src/cli.mjs

@@ -13,6 +13,7 @@ import { assertRuntimeTrust, assertSecureServerUrl, pairWithDeviceCode } from '.
 import { diagnoseLocalRuntime, installedVersion, runtimeAllowedRoots } from './cli/doctor.mjs';
 import { configFile, npm, officialOrigin, runtimeConfigFile } from './cli/env.mjs';
 import { currentInstallationInfo, ensureMacCliCommand, installPersistentAgent, persistentServiceState, servicePlatform, rememberCurrentInstallation, restartPersistentServiceIfInstalled, serviceInstallationInfo, uninstallPersistentService } from './cli/service.mjs';
+import { auditKnownInstallations } from './cli/installation-audit.mjs';
 import { scheduleMacTemperatureRepair } from './cli/mac-native-temperature.mjs';
 import { repairMacTemperatureAfterStart } from './cli/npm-global.mjs';
 import { run } from './cli/shell.mjs';
@@ -305,16 +306,13 @@ export async function main(argv = process.argv.slice(2)) {
     const targetClient = String(advertised?.cliVersion || '').trim() || null;
     const targetRuntime = String(advertised?.runtime || '').trim() || null;
     const configuredRuntime = String(cfg.runtime.packageSpec || '');
-    // The history also records CLI paths from old Node.js environments. An entry for
-    // a no-longer-existing path is not an additional installed package or agent.
-    const installationPaths = new Set([
-      currentInstall.cliPath,
-      serviceInstall.cliPath,
-      ...(Array.isArray(cfg.installations) ? cfg.installations.map(item => item?.cliPath) : []),
-    ].filter(file => typeof file === 'string' && fs.existsSync(file)).map(file => {
-      try { return fs.realpathSync(file); } catch { return file; }
-    }));
-    const multipleInstallations = installationPaths.size > 1;
+    // Count verified physical ReMCP package roots, not merely surviving paths or
+    // shell aliases. This is NOT a concurrent-agent/process count.
+    const installationAudit = auditKnownInstallations(cfg, {
+      currentCliPath:currentInstall.cliPath,
+      serviceCliPath:service.installed ? serviceInstall.cliPath : null,
+    });
+    const multipleInstallations = installationAudit.packageCopyCount > 1;
     const knownCliVersions = [VERSION, serviceInstall.cliVersion].filter(Boolean);
     const knownRuntimeVersions = [installedRuntime, serviceInstall.runtimeVersion].filter(Boolean);
     const versionConsistent = cfg.runtime.packageName === '@remcp/runtime'
@@ -368,6 +366,9 @@ export async function main(argv = process.argv.slice(2)) {
         targetClient,
         targetRuntime,
         multipleInstallations,
+        knownPackageCopies:installationAudit.packageCopyCount,
+        additionalKnownPackageCopies:installationAudit.otherCopyCount,
+        installationCountScope:'verified_physical_packages_not_running_agents',
         versionConsistent,
         state:updateState,
         upToDate,
@@ -382,6 +383,7 @@ export async function main(argv = process.argv.slice(2)) {
         serviceInstalled:service.installed,
         runtimeEntry:cfg.runtime.entry,
         npmManaged:true,
+        installations:installationAudit,
       };
     }
     console.log(JSON.stringify(report, null, 2));