@remcp/remcp 0.2.212 → 0.2.214

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/remcp",
-  "version": "0.2.212",
+  "version": "0.2.214",
   "description": "ReMCP device client: pair a computer with ReMCP and run the outbound-only agent that hosts the local MCP runtime.",
   "type": "module",
   "license": "MIT",
@@ -18,7 +18,7 @@
     "README.md"
   ],
   "scripts": {
-    "check": "node --check bin/remcp.mjs && node --check src/agent-deploy-reconnect.mjs && node --check src/agent-network-probe-client.mjs && node --check src/agent-relay-connection.mjs && node --check src/agent-responder.mjs && node --check src/agent-runtime-capabilities.mjs && node --check src/agent-update-monitor.mjs && node --check src/agent-update.mjs && node --check src/agent-utilities.mjs && node --check src/agent.mjs && node --check src/cli.mjs && node --check src/cli/config.mjs && node --check src/cli/connect.mjs && node --check src/cli/doctor.mjs && node --check src/cli/env.mjs && node --check src/cli/installation-audit.mjs && node --check src/cli/mac-native-temperature.mjs && node --check src/cli/npm-global.mjs && node --check src/cli/pairing-qr.mjs && node --check src/cli/service-inventory.mjs && node --check src/cli/service-macos.mjs && node --check src/cli/service-paths.mjs && node --check src/cli/service.mjs && node --check src/cli/shell.mjs && node --check src/cli/update.mjs && node --check src/cli/windows-supervisor.mjs && node --check src/cli/windows-user-supervisor.mjs && node --check src/fetch-update-manifest.mjs && node --check src/fs-access.mjs && node --check src/npm.mjs && node --check src/runtime.mjs && node --check src/version.mjs",
+    "check": "node --check bin/remcp.mjs && node --check src/agent-deploy-reconnect.mjs && node --check src/agent-network-probe-client.mjs && node --check src/agent-relay-connection.mjs && node --check src/agent-responder.mjs && node --check src/agent-runtime-capabilities.mjs && node --check src/agent-update-monitor.mjs && node --check src/agent-update.mjs && node --check src/agent-utilities.mjs && node --check src/agent.mjs && node --check src/cli.mjs && node --check src/cli/config.mjs && node --check src/cli/connect.mjs && node --check src/cli/doctor.mjs && node --check src/cli/env.mjs && node --check src/cli/installation-audit.mjs && node --check src/cli/mac-native-temperature.mjs && node --check src/cli/npm-global.mjs && node --check src/cli/pairing-qr.mjs && node --check src/cli/service-inventory.mjs && node --check src/cli/service-macos.mjs && node --check src/cli/service-paths.mjs && node --check src/cli/service.mjs && node --check src/cli/shell.mjs && node --check src/cli/update.mjs && node --check src/cli/windows-supervisor.mjs && node --check src/cli/windows-task-restart.mjs && node --check src/cli/windows-user-supervisor.mjs && node --check src/fetch-update-manifest.mjs && node --check src/fs-access.mjs && node --check src/npm.mjs && node --check src/runtime.mjs && node --check src/version.mjs",
     "test": "node --test test/*.test.mjs"
   },
   "dependencies": {

package/src/cli/connect.mjs

@@ -9,14 +9,13 @@ import { officialOrigin } from './env.mjs';
 import { sleep } from './shell.mjs';
 import { printPairingQr } from './pairing-qr.mjs';
 
-// Keep the server-provided approval URL as one argument all the way to the OS.
-// Windows Explorer can treat a URL as a shell path and open Documents instead.
-// FileProtocolHandler dispatches to the default browser without a cmd/PowerShell shell,
-// where a URL query containing '&' could otherwise be interpreted as a command.
+// Keep the server-provided approval URL as data all the way to the OS. In particular, do not route it
+// through `cmd /c start` on Windows: cmd reparses metacharacters such as `&`, so a custom pairing
+// server could otherwise turn a verification URL into a local shell command.
 export function browserLaunchCommand(url, platform = process.platform) {
   const target = String(url);
   if (platform === 'darwin') return { command: 'open', args: [target] };
-  if (platform === 'win32') return { command: 'rundll32.exe', args: ['url.dll,FileProtocolHandler', target] };
+  if (platform === 'win32') return { command: 'explorer.exe', args: [target] };
   return { command: 'xdg-open', args: [target] };
 }
 

package/src/cli/env.mjs

@@ -17,6 +17,7 @@ export const macServiceFile = path.join(home, 'Library', 'LaunchAgents', `${macS
 export const macLogFile = path.join(home, 'Library', 'Logs', 'remcp-agent.log');
 export const windowsTaskName = 'ReMCP Agent';
 export const windowsServiceLauncherFile = path.join(configDir, 'remcp-agent.cmd');
+export const windowsTaskScriptFile = path.join(configDir, 'remcp-agent.vbs');
 // Task Scheduler may refuse to create a task for a standard Windows account.
 // This per-user Startup folder runs without administrator privileges.
 export const windowsStartupScriptFile = path.join(

package/src/cli/service-inventory.mjs

@@ -72,6 +72,19 @@ function inferServiceIdentity() {
 
 export function canonicalServiceCliPath(config) {
   const configured = String(config?.serviceCliPath || '').trim();
+  if (servicePlatform() === 'win32' && configured) {
+    // Saved serviceCliPath is the resolved npm package entry (remcp.mjs), not
+    // the Windows executable shim. CMD `call remcp.mjs` opens the Windows
+    // "Choose an app" dialog instead of starting Node, and dirname(entry) is
+    // an invalid NPM_CONFIG_PREFIX. Recover the sibling npm global shim.
+    const suffix = '/node_modules/@remcp/remcp/bin/remcp.mjs';
+    if (configured.replaceAll('\\', '/').toLowerCase().endsWith(suffix)) {
+      const prefix = configured.slice(0, -suffix.length);
+      const shim = path.join(prefix, 'remcp.cmd');
+      if (!fs.existsSync(shim)) throw new Error('Windows ReMCP npm shim is missing; refusing a .mjs Scheduled Task');
+      return shim;
+    }
+  }
   if (configured && fs.existsSync(configured)) return configured;
   const inferred = inferServiceIdentity().cliPath;
   if (inferred && fs.existsSync(inferred)) return inferred;

package/src/cli/service.mjs

@@ -15,10 +15,11 @@ export { macLaunchDomain, ensureMacCliCommand, installMacService } from './servi
 import { PACKAGE_NAME, VERSION } from '../version.mjs';
 
 import { saveConfig } from './config.mjs';
-import { configDir, home, linuxServiceFile, linuxServiceLauncherFile, macServiceFile, macServiceLabel, windowsServiceLauncherFile, windowsStartupScriptFile, windowsTaskName } from './env.mjs';
+import { configDir, home, linuxServiceFile, linuxServiceLauncherFile, macServiceFile, macServiceLabel, windowsServiceLauncherFile, windowsTaskScriptFile, windowsStartupScriptFile, windowsTaskName } from './env.mjs';
 import { run } from './shell.mjs';
-import { windowsServiceLauncherText, windowsTaskReliabilityCommand, windowsTaskAbsenceCommand, windowsBatchUnsafeProfile, windowsStartupScriptText, windowsStartupScriptInstalled } from './windows-supervisor.mjs';
+import { windowsServiceLauncherText, windowsTaskReliabilityCommand, windowsTaskAbsenceCommand, windowsBatchUnsafeProfile, windowsTaskScriptText, windowsTaskScriptInstalled, windowsStartupScriptText, windowsStartupScriptInstalled } from './windows-supervisor.mjs';
 import { ensureWindowsSupervisorKey, windowsSupervisorCommand } from './windows-user-supervisor.mjs';
+import { scheduleWindowsTaskRestart } from './windows-task-restart.mjs';
 
 export function quoteSystemd(value) {
   return `"${String(value).replaceAll('\\', '\\\\').replaceAll('"', '\\"')}"`;
@@ -78,6 +79,20 @@ export function writeWindowsServiceLauncher(cliPath = globalCliPath(), nodePath
   return windowsServiceLauncherFile;
 }
 
+function writeWindowsTaskScript(launcherFile) {
+  if (fs.existsSync(windowsTaskScriptFile) && !windowsTaskScriptInstalled(windowsTaskScriptFile, windowsServiceLauncherFile)) {
+    throw new Error('The ReMCP scheduled task script is not owned by ReMCP; refusing to overwrite it');
+  }
+  const script = windowsTaskScriptText(launcherFile);
+  fs.mkdirSync(configDir, { recursive:true, mode:0o700 });
+  const temporary = `${windowsTaskScriptFile}.${process.pid}.${Date.now()}.tmp`;
+  try {
+    fs.writeFileSync(temporary, '\uFEFF' + script, { flag:'wx', encoding:'utf16le', mode:0o600 });
+    fs.renameSync(temporary, windowsTaskScriptFile);
+  } finally { try { fs.unlinkSync(temporary); } catch {} }
+  return windowsTaskScriptFile;
+}
+
 function installWindowsUserStartup(cliPath, nodePath) {
   const existed = fs.existsSync(windowsStartupScriptFile);
   if (existed && !windowsStartupScriptInstalled(windowsStartupScriptFile)) {
@@ -147,19 +162,11 @@ export function installWindowsService(cliPath = globalCliPath(), { nodePath = pr
     installWindowsUserStartup(cliPath, nodePath);
     return;
   }
-  // Task Scheduler runs an /IT .cmd inside a *visible* terminal window.
-  // For fresh installations prefer our existing hidden WSH + Node supervisor.
-  // Keep already-registered scheduled tasks intact until an explicit migration;
-  // never start two supervisors for the same machine.
-  const previousTask = spawnSync('schtasks.exe', ['/Query', '/TN', windowsTaskName],
-    { stdio:'ignore', windowsHide:true, timeout:10000 });
-  if (previousTask.status !== 0) {
-    requireWindowsScheduledTaskAbsent();
-    installWindowsUserStartup(cliPath, nodePath);
-    return;
-  }
   const launcherFile = writeWindowsServiceLauncher(cliPath, nodePath);
-  const command = `"${launcherFile}"`;
+  const taskScript = writeWindowsTaskScript(launcherFile);
+  // WScript has no console; its hidden CMD child remains attached until it exits.
+  // /IT keeps desktop/UI automation in the signed-in user's session.
+  const command = `wscript.exe //B //Nologo "${taskScript}"`;
   // Current-user interactive tasks need /IT. /RL LIMITED avoids requiring elevation.
   // An organization may still disable creation of all tasks by standard users.
   const created = spawnSync('schtasks.exe',
@@ -347,7 +354,7 @@ export function deferredLinuxAgentRestartArgs(pid) {
     'systemctl', '--user', 'restart', 'remcp-agent.service'];
 }
 
-export function restartPersistentServiceIfInstalled(config, { deferLinux = false } = {}) {
+export function restartPersistentServiceIfInstalled(config, { deferLinux = false, deferWindows = false } = {}) {
   if (!persistentServiceExpected(config)) return null;
   const platform = servicePlatform();
   if (platform === 'linux' && fs.existsSync(linuxServiceFile)) {
@@ -382,6 +389,7 @@ export function restartPersistentServiceIfInstalled(config, { deferLinux = false
     }
     const result = spawnSync('schtasks.exe', ['/Query', '/TN', windowsTaskName], { stdio: 'ignore' });
     if (result.status === 0) {
+      if (deferWindows) return scheduleWindowsTaskRestart(canonicalServiceNodePath(config));
       // /Run does not restart a task that is already running; stop the previous
       // process first so a rotated credential is loaded by the replacement.
       spawnSync('schtasks.exe', ['/End', '/TN', windowsTaskName], { stdio: 'ignore' });
@@ -420,6 +428,7 @@ export function uninstallPersistentService() {
     }
     spawnSync('schtasks.exe', ['/End', '/TN', windowsTaskName], { stdio: 'ignore' });
     spawnSync('schtasks.exe', ['/Delete', '/TN', windowsTaskName, '/F'], { stdio: 'ignore' });
+    try { if (windowsTaskScriptInstalled(windowsTaskScriptFile, windowsServiceLauncherFile)) fs.unlinkSync(windowsTaskScriptFile); } catch {}
     try { fs.unlinkSync(windowsServiceLauncherFile); } catch {}
   }
 }

package/src/cli/windows-supervisor.mjs

@@ -24,6 +24,12 @@ export function windowsBatchUnsafeProfile(...paths) {
 }
 
 export function windowsServiceLauncherText(cliPath, nodePath, { localAppData = process.env.LOCALAPPDATA } = {}) {
+  // CMD's `call` executes batch shims, not the underlying .mjs source. A saved
+  // package entry is valid for `node.exe remcp.mjs`, but invalid as a Task
+  // Scheduler command and must never be written into a persistent launcher.
+  if (/\.mjs$/i.test(String(cliPath))) {
+    throw new Error('Windows Scheduled Task requires the ReMCP .cmd shim, not a .mjs module');
+  }
   // Tests can simulate win32 from a POSIX runner with injected temporary paths.
   // Native Windows paths always use win32 parsing; POSIX-shaped fixtures keep their roots.
   const dirname = file => /^[A-Za-z]:[\\/]/.test(file) || file.includes('\\')
@@ -65,6 +71,44 @@ export function windowsServiceLauncherText(cliPath, nodePath, { localAppData = p
   ].join('\r\n');
 }
 
+export const WINDOWS_TASK_MARKER = "' ReMCP managed scheduled task (do not edit)";
+
+// WScript is a GUI subsystem executable: it starts the existing CMD supervisor
+// with SW_HIDE, while waiting for it so Task Scheduler still owns its lifetime.
+// A Task Scheduler "Hidden" setting only hides the task in its UI, not the console.
+export function windowsTaskScriptText(launcherPath) {
+  if (typeof launcherPath !== 'string' || !launcherPath ||
+      /["\0\r\n]/.test(launcherPath) ||
+      !(path.isAbsolute(launcherPath) || path.win32.isAbsolute(launcherPath))) {
+    throw new Error('Invalid ReMCP Windows task launcher');
+  }
+  return [
+    WINDOWS_TASK_MARKER,
+    'Set remcpShell = CreateObject("WScript.Shell")',
+    `remcpShell.Run Chr(34) & "${launcherPath}" & Chr(34), 0, True`,
+    '',
+  ].join('\r\n');
+}
+
+export function windowsTaskScriptInstalled(file, expectedLauncherPath = null) {
+  try {
+    const text = fs.readFileSync(file, 'utf16le');
+    const lines = text.replace(/^\uFEFF/, '').split('\r\n');
+    if (!text.startsWith('\uFEFF') || lines.length !== 4 ||
+        lines[0] !== WINDOWS_TASK_MARKER ||
+        lines[1] !== 'Set remcpShell = CreateObject("WScript.Shell")' ||
+        lines[3] !== '') return false;
+    const match = lines[2].match(/^remcpShell\.Run Chr\(34\) & "([^"]+)" & Chr\(34\), 0, True$/);
+    if (!match) return false;
+    const launcher = match[1];
+    const absolute = path.isAbsolute(launcher) || path.win32.isAbsolute(launcher);
+    const expected = expectedLauncherPath === null ||
+      path.win32.normalize(launcher).toLowerCase() === path.win32.normalize(expectedLauncherPath).toLowerCase();
+    return absolute && expected &&
+      path.posix.basename(launcher.replaceAll('\\', '/')) === 'remcp-agent.cmd';
+  } catch { return false; }
+}
+
 export const WINDOWS_STARTUP_MARKER = "' ReMCP managed user startup (do not edit)";
 
 // Start the existing private launcher in the interactive user's session without displaying

package/src/cli/windows-task-restart.mjs

@@ -0,0 +1,53 @@
+// ReMCP's confirmed remote God Mode change must acknowledge its command BEFORE
+// killing the agent's own Task Scheduler process tree. Launch a fixed-purpose
+// helper outside the CLI process; never interpolate a user-provided task or shell.
+import { spawn, spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+import { fileURLToPath } from 'node:url';
+import { windowsTaskName } from './env.mjs';
+
+const helperPath = fileURLToPath(import.meta.url);
+const options = { windowsHide:true, encoding:'utf8', timeout:15000, maxBuffer:32768 };
+
+export function scheduleWindowsTaskRestart(nodePath = process.execPath) {
+  if (!path.isAbsolute(nodePath) || !fs.existsSync(nodePath)) {
+    throw new Error('Windows deferred restart requires the existing Node interpreter');
+  }
+  const child = spawn(nodePath, [helperPath, '--relaunch'], {
+    detached:true, windowsHide:true, stdio:'ignore',
+  });
+  if (!Number.isSafeInteger(child.pid) || child.pid <= 0) {
+    throw new Error('Could not schedule independent Windows ReMCP restart');
+  }
+  child.unref();
+  return 'ReMCP Agent (restart scheduled)';
+}
+
+export async function executeWindowsTaskRestart({
+  pause = ms => new Promise(resolve => setTimeout(resolve,ms)),
+  invoke = spawnSync,
+} = {}) {
+  await pause(2500);
+  // Do not run a second agent if Windows refused to stop the owned task.
+  const stopped = invoke('schtasks.exe', ['/End','/TN',windowsTaskName], options);
+  if (stopped.error || stopped.status !== 0) {
+    throw new Error('Windows ReMCP task could not be stopped safely');
+  }
+  const started = invoke('schtasks.exe', ['/Run','/TN',windowsTaskName], options);
+  if (started.error || started.status !== 0) {
+    throw new Error('Windows ReMCP task could not be started after stop');
+  }
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === helperPath) {
+  if (process.argv[2] !== '--relaunch' || process.argv.length !== 3 || process.platform !== 'win32') {
+    process.exitCode = 2;
+  } else {
+    executeWindowsTaskRestart().catch(error => {
+      console.error(error.message);
+      process.exitCode = 1;
+    });
+  }
+}

package/src/cli.mjs

@@ -271,11 +271,12 @@ export async function main(argv = process.argv.slice(2)) {
     if (!['on', 'off', 'enable', 'disable'].includes(action)) throw new Error('Usage: remcp godmode [status|on|off]');
     const enabled = action === 'on' || action === 'enable';
     writeJsonFile(runtimeConfigFile, { ...readJsonFile(runtimeConfigFile), unrestricted: enabled });
-    // The authenticated Workspace supplies this explicit flag to allow the
-    // remote command to finish before its agent schedules a Linux restart.
-    // Local CLI and normal update operations retain synchronous semantics.
+    // The authenticated Workspace supplies this explicit flag so the remote
+    // command can acknowledge a policy change before Linux/Windows kills its
+    // own agent session. Local CLI operations retain synchronous semantics.
     const restarted = restartPersistentServiceIfInstalled(loadConfig(false),
-      { deferLinux: flags['defer-restart'] === true });
+      { deferLinux: flags['defer-restart'] === true,
+        deferWindows: flags['defer-restart'] === true });
     if (enabled) {
       console.error('Unrestricted mode is ON for this computer: every path and every command is allowed, including sudo. Anything the model is asked to do -- and anything a prompt injection asks it to do -- can now change this machine. Turn it off with `remcp godmode off` when you are done.');
     } else {