@remcp/remcp 0.2.215 → 0.2.217

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/remcp",
-  "version": "0.2.215",
+  "version": "0.2.217",
   "description": "ReMCP device client: pair a computer with ReMCP and run the outbound-only agent that hosts the local MCP runtime.",
   "type": "module",
   "license": "MIT",
@@ -18,7 +18,7 @@
     "README.md"
   ],
   "scripts": {
-    "check": "node --check bin/remcp.mjs && node --check src/agent-deploy-reconnect.mjs && node --check src/agent-network-probe-client.mjs && node --check src/agent-relay-connection.mjs && node --check src/agent-responder.mjs && node --check src/agent-runtime-capabilities.mjs && node --check src/agent-update-monitor.mjs && node --check src/agent-update.mjs && node --check src/agent-utilities.mjs && node --check src/agent.mjs && node --check src/cli.mjs && node --check src/cli/config.mjs && node --check src/cli/connect.mjs && node --check src/cli/doctor.mjs && node --check src/cli/env.mjs && node --check src/cli/installation-audit.mjs && node --check src/cli/mac-native-temperature.mjs && node --check src/cli/npm-global.mjs && node --check src/cli/pairing-qr.mjs && node --check src/cli/service-inventory.mjs && node --check src/cli/service-macos.mjs && node --check src/cli/service-paths.mjs && node --check src/cli/service.mjs && node --check src/cli/shell.mjs && node --check src/cli/update.mjs && node --check src/cli/windows-supervisor.mjs && node --check src/cli/windows-task-restart.mjs && node --check src/cli/windows-user-supervisor.mjs && node --check src/fetch-update-manifest.mjs && node --check src/fs-access.mjs && node --check src/npm.mjs && node --check src/runtime.mjs && node --check src/version.mjs",
+    "check": "node --check bin/remcp.mjs && node --check src/agent-deploy-reconnect.mjs && node --check src/agent-network-probe-client.mjs && node --check src/agent-relay-connection.mjs && node --check src/agent-responder.mjs && node --check src/agent-runtime-capabilities.mjs && node --check src/agent-update-monitor.mjs && node --check src/agent-update.mjs && node --check src/agent-utilities.mjs && node --check src/agent.mjs && node --check src/cli.mjs && node --check src/cli/config.mjs && node --check src/cli/connect.mjs && node --check src/cli/doctor.mjs && node --check src/cli/env.mjs && node --check src/cli/installation-audit.mjs && node --check src/cli/mac-native-temperature.mjs && node --check src/cli/npm-global.mjs && node --check src/cli/pairing-qr.mjs && node --check src/cli/service-inventory.mjs && node --check src/cli/service-macos.mjs && node --check src/cli/service-paths.mjs && node --check src/cli/service.mjs && node --check src/cli/shell.mjs && node --check src/cli/update.mjs && node --check src/cli/windows-supervisor.mjs && node --check src/cli/windows-task-restart.mjs && node --check src/cli/windows-update-lock.mjs && node --check src/cli/windows-user-supervisor.mjs && node --check src/fetch-update-manifest.mjs && node --check src/fs-access.mjs && node --check src/npm.mjs && node --check src/runtime.mjs && node --check src/version.mjs",
     "test": "node --test test/*.test.mjs"
   },
   "dependencies": {

package/src/agent-update-monitor.mjs

@@ -5,7 +5,9 @@ import { VERSION } from './version.mjs';
 import { fetchUpdateManifest } from './fetch-update-manifest.mjs';
 import { globalCliEntry, globalInstalledVersion, isNewer, restartToApplyUpdate, updateDecision, updateInvocationArgs } from './agent-update.mjs';
 
-export const UPDATE_CHECK_INTERVAL_MS = 6 * 60 * 60 * 1000;
+// Poll releases while connected too: relying on reconnect alone can leave a
+// healthy long-lived agent stale for six hours after deployment.
+export const UPDATE_CHECK_INTERVAL_MS = 30 * 60 * 1000;
 const UPDATE_CHECK_TIMEOUT_MS = 12000;
 // A flapping relay must not trigger update discovery on every successful reconnect.
 const UPDATE_CHECK_RECONNECT_GAP_MS = 30000;

package/src/cli/npm-global.mjs

@@ -6,6 +6,7 @@ import { PACKAGE_NAME } from '../version.mjs';
 import { home, npm } from './env.mjs';
 import { buildVettedMacTemperatureAddon } from './mac-native-temperature.mjs';
 import { output, run } from './shell.mjs';
+import { withWindowsUpdateLock } from './windows-update-lock.mjs';
 
 export function servicePlatform() {
   return process.env.NODE_ENV === 'test' && process.env.REMCP_TEST_PLATFORM ? process.env.REMCP_TEST_PLATFORM : process.platform;
@@ -53,8 +54,10 @@ function npmGlobalInstallArgs(specs, { preferOnline = false } = {}) {
 }
 
 export function npmGlobalInstall(...specs) {
-  assertSafeReMcpNpmPrefix(globalPrefix()); // Reject an unsafe prefix before npm writes anything.
-  run(npm.command, [...npm.args, ...npmGlobalInstallArgs(specs)]);
+  const prefix = assertSafeReMcpNpmPrefix(globalPrefix()); // Reject an unsafe prefix before npm writes anything.
+  const install = () => run(npm.command, [...npm.args, ...npmGlobalInstallArgs(specs)]);
+  if (servicePlatform() === 'win32') withWindowsUpdateLock(prefix, install);
+  else install();
   if (servicePlatform() === 'darwin' && specs.some(spec => /^@remcp\/runtime@[0-9]/.test(spec))) {
     try {
       buildVettedMacTemperatureAddon({
@@ -241,7 +244,7 @@ export function npmGlobalUpdate(packageNames, ...specs) {
     return;
   }
   if (platform === 'win32') {
-    transactionalWindowsGlobalInstall({ resolved:npm, prefix, packageNames, specs, preferOnline:true });
+    withWindowsUpdateLock(prefix, () => transactionalWindowsGlobalInstall({ resolved:npm, prefix, packageNames, specs, preferOnline:true }));
     return;
   }
   run(npm.command, [...npm.args, ...npmGlobalInstallArgs(specs, { preferOnline:true })]);
@@ -256,7 +259,7 @@ export function npmGlobalUpdateForNode(nodePath, packageNames, ...specs) {
     return;
   }
   if (platform === 'win32') {
-    transactionalWindowsGlobalInstall({ resolved, prefix, packageNames, specs, preferOnline:true });
+    withWindowsUpdateLock(prefix, () => transactionalWindowsGlobalInstall({ resolved, prefix, packageNames, specs, preferOnline:true }));
     return;
   }
   run(resolved.command, [...resolved.args, ...npmGlobalInstallArgs(specs, { preferOnline:true })]);

package/src/cli/update.mjs

@@ -12,7 +12,7 @@ import { loadConfig, saveConfig } from './config.mjs';
 import { assertSecureServerUrl } from './connect.mjs';
 import { installedVersion } from './doctor.mjs';
 import { linuxServiceFile, macServiceFile, officialOrigin } from './env.mjs';
-import { currentInstallationInfo, ensureMacCliCommand, ensureServiceIfRecorded, npmGlobalUpdate, persistentServiceExpected, rememberCurrentInstallation, restartPersistentServiceIfInstalled, serviceInstallationInfo, syncKnownInstallations } from './service.mjs';
+import { currentInstallationInfo, ensureMacCliCommand, ensureServiceIfRecorded, npmGlobalUpdate, persistentServiceExpected, rememberCurrentInstallation, restartPersistentServiceIfInstalled, servicePlatform, serviceInstallationInfo, syncKnownInstallations } from './service.mjs';
 
 const UPDATE_DISCOVERY_TIMEOUT_MS = 5000;
 
@@ -201,6 +201,14 @@ export function verifyManagedServiceReleasePair(serviceInstall, clientSpec, runt
   }
 }
 
+// A pinned automatic update can be a no-op on disk while an older Windows agent
+// still owns the Scheduled Task. Keep manual unpinned no-ops side-effect free.
+export function shouldApplyAlreadyInstalledWindowsRelease({ platform, serviceExpected, flags }) {
+  return platform === 'win32' && serviceExpected === true &&
+    typeof flags?.client === 'string' && Boolean(flags.client.trim()) &&
+    typeof flags?.runtime === 'string' && Boolean(flags.runtime.trim());
+}
+
 export async function updateCommand(flags) {
   let cfg = rememberCurrentInstallation(loadConfig());
   const targets = await resolveUpdateTargets({ cfg, flags });
@@ -246,6 +254,13 @@ export async function updateCommand(flags) {
     }
     const currentRuntimeVersion = String(currentInstall.runtimeVersion || specVersion(cfg.runtime.packageName, targets.runtimeSpec) || '?');
     console.log(`ReMCP is already up to date (client ${currentInstall.cliVersion || VERSION}, runtime ${currentRuntimeVersion}).`);
+    if (shouldApplyAlreadyInstalledWindowsRelease({ platform: servicePlatform(), serviceExpected, flags })) {
+      // This CLI may be newer than its still-running parent agent. The canonical
+      // service files are correct, but the existing Windows task must hand over.
+      const restarted = restartPersistentServiceIfInstalled(cfg, { deferWindows: true });
+      if (!restarted) throw new Error('ReMCP Windows task could not schedule a restart for the installed release');
+      console.log(`ReMCP installed release will be applied: ${restarted}.`);
+    }
     return;
   }
 
@@ -284,7 +299,12 @@ export async function updateCommand(flags) {
   // A changed macOS plist is reloaded by an independent launchd helper. Do not schedule a second
   // helper against the same job: two one-second handoffs can race bootout/bootstrap with kickstart
   // and leave the device offline even though npm installed the new release successfully.
-  const restarted = restartAlreadyScheduled || restartPersistentServiceIfInstalled(cfg);
+  // On Windows the updater may be a descendant of the task being restarted.
+  // An inline /End kills the updater before its /Run can execute, leaving an
+  // older process connected after the new release was installed on disk.
+  // Use the already-tested independent handoff helper for every update.
+  const restarted = restartAlreadyScheduled ||
+    restartPersistentServiceIfInstalled(cfg, { deferWindows: true });
   if (restarted) {
     console.log(`ReMCP updated and ${restarted} restarted (client ${before.cli} → ${after.cli ?? '?'}, runtime ${before.runtime ?? '?'} → ${after.runtime ?? '?'}).`);
     return;

package/src/cli/windows-update-lock.mjs

@@ -0,0 +1,77 @@
+// Serializes writes to one Windows npm global prefix across manual and agent updates.
+// The lock exists outside the npm-managed package/shim trees and is held through rollback.
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import process from 'node:process';
+
+const LOCK_NAME = '.remcp-update-lock';
+const OWNER_NAME = 'owner.json';
+
+function lockOwnerFile(directory) {
+  return path.join(directory, OWNER_NAME);
+}
+
+function ownerIsLive(directory) {
+  try {
+    const owner = JSON.parse(fs.readFileSync(lockOwnerFile(directory), 'utf8'));
+    if (!Number.isSafeInteger(owner.pid) || owner.pid <= 0) return true;
+    process.kill(owner.pid, 0);
+    return true;
+  } catch (error) {
+    // On Windows and Unix, only ESRCH is reliable evidence the owner has exited.
+    // Permission errors and damaged/incomplete owner metadata must fail closed.
+    return error?.code !== 'ESRCH';
+  }
+}
+
+function removeOwnedLock(directory, token) {
+  let owner;
+  try {
+    if (!fs.lstatSync(directory).isDirectory()) return;
+    owner = JSON.parse(fs.readFileSync(lockOwnerFile(directory), 'utf8'));
+  } catch { return; }
+  if (owner.token !== token || owner.pid !== process.pid) return;
+  try {
+    fs.unlinkSync(lockOwnerFile(directory));
+    fs.rmdirSync(directory);
+  } catch (error) {
+    // Never force-remove unexpected files created by another process.
+    if (error?.code !== 'ENOENT') console.error('ReMCP update lock cleanup failed:', error?.message);
+  }
+}
+
+export function withWindowsUpdateLock(prefix, operation) {
+  if (!path.isAbsolute(prefix)) throw new Error('Windows update lock requires an absolute npm prefix.');
+  if (typeof operation !== 'function') throw new TypeError('Windows update operation is required.');
+  fs.mkdirSync(prefix, { recursive:true });
+  const directory = path.join(prefix, LOCK_NAME);
+  try {
+    fs.mkdirSync(directory, { mode:0o700 });
+  } catch (error) {
+    if (error?.code !== 'EEXIST') throw error;
+    const stale = !ownerIsLive(directory);
+    throw new Error(stale
+      ? 'ReMCP previous Windows update exited without releasing its lock; repair the stale update lock before retrying.'
+      : 'ReMCP update already in progress for this Windows npm prefix; retry after it finishes.');
+  }
+
+  const token = crypto.randomUUID();
+  try {
+    fs.writeFileSync(lockOwnerFile(directory), JSON.stringify({
+      pid:process.pid, token, startedAt:Date.now(),
+    }), { flag:'wx', mode:0o600 });
+  } catch (error) {
+    try { fs.rmdirSync(directory); } catch {}
+    throw error;
+  }
+
+  const onExit = () => removeOwnedLock(directory, token);
+  process.once('exit', onExit);
+  try {
+    return operation();
+  } finally {
+    process.removeListener('exit', onExit);
+    removeOwnedLock(directory, token);
+  }
+}