@remcp/remcp 0.2.234 → 0.2.236

package/README.md

@@ -90,7 +90,7 @@ permission, and `remcp doctor` reports the state of each one.
 
 ## Updates
 
-The agent asks the server which versions it should run on every successful connection and every six hours, installs the exact trusted client/runtime release pair in the background, and restarts the managed service so it takes effect. The updater resolves itself and the sibling runtime from the package that is actually running instead of depending on an interactive shell PATH. When a computer has several Node.js environments (for example NVM, FNM or a system installation), ReMCP updates only the canonical managed service packages. It does not upgrade Node.js, rewrite unrelated npm packages, or silently remove old ReMCP copies. `remcp status` counts package roots verified from the current CLI/service and bounded installation history; aliases and vanished paths are not extra installations. `remcp doctor` adds the exact read-only package roots, corresponding client/runtime versions, aliases and historical/cache classifications. These are **physical package copies, not a count of running agents**. Old copies are never automatically removed; verifying process, startup and script dependencies is required before an explicit owner-approved cleanup. A failed install is retried no more often than every thirty minutes and update-check failures are logged, so a broken release cannot become a silent install loop. `remcp update` does the same immediately; `remcp auto-update off` disables automatic checks.
+The agent checks the server on a stable per-device phase within a 30-minute cycle, rather than on every reconnect. New automatic installs are spread over a deterministic 24-hour window per version; older unattended clients are admitted through a shared Redis budget of 120 update hints per minute. The exact trusted client/runtime release pair is installed in the background and the managed service restarts to apply it. An explicit manual `remcp update` remains immediate. The updater resolves itself and the sibling runtime from the package that is actually running instead of depending on an interactive shell PATH. When a computer has several Node.js environments (for example NVM, FNM or a system installation), ReMCP updates only the canonical managed service packages. It does not upgrade Node.js, rewrite unrelated npm packages, or silently remove old ReMCP copies. `remcp status` counts package roots verified from the current CLI/service and bounded installation history; aliases and vanished paths are not extra installations. `remcp doctor` adds the exact read-only package roots, corresponding client/runtime versions, aliases and historical/cache classifications. These are **physical package copies, not a count of running agents**. Old copies are never automatically removed; verifying process, startup and script dependencies is required before an explicit owner-approved cleanup. A failed install is retried no more often than every thirty minutes and update-check failures are logged, so a broken release cannot become a silent install loop. `remcp update` does the same immediately; `remcp auto-update off` disables automatic checks.
 
 ## Computer-use routing
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/remcp",
-  "version": "0.2.234",
+  "version": "0.2.236",
   "description": "ReMCP device client: pair a computer with ReMCP and run the outbound-only agent that hosts the local MCP runtime.",
   "type": "module",
   "license": "MIT",
@@ -18,7 +18,7 @@
     "README.md"
   ],
   "scripts": {
-    "check": "node --check bin/remcp.mjs && node --check src/agent-deploy-reconnect.mjs && node --check src/agent-network-probe-client.mjs && node --check src/agent-relay-connection.mjs && node --check src/agent-responder.mjs && node --check src/agent-runtime-capabilities.mjs && node --check src/agent-update-monitor.mjs && node --check src/agent-update.mjs && node --check src/agent-utilities.mjs && node --check src/agent.mjs && node --check src/cli.mjs && node --check src/cli/config.mjs && node --check src/cli/connect.mjs && node --check src/cli/doctor.mjs && node --check src/cli/env.mjs && node --check src/cli/installation-audit.mjs && node --check src/cli/mac-native-temperature.mjs && node --check src/cli/npm-global.mjs && node --check src/cli/pairing-qr.mjs && node --check src/cli/service-inventory.mjs && node --check src/cli/service-macos.mjs && node --check src/cli/service-paths.mjs && node --check src/cli/service.mjs && node --check src/cli/shell.mjs && node --check src/cli/supervised-agent-lifecycle.mjs && node --check src/cli/update.mjs && node --check src/cli/windows-cli-shim.mjs && node --check src/cli/windows-owned-job-source.mjs && node --check src/cli/windows-owned-job.mjs && node --check src/cli/windows-supervisor.mjs && node --check src/cli/windows-update-lock.mjs && node --check src/cli/windows-user-supervisor.mjs && node --check src/fetch-update-manifest.mjs && node --check src/fs-access.mjs && node --check src/npm.mjs && node --check src/runtime.mjs && node --check src/version.mjs",
+    "check": "node --check bin/remcp.mjs && node --check src/agent-deploy-reconnect.mjs && node --check src/agent-network-probe-client.mjs && node --check src/agent-relay-connection.mjs && node --check src/agent-responder.mjs && node --check src/agent-runtime-capabilities.mjs && node --check src/agent-update-monitor.mjs && node --check src/agent-update-rollout.mjs && node --check src/agent-update.mjs && node --check src/agent-utilities.mjs && node --check src/agent.mjs && node --check src/cli.mjs && node --check src/cli/config.mjs && node --check src/cli/connect.mjs && node --check src/cli/doctor.mjs && node --check src/cli/env.mjs && node --check src/cli/installation-audit.mjs && node --check src/cli/mac-native-temperature.mjs && node --check src/cli/npm-global.mjs && node --check src/cli/pairing-qr.mjs && node --check src/cli/service-inventory.mjs && node --check src/cli/service-macos.mjs && node --check src/cli/service-paths.mjs && node --check src/cli/service.mjs && node --check src/cli/shell.mjs && node --check src/cli/supervised-agent-lifecycle.mjs && node --check src/cli/update.mjs && node --check src/cli/windows-cli-shim.mjs && node --check src/cli/windows-owned-job-source.mjs && node --check src/cli/windows-owned-job.mjs && node --check src/cli/windows-supervisor.mjs && node --check src/cli/windows-update-lock.mjs && node --check src/cli/windows-user-supervisor.mjs && node --check src/fetch-update-manifest.mjs && node --check src/fs-access.mjs && node --check src/npm.mjs && node --check src/runtime.mjs && node --check src/version.mjs",
     "test": "node --test test/*.test.mjs"
   },
   "dependencies": {

package/src/agent-relay-connection.mjs

@@ -18,6 +18,7 @@ export function createAgentRelayConnection({
   setSocket, getHelloState, respond, inFlight,
   sendMetricsSample, reportInstallOnce, flushTelemetry,
   checkForUpdate, schedulePostConnectUpdateChecks, clearPostConnectUpdateChecks, stop,
+  checkUpdatesOnConnect = false,
   heartbeatIntervalMs = HEARTBEAT_INTERVAL_MS, handshakeTimeoutMs = HANDSHAKE_TIMEOUT_MS,
 }) {
   let revoked = false;
@@ -163,7 +164,9 @@ export function createAgentRelayConnection({
       sendMetricsSample();
       reportInstallOnce();
       flushTelemetry();
-      void checkForUpdate();
+      // Normal fleet clients poll on a stable per-device phase, not all on
+      // every relay handshake. Explicit short QA rechecks retain hot-path coverage.
+      if (checkUpdatesOnConnect) void checkForUpdate();
       schedulePostConnectUpdateChecks();
     });
     ws.on('pong', () => { if (activeSocket === ws) awaitingPong = false; });

package/src/agent-update-monitor.mjs

@@ -3,6 +3,7 @@ import { spawn } from 'node:child_process';
 import process from 'node:process';
 import { VERSION } from './version.mjs';
 import { fetchUpdateManifest } from './fetch-update-manifest.mjs';
+import { updateRolloutEligibility } from './agent-update-rollout.mjs';
 import { globalCliEntry, globalInstalledVersion, isNewer, restartToApplyUpdate, updateDecision, updateInvocationArgs } from './agent-update.mjs';
 
 // Poll releases while connected too: relying on reconnect alone can leave a
@@ -11,7 +12,9 @@ export const UPDATE_CHECK_INTERVAL_MS = 30 * 60 * 1000;
 const UPDATE_CHECK_TIMEOUT_MS = 12000;
 // A flapping relay must not trigger update discovery on every successful reconnect.
 const UPDATE_CHECK_RECONNECT_GAP_MS = 30000;
-const POST_CONNECT_UPDATE_RECHECK_DELAYS_MS = Object.freeze([60_000, 5 * 60_000, 15 * 60_000]);
+// Fleet clients already have a per-device wall-clock polling phase. Avoid
+// bursty reconnect-triggered rechecks; explicit short QA fixtures may opt in.
+const POST_CONNECT_UPDATE_RECHECK_DELAYS_MS = Object.freeze([]);
 const POST_CONNECT_UPDATE_RECHECK_JITTER_MS = 30_000;
 const UPDATE_RETRY_COOLDOWN_MS = 30 * 60 * 1000;
 
@@ -99,6 +102,15 @@ export function createAgentUpdateMonitor({ options, serverUrl, queueEvent, getRu
         // proves convergence only after the replacement agent reconnects.
         queueEvent({ event: 'agent_update_available', at: observedAt, reason: decision.reason.slice(0, 32) });
       }
+      const eligible = updateRolloutEligibility({
+        deviceId: options.deviceId,
+        target: availabilityKey,
+        rollout: advertised.rollout,
+        // An explicitly raised minimum version or broken local runtime needs
+        // repair without the normal gradual fleet-release delay.
+        urgent: decision.reason === 'runtime-repair' || Boolean(minimum && isNewer(minimum, VERSION)),
+      }, observedAt);
+      if (!eligible.ready) return;
       const cli = resolveCli();
       if (!cli || !existsSync(cli)) {
         if (announce) console.error(`ReMCP ${target} is available; run: remcp update`);

package/src/agent-update-rollout.mjs

@@ -0,0 +1,92 @@
+import { createHash } from 'node:crypto';
+
+// A 24-hour fleet rollout makes 100,000 downloads roughly 1.16/sec instead
+// of initiating all installers when a new version first becomes visible.
+export const ROLLOUT_WINDOW_MS = 24 * 60 * 60 * 1000;
+const ROLLOUT_MAX_WINDOW_MS = 7 * ROLLOUT_WINDOW_MS;
+const ROLLOUT_STATE_TTL_SECONDS = 120 * 24 * 60 * 60;
+
+export function updateRolloutEligibility({ deviceId, target, rollout, urgent = false }, now = Date.now()) {
+  if (urgent || !rollout) return { ready:true, readyAt:now };
+  const startAtMs = Number(rollout.startAtMs);
+  const windowMs = Number(rollout.windowMs);
+  // A malformed policy must not accidentally release the whole fleet at once.
+  if (!String(deviceId || '').trim() || !String(target || '').trim()
+    || !Number.isSafeInteger(startAtMs) || startAtMs < 1_600_000_000_000
+    || !Number.isSafeInteger(windowMs) || windowMs < 60_000 || windowMs > ROLLOUT_MAX_WINDOW_MS) {
+    return { ready:false, readyAt:null };
+  }
+  // A stable local device identifier is hashed, not transmitted to the public
+  // update endpoint. A distinct release has a distinct deterministic slot.
+  const hash = createHash('sha256').update('remcp-agent-rollout-v1\0')
+    .update(String(deviceId)).update('\0').update(String(target)).digest();
+  const offsetMs = Math.floor(hash.readUInt32BE(0) / 0x100000000 * windowMs);
+  const readyAt = startAtMs + offsetMs;
+  // The response's server timestamp prevents incorrect client wall clocks
+  // from synchronously skipping all fleet slots.
+  const serverNowMs = Number(rollout.serverNowMs);
+  const effectiveNow = Number.isSafeInteger(serverNowMs) && serverNowMs >= 1_600_000_000_000
+    ? serverNowMs : now;
+  return { ready:effectiveNow >= readyAt, readyAt };
+}
+
+// Fleet update checks are phased on the wall clock as well. A 100k-device
+// reconnect wave must not turn into 100k immediate manifest GETs or a synchronized
+// 30-minute polling loop. The phase survives agent restarts with no disk state.
+export function nextFleetManifestDelayMs(deviceId, now = Date.now(), intervalMs = 30 * 60 * 1000) {
+  if (!String(deviceId || '').trim() || !Number.isSafeInteger(intervalMs) || intervalMs < 1000) {
+    throw new Error('Fleet manifest scheduling requires a paired device and a valid interval');
+  }
+  const hash = createHash('sha256').update('remcp-update-check-phase-v1\0').update(String(deviceId)).digest();
+  const phase = Math.floor(hash.readUInt32BE(0) / 0x100000000 * intervalMs);
+  const elapsed = ((now % intervalMs) + intervalMs) % intervalMs;
+  return (phase - elapsed + intervalMs) % intervalMs || intervalMs;
+}
+
+// Legacy clients (before scheduler v1) cannot defer installs themselves.
+// Admit a bounded number of old automatic update checks per minute across the
+// entire HA cluster; the rest retry their next normal check. Manual status,
+// bootstrap and manually requested updates use their own unthrottled paths.
+export async function claimLegacyManifestSlot(command, version, {
+  now = Date.now, limitPerMinute = 120, isClosed = () => false,
+} = {}) {
+  if (isClosed() || !command?.isReady) throw new Error('Shared legacy update admission unavailable');
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(String(version))) {
+    throw new Error('Invalid version for legacy update admission');
+  }
+  if (!Number.isSafeInteger(limitPerMinute) || limitPerMinute < 1 || limitPerMinute > 6000) {
+    throw new Error('Invalid legacy update admission quota');
+  }
+  const minute = Math.floor(now() / 60_000);
+  const key = 'remcp:deploy:legacy-update-admit:v1:' + version + ':' + minute;
+  const script = "local n=redis.call('INCR',KEYS[1]); if n == 1 then redis.call('EXPIRE',KEYS[1],90) end; return n <= tonumber(ARGV[1]) and 1 or 0";
+  return Number(await command.eval(script, { keys:[key], arguments:[String(limitPerMinute)] })) === 1;
+}
+
+// Use only immutable HTTP traits that identify the old agent's no-header
+// automatic fetch. The trusted user-requested manual update uses Accept JSON.
+export function isLegacyAutomaticUpdateRequest(req) {
+  const header = name => String(req?.get?.(name) || req?.headers?.[name.toLowerCase()] || '').toLowerCase();
+  return /^(?:node|undici)(?:\/[0-9.]+)?$/.test(header('user-agent'))
+    && header('accept').trim() === '*/*'
+    && header('x-remcp-update-scheduler') !== 'v1'
+    && !req?.query?.fresh;
+}
+
+// The shared Redis epoch is created exactly once for each released version.
+// A rolling HA deploy or process restart must not reset the fleet schedule.
+// Use the same Redis coordination store as the existing release pause gate.
+export async function getOrCreateRolloutStart(command, version, now = Date.now, isClosed = () => false) {
+  if (isClosed() || !command?.isReady) throw new Error('Shared rollout control plane unavailable');
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(String(version))) {
+    throw new Error('Invalid release version for update rollout');
+  }
+  const key = 'remcp:deploy:agent-rollout-start:v1:' + version;
+  const proposed = String(now());
+  await command.set(key, proposed, { NX:true, EX:ROLLOUT_STATE_TTL_SECONDS });
+  const persisted = Number(await command.get(key));
+  if (!Number.isSafeInteger(persisted) || persisted < 1_600_000_000_000) {
+    throw new Error('Shared rollout start is unavailable');
+  }
+  return persisted;
+}

package/src/agent.mjs

@@ -8,6 +8,7 @@ import { localRuntimeEntry } from './agent-update.mjs';
 export { localRuntimeEntry, supervisorRestart, updateDecision } from './agent-update.mjs';
 import { normalizedServerUrl, sendRelayMessage, jitter, deviceMetrics } from './agent-utilities.mjs';
 import { createAgentUpdateMonitor, UPDATE_CHECK_INTERVAL_MS } from './agent-update-monitor.mjs';
+import { nextFleetManifestDelayMs } from './agent-update-rollout.mjs';
 import { createAgentResponder } from './agent-responder.mjs';
 import { createAgentRelayConnection } from './agent-relay-connection.mjs';
 import { createRuntimeCapabilities, normalizeRuntimeToolNames } from './agent-runtime-capabilities.mjs';
@@ -288,12 +289,20 @@ export async function runAgent(options) {
     }),
     respond, inFlight, sendMetricsSample, reportInstallOnce, flushTelemetry,
     checkForUpdate, schedulePostConnectUpdateChecks, clearPostConnectUpdateChecks, stop,
+    checkUpdatesOnConnect: Array.isArray(options.updateRecheckDelaysMs),
   });
 
   scheduleMetricsSample();
   const telemetryFlushTimer = setInterval(flushTelemetry, TELEMETRY_SEND_INTERVAL_MS);
   telemetryFlushTimer.unref?.();
-  const updateTimer = setInterval(() => void checkForUpdate(), UPDATE_CHECK_INTERVAL_MS);
+  // Spread 100k devices across the entire 30-minute manifest polling cycle.
+  // The stable device phase survives reconnects/restarts without local writes.
+  let recurringUpdateTimer = null;
+  const updateTimer = setTimeout(() => {
+    void checkForUpdate({ scheduled:true });
+    recurringUpdateTimer = setInterval(() => void checkForUpdate({ scheduled:true }), UPDATE_CHECK_INTERVAL_MS);
+    recurringUpdateTimer.unref?.();
+  }, nextFleetManifestDelayMs(deviceId, Date.now(), UPDATE_CHECK_INTERVAL_MS));
   updateTimer.unref?.();
 
   async function stop() {
@@ -305,7 +314,8 @@ export async function runAgent(options) {
     clearPostConnectUpdateChecks();
     if (telemetryTimer) clearTimeout(telemetryTimer);
     clearInterval(telemetryFlushTimer);
-    clearInterval(updateTimer);
+    clearTimeout(updateTimer);
+    if (recurringUpdateTimer) clearInterval(recurringUpdateTimer);
     for (const controller of inFlight.values()) controller.abort();
     activeSocket?.terminate();
     stopPromise = Promise.allSettled([mcp?.close(), transport?.close()]).then(results => {

package/src/cli/installation-audit.mjs

@@ -4,6 +4,14 @@ import path from 'node:path';
 const CLIENT_PACKAGE = '@remcp/remcp';
 const MAX_HISTORY = 32;
 
+function isExplicitCliAlias(cliPath) {
+  // A symlink in an ancestor directory (e.g. macOS /var -> /private/var)
+  // changes realpath but does not make the final CLI entry itself an alias.
+  // lstat checks the final path component without following that entry.
+  try { return fs.lstatSync(cliPath).isSymbolicLink(); }
+  catch { return false; } // A concurrently removed entry cannot be trusted.
+}
+
 // Inventory only paths previously recorded by this owner and the two current CLI
 // entrypoints. Never crawl npm/node directories or infer running processes.
 function installedPackageAt(cliPath) {
@@ -52,7 +60,7 @@ export function auditKnownInstallations(config, { currentCliPath, serviceCliPath
     }
     copy.sources.add(candidate.source);
     copy.cliPaths.add(candidate.path);
-    if (candidate.path !== installed.resolved && !aliases.some(a => a.path === candidate.path)) {
+    if (isExplicitCliAlias(candidate.path) && !aliases.some(a => a.path === candidate.path)) {
       aliases.push({ path:candidate.path, resolvesTo:installed.resolved });
     }
   }

package/src/cli.mjs

@@ -44,7 +44,7 @@ function printHelp() {
 }
 
 // The running agent snapshots update policy at startup. A saved toggle alone does not
-// change its six-hour polling loop, so reload a managed service after a policy change.
+// change its per-device polling schedule, so reload a managed service after a policy change.
 // Defer Linux handoff to avoid terminating a remote command before it returns.
 export function applyAutoUpdatePreference(cfg, enabled, {
   persist = saveConfig,
@@ -219,7 +219,7 @@ export async function main(argv = process.argv.slice(2)) {
     const action = String(positional[0] || 'status').toLowerCase();
     const cfg = loadConfig(false) || {};
     if (action === 'status') {
-      console.log(JSON.stringify({ autoUpdate: autoUpdateEnabled(cfg), checkIntervalHours: 6 }, null, 2));
+      console.log(JSON.stringify({ autoUpdate: autoUpdateEnabled(cfg), checkIntervalHours: 0.5, fleetRolloutHours:24 }, null, 2));
       return;
     }
     if (['on', 'enable', 'off', 'disable'].includes(action)) {

package/src/fetch-update-manifest.mjs

@@ -29,6 +29,9 @@ export async function fetchUpdateManifest(url, {
       (async () => {
         const response = await fetchImpl(url, {
           redirect: 'error',
+          // Signals support for deterministic fleet rollout; old agents send
+          // plain fetch requests and use a shared Redis admission budget.
+          headers: { 'x-remcp-update-scheduler':'v1' },
           signal: controller.signal,
         });
         if (!response.ok) return null;