@remcp/remcp 0.2.237 → 0.2.239

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/remcp",
-  "version": "0.2.237",
+  "version": "0.2.239",
   "description": "ReMCP device client: pair a computer with ReMCP and run the outbound-only agent that hosts the local MCP runtime.",
   "type": "module",
   "license": "MIT",
@@ -18,7 +18,7 @@
     "README.md"
   ],
   "scripts": {
-    "check": "node --check bin/remcp.mjs && node --check src/agent-deploy-reconnect.mjs && node --check src/agent-network-probe-client.mjs && node --check src/agent-relay-connection.mjs && node --check src/agent-responder.mjs && node --check src/agent-runtime-capabilities.mjs && node --check src/agent-update-monitor.mjs && node --check src/agent-update-rollout.mjs && node --check src/agent-update.mjs && node --check src/agent-utilities.mjs && node --check src/agent.mjs && node --check src/cli.mjs && node --check src/cli/config.mjs && node --check src/cli/connect.mjs && node --check src/cli/doctor.mjs && node --check src/cli/env.mjs && node --check src/cli/installation-audit.mjs && node --check src/cli/mac-native-temperature.mjs && node --check src/cli/npm-global.mjs && node --check src/cli/pairing-qr.mjs && node --check src/cli/service-inventory.mjs && node --check src/cli/service-macos.mjs && node --check src/cli/service-paths.mjs && node --check src/cli/service.mjs && node --check src/cli/shell.mjs && node --check src/cli/supervised-agent-lifecycle.mjs && node --check src/cli/update.mjs && node --check src/cli/windows-cli-shim.mjs && node --check src/cli/windows-owned-job-source.mjs && node --check src/cli/windows-owned-job.mjs && node --check src/cli/windows-supervisor.mjs && node --check src/cli/windows-update-lock.mjs && node --check src/cli/windows-user-supervisor.mjs && node --check src/fetch-update-manifest.mjs && node --check src/fs-access.mjs && node --check src/npm.mjs && node --check src/runtime.mjs && node --check src/version.mjs",
+    "check": "node --check bin/remcp.mjs && node --check src/agent-deploy-reconnect.mjs && node --check src/agent-network-probe-client.mjs && node --check src/agent-relay-connection.mjs && node --check src/agent-responder.mjs && node --check src/agent-runtime-capabilities.mjs && node --check src/agent-update-monitor.mjs && node --check src/agent-update-rollout.mjs && node --check src/agent-update.mjs && node --check src/agent-utilities.mjs && node --check src/agent.mjs && node --check src/cli.mjs && node --check src/cli/config.mjs && node --check src/cli/connect.mjs && node --check src/cli/doctor.mjs && node --check src/cli/env.mjs && node --check src/cli/installation-audit.mjs && node --check src/cli/mac-native-temperature.mjs && node --check src/cli/npm-global.mjs && node --check src/cli/pairing-qr.mjs && node --check src/cli/service-inventory.mjs && node --check src/cli/service-linux.mjs && node --check src/cli/service-macos.mjs && node --check src/cli/service-paths.mjs && node --check src/cli/service.mjs && node --check src/cli/shell.mjs && node --check src/cli/supervised-agent-lifecycle.mjs && node --check src/cli/update.mjs && node --check src/cli/windows-cli-shim.mjs && node --check src/cli/windows-owned-job-source.mjs && node --check src/cli/windows-owned-job.mjs && node --check src/cli/windows-supervisor.mjs && node --check src/cli/windows-update-lock.mjs && node --check src/cli/windows-user-supervisor.mjs && node --check src/fetch-update-manifest.mjs && node --check src/fs-access.mjs && node --check src/npm.mjs && node --check src/runtime.mjs && node --check src/version.mjs",
     "test": "node --test test/*.test.mjs"
   },
   "dependencies": {

package/src/cli/service-inventory.mjs

@@ -5,6 +5,7 @@ import { spawnSync } from 'node:child_process';
 import { PACKAGE_NAME, VERSION } from '../version.mjs';
 import { saveConfig } from './config.mjs';
 import { linuxServiceFile, linuxServiceLauncherFile, macServiceFile, macServiceLabel, windowsStartupScriptFile, windowsTaskName } from './env.mjs';
+import { linuxSystemAgentOwned } from './service-linux.mjs';
 import { servicePlatform, globalCliPath, npmGlobalUpdateForNode } from './npm-global.mjs';
 import { windowsStartupScriptInstalled } from './windows-supervisor.mjs';
 
@@ -12,7 +13,7 @@ export function persistentServiceExpected(config) {
   if (config?.serviceInstalled === false) return false;
   if (config?.serviceInstalled === true) return true;
   const platform = servicePlatform();
-  if (platform === 'linux') return fs.existsSync(linuxServiceFile);
+  if (platform === 'linux') return linuxSystemAgentOwned() || fs.existsSync(linuxServiceFile);
   if (platform === 'darwin') return fs.existsSync(macServiceFile);
   if (platform === 'win32') {
     return windowsStartupScriptInstalled(windowsStartupScriptFile) ||
@@ -25,9 +26,10 @@ export function persistentServiceState(config) {
   const platform = servicePlatform();
   const expected = persistentServiceExpected(config);
   if (platform === 'linux') {
-    const installed = fs.existsSync(linuxServiceFile);
-    const active = installed && spawnSync('systemctl', ['--user', 'is-active', '--quiet', 'remcp-agent.service'], { stdio: 'ignore' }).status === 0;
-    return { expected, installed, active, manager:'systemd-user', name:'remcp-agent.service' };
+    const system = linuxSystemAgentOwned();
+    const installed = system || fs.existsSync(linuxServiceFile);
+    const active = installed && spawnSync('systemctl', [...(system ? [] : ['--user']), 'is-active', '--quiet', 'remcp-agent.service'], { stdio: 'ignore' }).status === 0;
+    return { expected, installed, active, manager:system ? 'systemd-system' : 'systemd-user', name:'remcp-agent.service' };
   }
   if (platform === 'darwin') {
     const installed = fs.existsSync(macServiceFile);

package/src/cli/service-linux.mjs

@@ -0,0 +1,95 @@
+// Linux headless agents may be supervised by PID 1. Never mistake a system unit for
+// a session-owned user unit during status checks, repairs or auto-updates.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import process from 'node:process';
+import { spawnSync } from 'node:child_process';
+import { home, linuxServiceFile, linuxServiceLauncherFile } from './env.mjs';
+import { resolvedCliScript, shellQuote } from './service-paths.mjs';
+
+export const linuxSystemServiceFile = '/etc/systemd/system/remcp-agent.service';
+
+export function isManagedLinuxSystemUnit(text, launcher = linuxServiceLauncherFile) {
+  if (typeof text !== 'string') return false;
+  const expected = new Set([
+    'ExecStart="' + launcher.replaceAll('\\', '\\\\').replaceAll('"', '\\"') + '" start --service',
+    'ExecStart=' + launcher + ' start --service',
+  ]);
+  return text.split(/\r?\n/).some(line => expected.has(line.trim()));
+}
+
+export function linuxSystemAgentOwned() {
+  if (process.platform !== 'linux' || process.getuid?.() !== 0) return false;
+  try {
+    return isManagedLinuxSystemUnit(fs.readFileSync(linuxSystemServiceFile, 'utf8'));
+  } catch {
+    return false;
+  }
+}
+
+export function linuxServiceScope() {
+  return linuxSystemAgentOwned() ? 'system' : 'user';
+}
+
+export function linuxActiveServiceFile() {
+  return linuxServiceScope() === 'system' ? linuxSystemServiceFile : linuxServiceFile;
+}
+
+// Without linger, logind terminates user@UID.service at the final logout,
+// even if systemctl --user enable --now reported success.
+export function ensureLinuxLinger() {
+  if (process.platform !== 'linux') return;
+  // Test-only synthetic HOME has no logind account and must never mutate the host.
+  // Guard before os.userInfo(): an isolated CI UID may not have a passwd entry.
+  if (process.env.NODE_ENV === 'test' && process.env.REMCP_TEST_PLATFORM === 'linux') return;
+  let account;
+  try { account = os.userInfo(); }
+  catch { throw new Error('ReMCP cannot resolve the current Linux account for persistent systemd supervision.'); }
+  if (path.resolve(home) !== path.resolve(account.homedir)) {
+    throw new Error('Refusing a persistent Linux service with HOME different from the account home directory.');
+  }
+  const username = account.username;
+  const query = () => spawnSync('loginctl', ['show-user', username, '-p', 'Linger', '--value'],
+    { encoding:'utf8', timeout:10000 });
+  let state = query();
+  if (state.status === 0 && state.stdout.trim() === 'yes') return;
+  const enabled = spawnSync('loginctl', ['enable-linger', username],
+    { encoding:'utf8', timeout:10000 });
+  if (enabled.status !== 0) {
+    throw new Error('ReMCP cannot guarantee background operation after logout: '
+      + 'loginctl enable-linger failed. Ask an administrator to enable lingering for this account.');
+  }
+  state = query();
+  if (state.status !== 0 || state.stdout.trim() !== 'yes') {
+    throw new Error('ReMCP cannot verify systemd lingering; refusing to claim persistent installation.');
+  }
+}
+
+// The vetted bootstrap may install npm under ~/.local/share/remcp/npm and Node
+// under ~/.local/share/remcp/bootstrap; neither bin is necessarily on login PATH.
+export function linuxCliShimText(cliPath, nodePath) {
+  const entry = resolvedCliScript(cliPath);
+  const suffix = path.join('lib', 'node_modules', '@remcp', 'remcp', 'bin', 'remcp.mjs');
+  const prefix = entry.endsWith(path.sep + suffix)
+    ? entry.slice(0, -(suffix.length + 1)) : path.dirname(path.dirname(cliPath));
+  return '#!/bin/sh\n# ReMCP managed CLI shim\nNPM_CONFIG_PREFIX=' + shellQuote(prefix)
+    + '\nexport NPM_CONFIG_PREFIX\nPATH=' + shellQuote(path.dirname(nodePath)) + ':$PATH'
+    + '\nexport PATH\nexec ' + shellQuote(nodePath) + ' ' + shellQuote(entry) + ' "$@"\n';
+}
+
+export function ensureLinuxCliCommand(cliPath, nodePath) {
+  if (process.platform !== 'linux') return;
+  const destination = process.getuid?.() === 0
+    ? '/usr/local/bin/remcp' : path.join(home, '.local', 'bin', 'remcp');
+  fs.mkdirSync(path.dirname(destination), { recursive:true, mode:0o755 });
+  const marker = '# ReMCP managed CLI shim';
+  if (fs.existsSync(destination)) {
+    const current = fs.readFileSync(destination, 'utf8');
+    if (!current.includes(marker)) return; // Never overwrite an unrelated executable.
+  }
+  const content = linuxCliShimText(cliPath, nodePath);
+  const temp = destination + '.' + process.pid + '.tmp';
+  fs.writeFileSync(temp, content, { mode:0o755 });
+  fs.renameSync(temp, destination);
+}

package/src/cli/service.mjs

@@ -5,6 +5,7 @@ export { persistentServiceExpected, persistentServiceState, releasePairPresentAt
 // Installing, repairing and removing the background agent: one supervisor per platform, plus the
 // write-access tweaks a fresh install needs. Service maintenance follows local OS permissions.
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import process from 'node:process';
 import { spawnSync } from 'node:child_process';
@@ -17,6 +18,7 @@ import { PACKAGE_NAME, VERSION } from '../version.mjs';
 import { saveConfig } from './config.mjs';
 import { configDir, home, linuxServiceFile, linuxServiceLauncherFile, macServiceFile, macServiceLabel, windowsServiceLauncherFile, windowsStartupScriptFile, windowsTaskName } from './env.mjs';
 import { run } from './shell.mjs';
+import { linuxActiveServiceFile, linuxServiceScope, linuxSystemAgentOwned, linuxSystemServiceFile, ensureLinuxLinger, ensureLinuxCliCommand } from './service-linux.mjs';
 import { windowsServiceLauncherText, windowsTaskAbsenceCommand, windowsStartupScriptText, windowsStartupScriptInstalled } from './windows-supervisor.mjs';
 import { ensureWindowsSupervisorKey, windowsSupervisorCommand } from './windows-user-supervisor.mjs';
 
@@ -62,11 +64,32 @@ function writeLinuxServiceLauncher(cliPath = globalCliPath(), nodePath = process
 
 export function installLinuxService(cliPath = globalCliPath(), nodePath = process.execPath) {
   const launcherFile = writeLinuxServiceLauncher(cliPath, nodePath);
-  const unit = `[Unit]\nDescription=ReMCP device agent\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nType=simple\nExecStart=${quoteSystemd(launcherFile)} start --service\nRestart=always\nRestartSec=3\n\n[Install]\nWantedBy=default.target\n`;
-  fs.mkdirSync(path.dirname(linuxServiceFile), { recursive: true });
-  fs.writeFileSync(linuxServiceFile, unit);
-  run('systemctl', ['--user', 'daemon-reload']);
-  run('systemctl', ['--user', 'enable', '--now', 'remcp-agent.service']);
+  // Fresh root installs are boot services owned by PID 1. Legacy per-user units are
+  // left under their existing supervisor, but must have linger enabled.
+  const syntheticLinuxFixture = process.env.NODE_ENV === 'test' && process.env.REMCP_TEST_PLATFORM === 'linux';
+  const privileged = !syntheticLinuxFixture && process.getuid?.() === 0
+    && path.resolve(home) === path.resolve(os.userInfo().homedir);
+  if (privileged && fs.existsSync(linuxSystemServiceFile) && !linuxSystemAgentOwned()) {
+    throw new Error('Refusing to replace an unmanaged systemd remcp-agent.service');
+  }
+  const system = privileged && (linuxSystemAgentOwned() || !fs.existsSync(linuxServiceFile));
+  if (system) {
+    if (fs.existsSync(linuxSystemServiceFile) && !linuxSystemAgentOwned()) {
+      throw new Error('Refusing to replace an unmanaged systemd remcp-agent.service');
+    }
+    const unit = `[Unit]\nDescription=ReMCP headless device agent (system service)\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nType=simple\nUser=root\nWorkingDirectory=/root\nEnvironment=HOME=/root\nUMask=0077\nExecStart=${quoteSystemd(launcherFile)} start --service\nRestart=always\nRestartSec=5\n\n[Install]\nWantedBy=multi-user.target\n`;
+    fs.writeFileSync(linuxSystemServiceFile, unit, { mode:0o644 });
+    run('systemctl', ['daemon-reload']);
+    run('systemctl', ['enable', '--now', 'remcp-agent.service']);
+  } else {
+    ensureLinuxLinger();
+    const unit = `[Unit]\nDescription=ReMCP device agent\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nType=simple\nExecStart=${quoteSystemd(launcherFile)} start --service\nRestart=always\nRestartSec=3\n\n[Install]\nWantedBy=default.target\n`;
+    fs.mkdirSync(path.dirname(linuxServiceFile), { recursive: true });
+    fs.writeFileSync(linuxServiceFile, unit);
+    run('systemctl', ['--user', 'daemon-reload']);
+    run('systemctl', ['--user', 'enable', '--now', 'remcp-agent.service']);
+  }
+  ensureLinuxCliCommand(cliPath, nodePath);
 }
 
 export function writeWindowsServiceLauncher(cliPath = globalCliPath(), nodePath = process.execPath) {
@@ -241,11 +264,13 @@ export function ensureServiceIfRecorded(config) {
     const platform = servicePlatform();
     let restartScheduled = null;
     if (platform === 'linux') {
-      // Read and repair the unit through one descriptor. This avoids a check/read/write race where
-      // the path could be replaced between validation and mutation.
+      const scope = linuxServiceScope();
+      if (scope === 'user') ensureLinuxLinger();
+      // Read and repair the active unit through one descriptor. Never create a
+      // second user agent when a PID-1 system service already owns this pairing.
       let fd = null;
       try {
-        fd = fs.openSync(linuxServiceFile, fs.constants.O_RDWR | (fs.constants.O_NOFOLLOW || 0));
+        fd = fs.openSync(linuxActiveServiceFile(), fs.constants.O_RDWR | (fs.constants.O_NOFOLLOW || 0));
       } catch (error) {
         if (error?.code !== 'ENOENT') throw error;
       }
@@ -279,7 +304,7 @@ export function ensureServiceIfRecorded(config) {
             }
             fs.ftruncateSync(fd, data.length);
             fs.fsyncSync(fd);
-            run('systemctl', ['--user', 'daemon-reload']);
+            run('systemctl', [...(scope === 'user' ? ['--user'] : []), 'daemon-reload']);
           }
         } finally {
           fs.closeSync(fd);
@@ -308,24 +333,28 @@ export function ensureServiceIfRecorded(config) {
   }
 }
 
-export function deferredLinuxAgentRestartArgs(pid) {
+export function deferredLinuxAgentRestartArgs(pid, scope = 'user') {
   if (!Number.isSafeInteger(pid) || pid <= 0) throw new Error('Invalid process identifier');
-  return ['--user', '--on-active=3s', `--unit=remcp-agent-settings-${pid}`,
-    'systemctl', '--user', 'restart', 'remcp-agent.service'];
+  if (scope !== 'user' && scope !== 'system') throw new Error('Invalid Linux service scope');
+  const option = scope === 'user' ? ['--user'] : [];
+  return [...option, '--on-active=3s', `--unit=remcp-agent-settings-${pid}`,
+    'systemctl', ...option, 'restart', 'remcp-agent.service'];
 }
 
 export function restartPersistentServiceIfInstalled(config, { deferLinux = false, deferWindows = false } = {}) {
   if (!persistentServiceExpected(config)) return null;
   const platform = servicePlatform();
-  if (platform === 'linux' && fs.existsSync(linuxServiceFile)) {
+  if (platform === 'linux' && fs.existsSync(linuxActiveServiceFile())) {
+    const scope = linuxServiceScope();
+    const option = scope === 'user' ? ['--user'] : [];
     // Only owner-confirmed remote policy changes defer their restart. Ordinary
     // installs and updates preserve their existing synchronous supervisor contract.
     if (deferLinux) {
-      run('systemd-run', deferredLinuxAgentRestartArgs(process.pid));
+      run('systemd-run', deferredLinuxAgentRestartArgs(process.pid, scope));
       return 'remcp-agent.service (restart scheduled)';
     }
-    run('systemctl', ['--user', 'daemon-reload']);
-    run('systemctl', ['--user', 'restart', 'remcp-agent.service']);
+    run('systemctl', [...option, 'daemon-reload']);
+    run('systemctl', [...option, 'restart', 'remcp-agent.service']);
     return 'remcp-agent.service';
   }
   if (platform === 'darwin' && fs.existsSync(macServiceFile)) {
@@ -357,9 +386,11 @@ export function restartPersistentServiceIfInstalled(config, { deferLinux = false
 export function uninstallPersistentService() {
   const platform = servicePlatform();
   if (platform === 'linux') {
-    spawnSync('systemctl', ['--user', 'disable', '--now', 'remcp-agent.service'], { stdio: 'inherit' });
-    try { fs.unlinkSync(linuxServiceFile); } catch {}
-    spawnSync('systemctl', ['--user', 'daemon-reload'], { stdio: 'inherit' });
+    const scope = linuxServiceScope();
+    const option = scope === 'user' ? ['--user'] : [];
+    spawnSync('systemctl', [...option, 'disable', '--now', 'remcp-agent.service'], { stdio:'inherit' });
+    try { fs.unlinkSync(linuxActiveServiceFile()); } catch {}
+    spawnSync('systemctl', [...option, 'daemon-reload'], { stdio:'inherit' });
   } else if (platform === 'darwin') {
     const domain = macLaunchDomain();
     spawnSync('launchctl', ['bootout', domain, macServiceFile], { stdio: 'ignore' });

package/src/cli/update.mjs

@@ -12,6 +12,7 @@ import { loadConfig, saveConfig } from './config.mjs';
 import { assertSecureServerUrl } from './connect.mjs';
 import { installedVersion } from './doctor.mjs';
 import { linuxServiceFile, macServiceFile, officialOrigin } from './env.mjs';
+import { linuxSystemAgentOwned } from './service-linux.mjs';
 import { assertWindowsUpdateLifecycleSafe, currentInstallationInfo, ensureMacCliCommand, ensureServiceIfRecorded, npmGlobalUpdate, persistentServiceExpected, rememberCurrentInstallation, restartPersistentServiceIfInstalled, servicePlatform, serviceInstallationInfo, syncKnownInstallations } from './service.mjs';
 
 const UPDATE_DISCOVERY_TIMEOUT_MS = 5000;
@@ -235,7 +236,7 @@ export async function updateCommand(flags) {
       updateSource: targets.source,
       installable: targets.installable,
       upToDate: alreadyCurrent,
-      managedService: fs.existsSync(linuxServiceFile) || fs.existsSync(macServiceFile),
+      managedService: linuxSystemAgentOwned() || fs.existsSync(linuxServiceFile) || fs.existsSync(macServiceFile),
       supervisor: supervisorRestart() ?? 'none',
     }, null, 2));
     return;