@remcp/remcp 0.2.28 → 0.2.30

package/README.md

@@ -33,6 +33,25 @@ remcp --version
 `remcp status` reports the runtime the device would install, whether the agent service is running,
 and the current usage-metrics state, so a support request can be answered with one paste.
 
+## Unrestricted mode
+
+`remcp godmode on` removes the runtime's own safety rails on **this** computer: file access is no
+longer confined to the allowed roots, the configured command blocklist is ignored, and the
+catastrophic-command guardrail is set to allow. `remcp godmode off` puts them back; `remcp godmode
+status` says which state you are in and where it comes from.
+
+Two things it deliberately does not do:
+
+- **It is not reachable from a model.** `set_config_value` lists the settings a model may change and
+  this is not one of them; only a person at the computer (this command, `REMCP_RUNTIME_UNRESTRICTED=1`,
+  or `unrestricted: true` in `~/.config/remcp/runtime.json`) can turn it on. That is what keeps a
+  prompt injection from becoming root.
+- **It does not make the agent root.** Commands run as the user the agent runs as. `sudo` is no longer
+  blocked, but it still needs your sudoers rules; to run everything as root, run the agent as root.
+
+While it is on, `get_runtime_info` reports `policy.unrestricted: true`, so the model can see it and
+say so instead of assuming the guardrails are still there.
+
 ## macOS folder permissions
 
 macOS protects Desktop, Documents, Downloads and iCloud Drive. Until it is granted access, ReMCP

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/remcp",
-  "version": "0.2.28",
+  "version": "0.2.30",
   "description": "ReMCP device client: pair a computer with ReMCP and run the outbound-only agent that hosts the local MCP runtime.",
   "type": "module",
   "license": "MIT",

package/src/cli.mjs

@@ -487,7 +487,7 @@ function assertRuntimeTrust(server, flags) {
 }
 
 function printHelp() {
-  console.log(`ReMCP ${VERSION}\n\nCommands:\n  remcp start\n  remcp status\n  remcp doctor\n  remcp update\n  remcp install\n  remcp uninstall\n  remcp uninstall --purge\n  remcp telemetry [status|on|off]\n  remcp --version\n\nPairing commands are generated in the ReMCP workspace.\n\nUsage metrics are opt-out (tool names, timings, outcomes only, sent to your own ReMCP\naccount through the paired agent). Disable them at any time with: remcp telemetry off`);
+  console.log(`ReMCP ${VERSION}\n\nCommands:\n  remcp start\n  remcp status\n  remcp doctor\n  remcp update\n  remcp install\n  remcp uninstall\n  remcp uninstall --purge\n  remcp telemetry [status|on|off]\n  remcp godmode [status|on|off]\n  remcp --version\n\nPairing commands are generated in the ReMCP workspace.\n\nUsage metrics are opt-out (tool names, timings, outcomes only, sent to your own ReMCP\naccount through the paired agent). Disable them at any time with: remcp telemetry off\n\nUnrestricted mode (remcp godmode on) lifts the access roots and the command guardrails for this\ncomputer only. It is deliberately not reachable from a model or an MCP tool.`);
 }
 
 export async function main(argv = process.argv.slice(2)) {
@@ -602,6 +602,37 @@ export async function main(argv = process.argv.slice(2)) {
     throw new Error('Usage: remcp telemetry [status|on|off]');
   }
 
+  // The switch that lifts every guardrail: no access roots, no command blocklist, no catastrophic
+  // command protection. It lives here, on the machine, because a model that could turn it on would
+  // turn any prompt injection into root. The runtime refuses to set it through MCP
+  // (`set_config_value` lists what it accepts, and this is not on the list).
+  if (command === 'godmode' || command === 'unrestricted') {
+    const action = String(positional[0] || 'status').toLowerCase();
+    if (action === 'status') {
+      const runtimeFile = readJsonFile(runtimeConfigFile);
+      const state = runtimeFile.unrestricted === true || process.env.REMCP_RUNTIME_UNRESTRICTED === '1';
+      console.log(JSON.stringify({
+        unrestricted: state,
+        source: runtimeFile.unrestricted === true ? runtimeConfigFile : process.env.REMCP_RUNTIME_UNRESTRICTED === '1' ? 'REMCP_RUNTIME_UNRESTRICTED' : 'default',
+        meaning: state
+          ? 'Every path and every command is allowed. Commands run as the user the agent runs as; run the agent as root (sudo remcp install --system) if you want root.'
+          : 'The runtime confines file access to its allowed roots and applies its command guardrails.',
+      }, null, 2));
+      return;
+    }
+    if (!['on', 'off', 'enable', 'disable'].includes(action)) throw new Error('Usage: remcp godmode [status|on|off]');
+    const enabled = action === 'on' || action === 'enable';
+    writeJsonFile(runtimeConfigFile, { ...readJsonFile(runtimeConfigFile), unrestricted: enabled });
+    const restarted = restartPersistentServiceIfInstalled();
+    if (enabled) {
+      console.error('Unrestricted mode is ON for this computer: every path and every command is allowed, including sudo. Anything the model is asked to do -- and anything a prompt injection asks it to do -- can now change this machine. Turn it off with `remcp godmode off` when you are done.');
+    } else {
+      console.log('Unrestricted mode is off: the runtime is back to its allowed roots and command guardrails.');
+    }
+    console.log(JSON.stringify({ unrestricted: enabled, configFile: runtimeConfigFile, restarted }, null, 2));
+    return;
+  }
+
   if (command === 'status' || command === 'doctor') {
     const cfg = loadConfig();
     const health = await fetch(`${cfg.serverUrl}/health?fresh=${Date.now()}`, { cache: 'no-store' }).then(r => r.json()).catch(error => ({ error: error.message }));