@remcp/remcp 0.2.29 → 0.2.31

package/README.md

@@ -27,12 +27,33 @@ remcp install                Install or repair the user service
 remcp uninstall              Remove the user service
 remcp uninstall --purge      Remove the service and the global packages
 remcp telemetry [status|on|off]
+remcp godmode [status|on|off]
 remcp --version
 ```
 
 `remcp status` reports the runtime the device would install, whether the agent service is running,
 and the current usage-metrics state, so a support request can be answered with one paste.
 
+## Unrestricted mode
+
+`remcp godmode on` removes the runtime's own safety rails on **this** computer: file access is no
+longer confined to the allowed roots, the configured command blocklist is ignored, and the
+catastrophic-command guardrail is set to allow. `remcp godmode off` puts them back; `remcp godmode
+status` says which state you are in and where it comes from.
+
+Two things it deliberately does not do:
+
+- **It is not reachable from a model.** `set_config_value` lists the settings a model may change and
+  this is not one of them; only a person at the computer (this command, `REMCP_RUNTIME_UNRESTRICTED=1`,
+  or `unrestricted: true` in `~/.config/remcp/runtime.json`) can turn it on. That is what keeps a
+  prompt injection from becoming root.
+- **It does not make the agent root.** Commands run as the user the agent runs as. `sudo` is no longer
+  blocked, but the operating system still asks for a password unless your sudoers rules say otherwise;
+  a non-interactive command cannot type one. Nothing in this mode grants root by itself.
+
+While it is on, `get_runtime_info` reports `policy.unrestricted: true`, so the model can see it and
+say so instead of assuming the guardrails are still there.
+
 ## macOS folder permissions
 
 macOS protects Desktop, Documents, Downloads and iCloud Drive. Until it is granted access, ReMCP
@@ -43,6 +64,32 @@ background service: open **System Settings → Privacy & Security → Full Disk
 binary that `remcp doctor` prints, and run `remcp start`. Folders outside those four need no new
 permission, and `remcp doctor` reports the state of each one.
 
+## Updates
+
+The agent asks the server which versions it should run when it connects and every six hours, installs
+a newer client and runtime in the background, and restarts the service so they take effect. A failed
+install is retried no more often than every thirty minutes, so a broken release cannot turn into an
+install loop. `remcp update` does the same immediately; `remcp auto-update off` turns the automatic
+check off for a machine that must not change on its own.
+
+## Screenshots
+
+`take_screenshot` returns the screen of this computer as an image, and each desktop keeps its own
+gate — ReMCP names the one that refused instead of printing a generic error:
+
+- **macOS** wants Screen Recording for the binary that runs the tools (`remcp doctor` prints its
+  path), then `remcp start`.
+- **Windows** needs an unlocked interactive session; a locked or signed-out machine cannot be
+  captured.
+- **Linux on Wayland** needs a capture backend: `grim` on wlroots desktops (sway, hyprland), and
+  `gnome-screenshot` on GNOME — GNOME refuses the shell's own screenshot API to background processes
+  and `grim` cannot read a GNOME session. On X11, `scrot`, ImageMagick `import` or `gnome-screenshot`
+  all work.
+- A machine with no graphical session (a server, a container) says so: there is nothing to capture.
+
+A screenshot larger than the inline limit is saved on the computer, and the result says where it is
+and how to fetch it in chunks.
+
 ## What runs on your computer
 
 - the agent (`remcp start`), which holds the device credential and dials

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/remcp",
-  "version": "0.2.29",
+  "version": "0.2.31",
   "description": "ReMCP device client: pair a computer with ReMCP and run the outbound-only agent that hosts the local MCP runtime.",
   "type": "module",
   "license": "MIT",

package/src/cli.mjs

@@ -487,7 +487,7 @@ function assertRuntimeTrust(server, flags) {
 }
 
 function printHelp() {
-  console.log(`ReMCP ${VERSION}\n\nCommands:\n  remcp start\n  remcp status\n  remcp doctor\n  remcp update\n  remcp install\n  remcp uninstall\n  remcp uninstall --purge\n  remcp telemetry [status|on|off]\n  remcp --version\n\nPairing commands are generated in the ReMCP workspace.\n\nUsage metrics are opt-out (tool names, timings, outcomes only, sent to your own ReMCP\naccount through the paired agent). Disable them at any time with: remcp telemetry off`);
+  console.log(`ReMCP ${VERSION}\n\nCommands:\n  remcp start\n  remcp status\n  remcp doctor\n  remcp update\n  remcp install\n  remcp uninstall\n  remcp uninstall --purge\n  remcp telemetry [status|on|off]\n  remcp godmode [status|on|off]\n  remcp --version\n\nPairing commands are generated in the ReMCP workspace.\n\nUsage metrics are opt-out (tool names, timings, outcomes only, sent to your own ReMCP\naccount through the paired agent). Disable them at any time with: remcp telemetry off\n\nUnrestricted mode (remcp godmode on) lifts the access roots and the command guardrails for this\ncomputer only. It is deliberately not reachable from a model or an MCP tool.`);
 }
 
 export async function main(argv = process.argv.slice(2)) {
@@ -602,6 +602,37 @@ export async function main(argv = process.argv.slice(2)) {
     throw new Error('Usage: remcp telemetry [status|on|off]');
   }
 
+  // The switch that lifts every guardrail: no access roots, no command blocklist, no catastrophic
+  // command protection. It lives here, on the machine, because a model that could turn it on would
+  // turn any prompt injection into root. The runtime refuses to set it through MCP
+  // (`set_config_value` lists what it accepts, and this is not on the list).
+  if (command === 'godmode' || command === 'unrestricted') {
+    const action = String(positional[0] || 'status').toLowerCase();
+    if (action === 'status') {
+      const runtimeFile = readJsonFile(runtimeConfigFile);
+      const state = runtimeFile.unrestricted === true || process.env.REMCP_RUNTIME_UNRESTRICTED === '1';
+      console.log(JSON.stringify({
+        unrestricted: state,
+        source: runtimeFile.unrestricted === true ? runtimeConfigFile : process.env.REMCP_RUNTIME_UNRESTRICTED === '1' ? 'REMCP_RUNTIME_UNRESTRICTED' : 'default',
+        meaning: state
+          ? 'Every path and every command is allowed. Commands run as the user the agent runs as, so sudo still needs your own sudoers rules; nothing here grants root by itself.'
+          : 'The runtime confines file access to its allowed roots and applies its command guardrails.',
+      }, null, 2));
+      return;
+    }
+    if (!['on', 'off', 'enable', 'disable'].includes(action)) throw new Error('Usage: remcp godmode [status|on|off]');
+    const enabled = action === 'on' || action === 'enable';
+    writeJsonFile(runtimeConfigFile, { ...readJsonFile(runtimeConfigFile), unrestricted: enabled });
+    const restarted = restartPersistentServiceIfInstalled();
+    if (enabled) {
+      console.error('Unrestricted mode is ON for this computer: every path and every command is allowed, including sudo. Anything the model is asked to do -- and anything a prompt injection asks it to do -- can now change this machine. Turn it off with `remcp godmode off` when you are done.');
+    } else {
+      console.log('Unrestricted mode is off: the runtime is back to its allowed roots and command guardrails.');
+    }
+    console.log(JSON.stringify({ unrestricted: enabled, configFile: runtimeConfigFile, restarted }, null, 2));
+    return;
+  }
+
   if (command === 'status' || command === 'doctor') {
     const cfg = loadConfig();
     const health = await fetch(`${cfg.serverUrl}/health?fresh=${Date.now()}`, { cache: 'no-store' }).then(r => r.json()).catch(error => ({ error: error.message }));