@remcp/remcp 0.2.33 → 0.2.34

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/remcp",
-  "version": "0.2.33",
+  "version": "0.2.34",
   "description": "ReMCP device client: pair a computer with ReMCP and run the outbound-only agent that hosts the local MCP runtime.",
   "type": "module",
   "license": "MIT",
@@ -18,7 +18,7 @@
     "README.md"
   ],
   "scripts": {
-    "check": "node --check bin/remcp.mjs && node --check src/agent.mjs && node --check src/cli.mjs && node --check src/cli/config.mjs && node --check src/cli/connect.mjs && node --check src/cli/doctor.mjs && node --check src/cli/env.mjs && node --check src/cli/service.mjs && node --check src/cli/shell.mjs && node --check src/fs-access.mjs && node --check src/npm.mjs && node --check src/runtime.mjs && node --check src/version.mjs",
+    "check": "node --check bin/remcp.mjs && node --check src/agent.mjs && node --check src/cli.mjs && node --check src/cli/config.mjs && node --check src/cli/connect.mjs && node --check src/cli/doctor.mjs && node --check src/cli/env.mjs && node --check src/cli/service.mjs && node --check src/cli/shell.mjs && node --check src/cli/update.mjs && node --check src/fs-access.mjs && node --check src/npm.mjs && node --check src/runtime.mjs && node --check src/version.mjs",
     "test": "node --test test/*.test.mjs"
   },
   "dependencies": {

package/src/cli/connect.mjs

@@ -8,13 +8,22 @@ import { ensureMachineId } from './config.mjs';
 import { officialOrigin } from './env.mjs';
 import { sleep } from './shell.mjs';
 
+// Keep the server-provided approval URL as data all the way to the OS. In particular, do not route it
+// through `cmd /c start` on Windows: cmd reparses metacharacters such as `&`, so a custom pairing
+// server could otherwise turn a verification URL into a local shell command.
+export function browserLaunchCommand(url, platform = process.platform) {
+  const target = String(url);
+  if (platform === 'darwin') return { command: 'open', args: [target] };
+  if (platform === 'win32') return { command: 'explorer.exe', args: [target] };
+  return { command: 'xdg-open', args: [target] };
+}
+
 // Opens the approval page in the person's browser. A machine that nobody is looking at only gets the
 // printed URL, so every failure here is silent and non-fatal.
 export function openInBrowser(url) {
   try {
-    const command = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'cmd' : 'xdg-open';
-    const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
-    const child = spawn(command, args, { stdio: 'ignore', detached: true });
+    const { command, args } = browserLaunchCommand(url);
+    const child = spawn(command, args, { stdio: 'ignore', detached: true, shell: false });
     child.on('error', () => {});
     child.unref();
   } catch {}

package/src/cli/update.mjs

@@ -0,0 +1,74 @@
+// `remcp update`: install what the server advertises, then let whoever supervises the agent restart
+// it. Only a spec the configured package can satisfy is installed, so a pairing response from a
+// custom server cannot point this machine at a different package or run a git/URL spec.
+import fs from 'node:fs';
+import process from 'node:process';
+
+import { supervisorRestart } from '../agent.mjs';
+import { isRuntimeSpecFor, normalizeRuntime } from '../runtime.mjs';
+import { PACKAGE_NAME, VERSION } from '../version.mjs';
+
+import { loadConfig, saveConfig } from './config.mjs';
+import { installedVersion } from './doctor.mjs';
+import { linuxServiceFile, macServiceFile, officialOrigin } from './env.mjs';
+import { ensureServiceIfRecorded, npmGlobalInstall, restartPersistentServiceIfInstalled } from './service.mjs';
+
+export async function updateCommand(flags) {
+  const cfg = loadConfig();
+  // The server advertises which runtime version it expects; an agent that is updating
+  // itself passes it through so client and runtime move together.
+  const requested = typeof flags.runtime === 'string' ? flags.runtime.trim() : '';
+  // Whatever the server advertises is installed globally, so it is validated exactly like the
+  // metadata from a pairing response: same package as the configured runtime, a spec that
+  // parses, and an explicit --trust-runtime before a custom server may change it.
+  let runtimeSpec = cfg.runtime.packageSpec;
+  if (requested) {
+    // Only `<configured package>@<semver>` is installable: an alias, a git/URL/file spec, a tag or
+    // a range would run code the user never agreed to.
+    if (!isRuntimeSpecFor(cfg.runtime.packageName, requested)) {
+      throw new Error(`--runtime must be ${cfg.runtime.packageName}@<version>`);
+    }
+    const trusted = cfg.trustRuntime === true
+      || Boolean(flags['trust-runtime'])
+      || process.env.REMCP_TRUST_RUNTIME === '1'
+      // A configuration written before the field existed paired with the official server, which is
+      // trusted by definition; refusing it would silently stop every existing device updating.
+      || new URL(cfg.serverUrl).origin === officialOrigin;
+    if (!trusted) {
+      throw new Error(`This machine was paired without trusting ${cfg.serverUrl} to choose a runtime version. Re-run with --trust-runtime if you trust that server.`);
+    }
+    runtimeSpec = normalizeRuntime({ kind: 'npm', packageName: cfg.runtime.packageName, packageSpec: requested, entry: cfg.runtime.entry }).packageSpec;
+  }
+  if (flags.check) {
+    console.log(JSON.stringify({
+      current: VERSION,
+      installedRuntime: installedVersion(cfg.runtime.packageName),
+      runtimeSpec: runtimeSpec,
+      available: `${PACKAGE_NAME}@latest`,
+      managedService: fs.existsSync(linuxServiceFile) || fs.existsSync(macServiceFile),
+      supervisor: supervisorRestart() ?? 'none',
+    }, null, 2));
+    return;
+  }
+  const before = { cli: VERSION, runtime: installedVersion(cfg.runtime.packageName) };
+  console.log(`Updating ReMCP to the latest published version (${runtimeSpec})…`);
+  npmGlobalInstall(`${PACKAGE_NAME}@latest`, runtimeSpec);
+  // The npm prefix can change across Node-manager upgrades. Repair an existing persistent-service
+  // launcher only after the install, when globalCliPath() points at the CLI we just installed.
+  ensureServiceIfRecorded(cfg);
+  // Only a validated spec is persisted, so a failed update cannot leave the install unable to start.
+  if (requested && runtimeSpec !== cfg.runtime.packageSpec) saveConfig({ ...cfg, runtime: { ...cfg.runtime, packageSpec: runtimeSpec } });
+  const after = { cli: installedVersion(PACKAGE_NAME), runtime: installedVersion(cfg.runtime.packageName) };
+  const restarted = restartPersistentServiceIfInstalled();
+  if (restarted) {
+    console.log(`ReMCP updated and ${restarted} restarted (client ${before.cli} → ${after.cli ?? '?'}, runtime ${before.runtime ?? '?'} → ${after.runtime ?? '?'}).`);
+    return;
+  }
+  // This process is the updater, not the agent: exiting here would restart nothing. The agent sees
+  // the exit status, verifies the installed version, and restarts itself.
+  console.log(`ReMCP updated (client ${before.cli} → ${after.cli ?? '?'}, runtime ${before.runtime ?? '?'} → ${after.runtime ?? '?'}). The running agent restarts itself to apply it.`);
+  if (after.cli === before.cli && after.runtime === before.runtime) {
+    console.log('Nothing changed: the installed versions already match the requested ones.');
+  }
+  return;
+}

package/src/cli.mjs

@@ -1,18 +1,18 @@
-import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import process from 'node:process';
-import { runAgent, supervisorRestart } from './agent.mjs';
-import { isRuntimeSpecFor, normalizeRuntime } from './runtime.mjs';
+import { runAgent } from './agent.mjs';
+import { normalizeRuntime } from './runtime.mjs';
 import { PACKAGE_NAME, VERSION } from './version.mjs';
 import { probeFilesystemAccess } from './fs-access.mjs';
 
 import { ensureMachineId, loadConfig, readJsonFile, saveConfig, setTelemetry, telemetryState, writeJsonFile } from './cli/config.mjs';
 import { assertRuntimeTrust, pairWithDeviceCode } from './cli/connect.mjs';
-import { diagnoseLocalRuntime, installedVersion, runtimeAllowedRoots } from './cli/doctor.mjs';
-import { configFile, linuxServiceFile, macServiceFile, npm, officialOrigin, runtimeConfigFile } from './cli/env.mjs';
-import { ensureServiceIfRecorded, globalCliPath, installPersistentAgent, npmGlobalInstall, restartPersistentServiceIfInstalled, uninstallPersistentService } from './cli/service.mjs';
+import { diagnoseLocalRuntime, runtimeAllowedRoots } from './cli/doctor.mjs';
+import { configFile, npm, officialOrigin, runtimeConfigFile } from './cli/env.mjs';
+import { installPersistentAgent, restartPersistentServiceIfInstalled, uninstallPersistentService } from './cli/service.mjs';
 import { run } from './cli/shell.mjs';
+import { updateCommand } from './cli/update.mjs';
 function parse(argv) {
   const [command = 'help', ...rest] = argv;
   const flags = {};
@@ -208,62 +208,7 @@ export async function main(argv = process.argv.slice(2)) {
   }
 
   if (command === 'update') {
-    const cfg = loadConfig();
-    // The server advertises which runtime version it expects; an agent that is updating
-    // itself passes it through so client and runtime move together.
-    const requested = typeof flags.runtime === 'string' ? flags.runtime.trim() : '';
-    // Whatever the server advertises is installed globally, so it is validated exactly like the
-    // metadata from a pairing response: same package as the configured runtime, a spec that
-    // parses, and an explicit --trust-runtime before a custom server may change it.
-    let runtimeSpec = cfg.runtime.packageSpec;
-    if (requested) {
-      // Only `<configured package>@<semver>` is installable: an alias, a git/URL/file spec, a tag or
-      // a range would run code the user never agreed to.
-      if (!isRuntimeSpecFor(cfg.runtime.packageName, requested)) {
-        throw new Error(`--runtime must be ${cfg.runtime.packageName}@<version>`);
-      }
-      const trusted = cfg.trustRuntime === true
-        || Boolean(flags['trust-runtime'])
-        || process.env.REMCP_TRUST_RUNTIME === '1'
-        // A configuration written before the field existed paired with the official server, which is
-        // trusted by definition; refusing it would silently stop every existing device updating.
-        || new URL(cfg.serverUrl).origin === officialOrigin;
-      if (!trusted) {
-        throw new Error(`This machine was paired without trusting ${cfg.serverUrl} to choose a runtime version. Re-run with --trust-runtime if you trust that server.`);
-      }
-      runtimeSpec = normalizeRuntime({ kind: 'npm', packageName: cfg.runtime.packageName, packageSpec: requested, entry: cfg.runtime.entry }).packageSpec;
-    }
-    if (flags.check) {
-      console.log(JSON.stringify({
-        current: VERSION,
-        installedRuntime: installedVersion(cfg.runtime.packageName),
-        runtimeSpec: runtimeSpec,
-        available: `${PACKAGE_NAME}@latest`,
-        managedService: fs.existsSync(linuxServiceFile) || fs.existsSync(macServiceFile),
-        supervisor: supervisorRestart() ?? 'none',
-      }, null, 2));
-      return;
-    }
-    const before = { cli: VERSION, runtime: installedVersion(cfg.runtime.packageName) };
-    console.log(`Updating ReMCP to the latest published version (${runtimeSpec})…`);
-    npmGlobalInstall(`${PACKAGE_NAME}@latest`, runtimeSpec);
-    // The npm prefix can change across Node-manager upgrades. Repair an existing persistent-service
-    // launcher only after the install, when globalCliPath() points at the CLI we just installed.
-    ensureServiceIfRecorded(cfg);
-    // Only a validated spec is persisted, so a failed update cannot leave the install unable to start.
-    if (requested && runtimeSpec !== cfg.runtime.packageSpec) saveConfig({ ...cfg, runtime: { ...cfg.runtime, packageSpec: runtimeSpec } });
-    const after = { cli: installedVersion(PACKAGE_NAME), runtime: installedVersion(cfg.runtime.packageName) };
-    const restarted = restartPersistentServiceIfInstalled();
-    if (restarted) {
-      console.log(`ReMCP updated and ${restarted} restarted (client ${before.cli} → ${after.cli ?? '?'}, runtime ${before.runtime ?? '?'} → ${after.runtime ?? '?'}).`);
-      return;
-    }
-    // This process is the updater, not the agent: exiting here would restart nothing. The agent sees
-    // the exit status, verifies the installed version, and restarts itself.
-    console.log(`ReMCP updated (client ${before.cli} → ${after.cli ?? '?'}, runtime ${before.runtime ?? '?'} → ${after.runtime ?? '?'}). The running agent restarts itself to apply it.`);
-    if (after.cli === before.cli && after.runtime === before.runtime) {
-      console.log('Nothing changed: the installed versions already match the requested ones.');
-    }
+    await updateCommand(flags);
     return;
   }
 
@@ -278,4 +223,4 @@ export async function main(argv = process.argv.slice(2)) {
   }
 
   printHelp();
-}
+}