@remcp/remcp 0.2.42 → 0.2.44

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/remcp",
-  "version": "0.2.42",
+  "version": "0.2.44",
   "description": "ReMCP device client: pair a computer with ReMCP and run the outbound-only agent that hosts the local MCP runtime.",
   "type": "module",
   "license": "MIT",

package/src/agent.mjs

@@ -77,6 +77,7 @@ export async function runAgent(options) {
   const inFlight = new Map();
   let activeSocket;
   let reconnects = 0;
+  let reconnectTimer = null;
   // Set when a replica asks this agent to move before it is replaced; the close handler reads it.
   let askedToReconnect = false;
   let pendingRequests = 0;
@@ -219,6 +220,26 @@ export async function runAgent(options) {
     }
   }
 
+  function scheduleReconnect(delay) {
+    if (stopping || revoked || reconnectTimer) return;
+    reconnectTimer = setTimeout(() => {
+      reconnectTimer = null;
+      connect();
+    }, delay);
+    reconnectTimer.unref?.();
+  }
+
+  function scheduleBackoffReconnect() {
+    if (stopping || revoked || reconnectTimer) return;
+    reconnects += 1;
+    // The first retry after an unexpected drop is quick on purpose: a deploy blip, a proxy restart or
+    // a dropped packet should cost a fraction of a second, not the two seconds the backoff starts at.
+    const delay = reconnects === 1
+      ? jitter(RECONNECT_FIRST_MS)
+      : jitter(Math.min(RECONNECT_MAX_MS, RECONNECT_BASE_MS * 2 ** Math.min(reconnects, 5)));
+    scheduleReconnect(delay);
+  }
+
   async function respond(ws, message) {
     pendingRequests += 1;
     // The relay forwards a cancel when the MCP client goes away. Without it a cancelled tool call
@@ -250,15 +271,29 @@ export async function runAgent(options) {
   function connect() {
     if (stopping) return;
     const ws = new WebSocket(agentUrl, { headers: { Authorization: `Bearer ${deviceToken}` } });
-    // A revoked device is refused during the handshake with a 401 and this header, because a bare
-    // rejection looked like a network problem (close 1006) and the agent retried it forever.
-    ws.on('unexpected-response', (_request, response) => {
-      if (String(response.headers['x-remcp-revoked'] || '') === '1') revoked = true;
-      console.error(`ReMCP relay refused the connection (HTTP ${response.statusCode})${revoked ? ': this device was revoked' : ''}.`);
+    // The ws client leaves cleanup/retry to the caller when an unexpected-response listener exists.
+    // A temporary workspace pause therefore needs an explicit retry; otherwise the first 423 leaves
+    // this WebSocket stuck in CONNECTING forever and turning the device back on cannot recover it.
+    ws.on('unexpected-response', (request, response) => {
+      const handshakeRevoked = String(response.headers['x-remcp-revoked'] || '') === '1';
+      const handshakeDisabled = String(response.headers['x-remcp-disabled'] || '') === '1';
+      if (handshakeRevoked) revoked = true;
+      console.error(`ReMCP relay refused the connection (HTTP ${response.statusCode})${handshakeRevoked ? ': this device was revoked' : handshakeDisabled ? ': this device is temporarily disabled' : ''}.`);
       response.resume();
+      request.destroy();
+      if (handshakeDisabled && !revoked) {
+        reconnects += 1;
+        // Service access is a user-controlled pause, not an outage. Poll slowly enough not to hammer
+        // the relay, but cap recovery so an enable action becomes effective within seconds.
+        scheduleReconnect(jitter(RECONNECT_BASE_MS));
+      }
     });
     activeSocket = ws;
     ws.on('open', () => {
+      if (reconnectTimer) {
+        clearTimeout(reconnectTimer);
+        reconnectTimer = null;
+      }
       reconnects = 0;
       ws.send(JSON.stringify({
         type: 'hello',
@@ -303,7 +338,7 @@ export async function runAgent(options) {
         askedToReconnect = false;
         reconnects = 0;
         console.log('ReMCP relay is being redeployed; reconnecting now.');
-        setTimeout(connect, 150);
+        scheduleReconnect(150);
         return;
       }
       if (code === 1008 || revoked) {
@@ -321,13 +356,7 @@ export async function runAgent(options) {
         void stop().finally(() => setTimeout(() => process.exit(0), 100));
         return;
       }
-      reconnects += 1;
-      // The first retry after an unexpected drop is quick on purpose: a deploy blip, a proxy restart or
-      // a dropped packet should cost a fraction of a second, not the two seconds the backoff starts at.
-      const delay = reconnects === 1
-        ? jitter(RECONNECT_FIRST_MS)
-        : jitter(Math.min(RECONNECT_MAX_MS, RECONNECT_BASE_MS * 2 ** Math.min(reconnects, 5)));
-      setTimeout(connect, delay);
+      scheduleBackoffReconnect();
     });
     ws.on('error', error => console.error(`ReMCP relay: ${error.message}`));
   }
@@ -443,6 +472,8 @@ export async function runAgent(options) {
     if (stopPromise) return stopPromise;
     stopping = true;
     clearTimeout(runtimeRestartTimer);
+    clearTimeout(reconnectTimer);
+    reconnectTimer = null;
     if (telemetryTimer) clearInterval(telemetryTimer);
     clearInterval(telemetryFlushTimer);
     clearInterval(updateTimer);

package/src/cli/config.mjs

@@ -7,21 +7,64 @@ import { normalizeRuntime } from '../runtime.mjs';
 
 import { configDir, configFile, machineIdFile, officialOrigin, runtimeConfigFile } from './env.mjs';
 
+export const CONFIG_SCHEMA_VERSION = 1;
+const legacyOfficialOrigins = new Set(['https://remcp.delio24.com']);
+
+function migrateConfig(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('ReMCP config must be a JSON object');
+  const declared = Number(value.configSchemaVersion || 0);
+  // A newer client may have added fields this client does not understand. Preserve that document
+  // byte-for-meaning and only use the known fields below; never downgrade its schema marker.
+  if (Number.isSafeInteger(declared) && declared > CONFIG_SCHEMA_VERSION) return { value: { ...value }, changed: false };
+
+  let next = { ...value };
+  let changed = false;
+  if (declared < 1) {
+    try {
+      const server = new URL(String(next.serverUrl || ''));
+      if (legacyOfficialOrigins.has(server.origin)) {
+        next.serverUrl = officialOrigin;
+        if (next.trustRuntime === undefined) next.trustRuntime = true;
+        changed = true;
+      }
+    } catch {}
+    if (next.configSchemaVersion !== CONFIG_SCHEMA_VERSION) {
+      next.configSchemaVersion = CONFIG_SCHEMA_VERSION;
+      changed = true;
+    }
+  }
+  return { value: next, changed };
+}
+
+function configForWrite(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('ReMCP config must be a JSON object');
+  const declared = Number(value.configSchemaVersion || 0);
+  return {
+    ...value,
+    configSchemaVersion: Number.isSafeInteger(declared) && declared > CONFIG_SCHEMA_VERSION
+      ? declared
+      : CONFIG_SCHEMA_VERSION,
+  };
+}
+
 export function loadConfig(required = true) {
   if (!fs.existsSync(configFile)) {
     if (!required) return undefined;
     throw new Error(`ReMCP is not paired. Generate a pairing command at ${officialOrigin}/app/connect`);
   }
-  const value = JSON.parse(fs.readFileSync(configFile, 'utf8'));
+  const migrated = migrateConfig(JSON.parse(fs.readFileSync(configFile, 'utf8')));
+  const value = migrated.value;
   // A configuration that only carries preferences (for example after `remcp auto-update off`
   // before pairing) has no runtime yet; it must not fail as if it were corrupt.
   if (value.runtime !== undefined) value.runtime = normalizeRuntime(value.runtime);
+  if (migrated.changed) saveConfig(value);
   return value;
 }
 
 export function saveConfig(value) {
+  const persisted = configForWrite(value);
   fs.mkdirSync(configDir, { recursive: true, mode: 0o700 });
-  fs.writeFileSync(configFile, JSON.stringify(value, null, 2) + '\n', { mode: 0o600 });
+  fs.writeFileSync(configFile, JSON.stringify(persisted, null, 2) + '\n', { mode: 0o600 });
   fs.chmodSync(configFile, 0o600);
 }
 

package/src/cli/service.mjs

@@ -72,6 +72,22 @@ export function installWindowsService(cliPath = globalCliPath()) {
   run('schtasks.exe', ['/Run', '/TN', windowsTaskName]);
 }
 
+// `serviceInstalled` was added after background services already existed in the wild. Treat an
+// explicit false as the user's opt-out, an explicit true as the current marker, and only infer the
+// old intent from an OS service artifact when the marker is absent. This keeps legacy installs
+// repairable without resurrecting a service that a newer client explicitly disabled.
+export function persistentServiceExpected(config) {
+  if (config?.serviceInstalled === false) return false;
+  if (config?.serviceInstalled === true) return true;
+  const platform = servicePlatform();
+  if (platform === 'linux') return fs.existsSync(linuxServiceFile);
+  if (platform === 'darwin') return fs.existsSync(macServiceFile);
+  if (platform === 'win32') {
+    return spawnSync('schtasks.exe', ['/Query', '/TN', windowsTaskName], { stdio: 'ignore' }).status === 0;
+  }
+  return false;
+}
+
 export function configurePostInstallAccess() {
   const platform = servicePlatform();
   try {
@@ -136,7 +152,7 @@ export function installPersistentAgent(config) {
 // (a failed install, a cleaned LaunchAgents directory, a re-imaged user), the next update recreates
 // it instead of leaving a hand-over to a process nobody supervises.
 export function ensureServiceIfRecorded(config) {
-  if (config?.serviceInstalled !== true) return false;
+  if (!persistentServiceExpected(config)) return false;
   try {
     const cliPath = globalCliPath();
     const platform = servicePlatform();
@@ -169,6 +185,9 @@ export function ensureServiceIfRecorded(config) {
       // kickstart) and is what the Windows task already does on every update.
       installMacService(cliPath);
     } else if (platform === 'win32') installWindowsService(cliPath);
+    // Upgrade the legacy inferred state only after the supervisor repair succeeded. A failed repair
+    // must not turn a stale artifact into a permanent "managed service" declaration.
+    if (config?.serviceInstalled !== true) saveConfig({ ...config, serviceInstalled: true });
     return true;
   } catch (error) {
     console.error(`Could not ensure the background service: ${error instanceof Error ? error.message : String(error)}`);
@@ -176,7 +195,8 @@ export function ensureServiceIfRecorded(config) {
   }
 }
 
-export function restartPersistentServiceIfInstalled() {
+export function restartPersistentServiceIfInstalled(config) {
+  if (!persistentServiceExpected(config)) return null;
   const platform = servicePlatform();
   if (platform === 'linux' && fs.existsSync(linuxServiceFile)) {
     run('systemctl', ['--user', 'daemon-reload']);
@@ -184,7 +204,14 @@ export function restartPersistentServiceIfInstalled() {
     return 'remcp-agent.service';
   }
   if (platform === 'darwin' && fs.existsSync(macServiceFile)) {
-    run('launchctl', ['kickstart', '-k', `${macLaunchDomain()}/${macServiceLabel}`]);
+    try {
+      run('launchctl', ['kickstart', '-k', `${macLaunchDomain()}/${macServiceLabel}`]);
+    } catch {
+      // A plist can survive while launchd has no loaded job (older installs, logout/login cleanup,
+      // manual bootout, or a failed previous update). Re-register the job instead of surfacing the
+      // opaque launchctl 113 error. installMacService is idempotent and rewrites stale Node paths too.
+      installMacService(globalCliPath());
+    }
     return macServiceLabel;
   }
   if (platform === 'win32') {

package/src/cli/update.mjs

@@ -200,7 +200,7 @@ export async function updateCommand(flags) {
   // Only a validated spec is persisted, so a failed update cannot leave the install unable to start.
   if (targets.persistRuntime) saveConfig({ ...cfg, runtime: { ...cfg.runtime, packageSpec: targets.runtimeSpec } });
   const after = { cli: installedVersion(PACKAGE_NAME), runtime: installedVersion(cfg.runtime.packageName) };
-  const restarted = restartPersistentServiceIfInstalled();
+  const restarted = restartPersistentServiceIfInstalled(cfg);
   if (restarted) {
     console.log(`ReMCP updated and ${restarted} restarted (client ${before.cli} → ${after.cli ?? '?'}, runtime ${before.runtime ?? '?'} → ${after.runtime ?? '?'}).`);
     return;

package/src/cli.mjs

@@ -128,13 +128,13 @@ export async function main(argv = process.argv.slice(2)) {
     }
     if (action === 'on' || action === 'enable') {
       console.log(JSON.stringify(setTelemetry(true), null, 2));
-      restartPersistentServiceIfInstalled();
+      restartPersistentServiceIfInstalled(loadConfig(false));
       console.log('Usage metrics enabled and the agent restarted to apply it.');
       return;
     }
     if (action === 'off' || action === 'disable') {
       console.log(JSON.stringify(setTelemetry(false), null, 2));
-      restartPersistentServiceIfInstalled();
+      restartPersistentServiceIfInstalled(loadConfig(false));
       console.log('Usage metrics disabled and the agent restarted to apply it.');
       return;
     }
@@ -162,7 +162,7 @@ export async function main(argv = process.argv.slice(2)) {
     if (!['on', 'off', 'enable', 'disable'].includes(action)) throw new Error('Usage: remcp godmode [status|on|off]');
     const enabled = action === 'on' || action === 'enable';
     writeJsonFile(runtimeConfigFile, { ...readJsonFile(runtimeConfigFile), unrestricted: enabled });
-    const restarted = restartPersistentServiceIfInstalled();
+    const restarted = restartPersistentServiceIfInstalled(loadConfig(false));
     if (enabled) {
       console.error('Unrestricted mode is ON for this computer: every path and every command is allowed, including sudo. Anything the model is asked to do -- and anything a prompt injection asks it to do -- can now change this machine. Turn it off with `remcp godmode off` when you are done.');
     } else {
@@ -213,9 +213,12 @@ export async function main(argv = process.argv.slice(2)) {
   }
 
   if (command === 'uninstall') {
+    const cfg = loadConfig(false);
     uninstallPersistentService();
+    // Keep the pairing unless --purge was requested, but remember that the owner explicitly removed
+    // the supervisor. Future updates must not infer an old service artifact and recreate it.
+    if (cfg) saveConfig({ ...cfg, serviceInstalled: false });
     if (flags.purge) {
-      const cfg = loadConfig(false);
       const specs = [PACKAGE_NAME, ...(cfg?.runtime?.packageName ? [cfg.runtime.packageName] : [])];
       run(npm.command, [...npm.args, 'uninstall', '--global', ...specs, '--no-audit', '--no-fund', '--loglevel=error']);
     }