@remcp/remcp 0.2.43 → 0.2.45

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/remcp",
-  "version": "0.2.43",
+  "version": "0.2.45",
   "description": "ReMCP device client: pair a computer with ReMCP and run the outbound-only agent that hosts the local MCP runtime.",
   "type": "module",
   "license": "MIT",

package/src/cli/config.mjs

@@ -7,21 +7,64 @@ import { normalizeRuntime } from '../runtime.mjs';
 
 import { configDir, configFile, machineIdFile, officialOrigin, runtimeConfigFile } from './env.mjs';
 
+export const CONFIG_SCHEMA_VERSION = 1;
+const legacyOfficialOrigins = new Set(['https://remcp.delio24.com']);
+
+function migrateConfig(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('ReMCP config must be a JSON object');
+  const declared = Number(value.configSchemaVersion || 0);
+  // A newer client may have added fields this client does not understand. Preserve that document
+  // byte-for-meaning and only use the known fields below; never downgrade its schema marker.
+  if (Number.isSafeInteger(declared) && declared > CONFIG_SCHEMA_VERSION) return { value: { ...value }, changed: false };
+
+  let next = { ...value };
+  let changed = false;
+  if (declared < 1) {
+    try {
+      const server = new URL(String(next.serverUrl || ''));
+      if (legacyOfficialOrigins.has(server.origin)) {
+        next.serverUrl = officialOrigin;
+        if (next.trustRuntime === undefined) next.trustRuntime = true;
+        changed = true;
+      }
+    } catch {}
+    if (next.configSchemaVersion !== CONFIG_SCHEMA_VERSION) {
+      next.configSchemaVersion = CONFIG_SCHEMA_VERSION;
+      changed = true;
+    }
+  }
+  return { value: next, changed };
+}
+
+function configForWrite(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('ReMCP config must be a JSON object');
+  const declared = Number(value.configSchemaVersion || 0);
+  return {
+    ...value,
+    configSchemaVersion: Number.isSafeInteger(declared) && declared > CONFIG_SCHEMA_VERSION
+      ? declared
+      : CONFIG_SCHEMA_VERSION,
+  };
+}
+
 export function loadConfig(required = true) {
   if (!fs.existsSync(configFile)) {
     if (!required) return undefined;
     throw new Error(`ReMCP is not paired. Generate a pairing command at ${officialOrigin}/app/connect`);
   }
-  const value = JSON.parse(fs.readFileSync(configFile, 'utf8'));
+  const migrated = migrateConfig(JSON.parse(fs.readFileSync(configFile, 'utf8')));
+  const value = migrated.value;
   // A configuration that only carries preferences (for example after `remcp auto-update off`
   // before pairing) has no runtime yet; it must not fail as if it were corrupt.
   if (value.runtime !== undefined) value.runtime = normalizeRuntime(value.runtime);
+  if (migrated.changed) saveConfig(value);
   return value;
 }
 
 export function saveConfig(value) {
+  const persisted = configForWrite(value);
   fs.mkdirSync(configDir, { recursive: true, mode: 0o700 });
-  fs.writeFileSync(configFile, JSON.stringify(value, null, 2) + '\n', { mode: 0o600 });
+  fs.writeFileSync(configFile, JSON.stringify(persisted, null, 2) + '\n', { mode: 0o600 });
   fs.chmodSync(configFile, 0o600);
 }
 

package/src/cli/service.mjs

@@ -8,7 +8,7 @@ import { spawnSync } from 'node:child_process';
 import { PACKAGE_NAME, VERSION } from '../version.mjs';
 
 import { saveConfig } from './config.mjs';
-import { home, linuxServiceFile, macLogFile, macServiceFile, macServiceLabel, npm, windowsTaskName } from './env.mjs';
+import { configDir, home, linuxServiceFile, macLogFile, macServiceFile, macServiceLabel, npm, windowsTaskName } from './env.mjs';
 import { output, run } from './shell.mjs';
 
 export function servicePlatform() {
@@ -49,21 +49,72 @@ export function macLaunchDomain() {
   return `gui/${process.getuid()}`;
 }
 
-export function installMacService(cliPath = globalCliPath()) {
-  const domain = macLaunchDomain();
-  const target = `${domain}/${macServiceLabel}`;
+function shellQuote(value) {
+  return `'${String(value).replaceAll("'", "'\\''")}'`;
+}
+
+function macServicePlist(cliPath) {
   // launchd wants an absolute path; a symlinked prefix that npm has not materialised yet (or a path
   // that is about to be replaced by the next install) must not abort the repair — a stale plist is
   // exactly the loop this function exists to break.
   const cliScript = fs.existsSync(cliPath) ? fs.realpathSync(cliPath) : path.resolve(cliPath);
+  return `<?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0"><dict>\n<key>Label</key><string>${macServiceLabel}</string>\n<key>ProgramArguments</key><array><string>${xmlEscape(process.execPath)}</string><string>${xmlEscape(cliScript)}</string><string>start</string></array>\n<key>RunAtLoad</key><true/><key>KeepAlive</key><true/>\n<key>ProcessType</key><string>Background</string>\n<key>StandardOutPath</key><string>${xmlEscape(macLogFile)}</string>\n<key>StandardErrorPath</key><string>${xmlEscape(macLogFile)}</string>\n</dict></plist>\n`;
+}
+
+function macJobLoaded(target) {
+  return spawnSync('launchctl', ['print', target], { stdio: 'ignore' }).status === 0;
+}
+
+function scheduleMacServiceReload(domain, target) {
+  fs.mkdirSync(configDir, { recursive: true, mode: 0o700 });
+  const helperFile = path.join(configDir, `launchd-reload-${process.pid}.sh`);
+  const helperLabel = `${macServiceLabel}.reload.${process.pid}`;
+  const script = [
+    '#!/bin/sh',
+    'sleep 1',
+    `launchctl bootout ${shellQuote(target)} >/dev/null 2>&1 || true`,
+    `launchctl bootstrap ${shellQuote(domain)} ${shellQuote(macServiceFile)}`,
+    `launchctl enable ${shellQuote(target)}`,
+    `launchctl kickstart -k ${shellQuote(target)}`,
+    `rm -f ${shellQuote(helperFile)}`,
+    '',
+  ].join('\n');
+  fs.writeFileSync(helperFile, script, { mode: 0o700 });
+  fs.chmodSync(helperFile, 0o700);
+  run('launchctl', ['submit', '-l', helperLabel, '--', '/bin/sh', helperFile]);
+}
+
+export function installMacService(cliPath = globalCliPath(), { restart = true } = {}) {
+  const domain = macLaunchDomain();
+  const target = `${domain}/${macServiceLabel}`;
+  const plist = macServicePlist(cliPath);
+  let previous = '';
+  try { previous = fs.readFileSync(macServiceFile, 'utf8'); } catch {}
+  const loaded = macJobLoaded(target);
+
   fs.mkdirSync(path.dirname(macServiceFile), { recursive: true });
   fs.mkdirSync(path.dirname(macLogFile), { recursive: true });
-  const plist = `<?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0"><dict>\n<key>Label</key><string>${macServiceLabel}</string>\n<key>ProgramArguments</key><array><string>${xmlEscape(process.execPath)}</string><string>${xmlEscape(cliScript)}</string><string>start</string></array>\n<key>RunAtLoad</key><true/><key>KeepAlive</key><true/>\n<key>ProcessType</key><string>Background</string>\n<key>StandardOutPath</key><string>${xmlEscape(macLogFile)}</string>\n<key>StandardErrorPath</key><string>${xmlEscape(macLogFile)}</string>\n</dict></plist>\n`;
   fs.writeFileSync(macServiceFile, plist, { mode: 0o600 });
-  spawnSync('launchctl', ['bootout', domain, macServiceFile], { stdio: 'ignore' });
+
+  if (loaded && previous === plist) {
+    run('launchctl', ['enable', target]);
+    // Never boot out a healthy loaded job just to refresh an in-place npm install. The final
+    // kickstart keeps launchd responsible for bringing the replacement agent back.
+    if (restart) run('launchctl', ['kickstart', '-k', target]);
+    return 'loaded';
+  }
+
+  if (loaded) {
+    // A changed Node/npm prefix requires launchd to re-read ProgramArguments. A separate transient
+    // launchd job survives booting out com.remcp.agent even when the updater was launched by it.
+    scheduleMacServiceReload(domain, target);
+    return 'reload-scheduled';
+  }
+
   run('launchctl', ['bootstrap', domain, macServiceFile]);
   run('launchctl', ['enable', target]);
-  run('launchctl', ['kickstart', '-k', target]);
+  if (restart) run('launchctl', ['kickstart', '-k', target]);
+  return 'bootstrapped';
 }
 
 export function installWindowsService(cliPath = globalCliPath()) {
@@ -72,6 +123,22 @@ export function installWindowsService(cliPath = globalCliPath()) {
   run('schtasks.exe', ['/Run', '/TN', windowsTaskName]);
 }
 
+// `serviceInstalled` was added after background services already existed in the wild. Treat an
+// explicit false as the user's opt-out, an explicit true as the current marker, and only infer the
+// old intent from an OS service artifact when the marker is absent. This keeps legacy installs
+// repairable without resurrecting a service that a newer client explicitly disabled.
+export function persistentServiceExpected(config) {
+  if (config?.serviceInstalled === false) return false;
+  if (config?.serviceInstalled === true) return true;
+  const platform = servicePlatform();
+  if (platform === 'linux') return fs.existsSync(linuxServiceFile);
+  if (platform === 'darwin') return fs.existsSync(macServiceFile);
+  if (platform === 'win32') {
+    return spawnSync('schtasks.exe', ['/Query', '/TN', windowsTaskName], { stdio: 'ignore' }).status === 0;
+  }
+  return false;
+}
+
 export function configurePostInstallAccess() {
   const platform = servicePlatform();
   try {
@@ -136,7 +203,7 @@ export function installPersistentAgent(config) {
 // (a failed install, a cleaned LaunchAgents directory, a re-imaged user), the next update recreates
 // it instead of leaving a hand-over to a process nobody supervises.
 export function ensureServiceIfRecorded(config) {
-  if (config?.serviceInstalled !== true) return false;
+  if (!persistentServiceExpected(config)) return false;
   try {
     const cliPath = globalCliPath();
     const platform = servicePlatform();
@@ -163,12 +230,15 @@ export function ensureServiceIfRecorded(config) {
         }
       }
     } else if (platform === 'darwin') {
-      // launchd bakes the interpreter and the CLI path into the plist, so a Node manager that moves
-      // its global prefix leaves the agent launching a file that no longer exists — the same loop the
-      // Linux unit above is repaired for. Reinstalling is idempotent (bootout, bootstrap, enable,
-      // kickstart) and is what the Windows task already does on every update.
-      installMacService(cliPath);
+      // launchd bakes the interpreter and CLI path into the plist. Repair the file first, but never
+      // boot out a loaded agent inline: this updater may itself be a descendant of that LaunchAgent.
+      // installMacService either leaves an unchanged loaded job alone, bootstraps an unloaded job, or
+      // hands a changed launcher to an independent transient launchd helper.
+      installMacService(cliPath, { restart: false });
     } else if (platform === 'win32') installWindowsService(cliPath);
+    // Upgrade the legacy inferred state only after the supervisor repair succeeded. A failed repair
+    // must not turn a stale artifact into a permanent "managed service" declaration.
+    if (config?.serviceInstalled !== true) saveConfig({ ...config, serviceInstalled: true });
     return true;
   } catch (error) {
     console.error(`Could not ensure the background service: ${error instanceof Error ? error.message : String(error)}`);
@@ -176,7 +246,8 @@ export function ensureServiceIfRecorded(config) {
   }
 }
 
-export function restartPersistentServiceIfInstalled() {
+export function restartPersistentServiceIfInstalled(config) {
+  if (!persistentServiceExpected(config)) return null;
   const platform = servicePlatform();
   if (platform === 'linux' && fs.existsSync(linuxServiceFile)) {
     run('systemctl', ['--user', 'daemon-reload']);
@@ -184,7 +255,14 @@ export function restartPersistentServiceIfInstalled() {
     return 'remcp-agent.service';
   }
   if (platform === 'darwin' && fs.existsSync(macServiceFile)) {
-    run('launchctl', ['kickstart', '-k', `${macLaunchDomain()}/${macServiceLabel}`]);
+    try {
+      run('launchctl', ['kickstart', '-k', `${macLaunchDomain()}/${macServiceLabel}`]);
+    } catch {
+      // A plist can survive while launchd has no loaded job (older installs, logout/login cleanup,
+      // manual bootout, or a failed previous update). Re-register the job instead of surfacing the
+      // opaque launchctl 113 error. installMacService is idempotent and rewrites stale Node paths too.
+      installMacService(globalCliPath());
+    }
     return macServiceLabel;
   }
   if (platform === 'win32') {

package/src/cli/update.mjs

@@ -200,7 +200,7 @@ export async function updateCommand(flags) {
   // Only a validated spec is persisted, so a failed update cannot leave the install unable to start.
   if (targets.persistRuntime) saveConfig({ ...cfg, runtime: { ...cfg.runtime, packageSpec: targets.runtimeSpec } });
   const after = { cli: installedVersion(PACKAGE_NAME), runtime: installedVersion(cfg.runtime.packageName) };
-  const restarted = restartPersistentServiceIfInstalled();
+  const restarted = restartPersistentServiceIfInstalled(cfg);
   if (restarted) {
     console.log(`ReMCP updated and ${restarted} restarted (client ${before.cli} → ${after.cli ?? '?'}, runtime ${before.runtime ?? '?'} → ${after.runtime ?? '?'}).`);
     return;

package/src/cli.mjs

@@ -128,13 +128,13 @@ export async function main(argv = process.argv.slice(2)) {
     }
     if (action === 'on' || action === 'enable') {
       console.log(JSON.stringify(setTelemetry(true), null, 2));
-      restartPersistentServiceIfInstalled();
+      restartPersistentServiceIfInstalled(loadConfig(false));
       console.log('Usage metrics enabled and the agent restarted to apply it.');
       return;
     }
     if (action === 'off' || action === 'disable') {
       console.log(JSON.stringify(setTelemetry(false), null, 2));
-      restartPersistentServiceIfInstalled();
+      restartPersistentServiceIfInstalled(loadConfig(false));
       console.log('Usage metrics disabled and the agent restarted to apply it.');
       return;
     }
@@ -162,7 +162,7 @@ export async function main(argv = process.argv.slice(2)) {
     if (!['on', 'off', 'enable', 'disable'].includes(action)) throw new Error('Usage: remcp godmode [status|on|off]');
     const enabled = action === 'on' || action === 'enable';
     writeJsonFile(runtimeConfigFile, { ...readJsonFile(runtimeConfigFile), unrestricted: enabled });
-    const restarted = restartPersistentServiceIfInstalled();
+    const restarted = restartPersistentServiceIfInstalled(loadConfig(false));
     if (enabled) {
       console.error('Unrestricted mode is ON for this computer: every path and every command is allowed, including sudo. Anything the model is asked to do -- and anything a prompt injection asks it to do -- can now change this machine. Turn it off with `remcp godmode off` when you are done.');
     } else {
@@ -213,9 +213,12 @@ export async function main(argv = process.argv.slice(2)) {
   }
 
   if (command === 'uninstall') {
+    const cfg = loadConfig(false);
     uninstallPersistentService();
+    // Keep the pairing unless --purge was requested, but remember that the owner explicitly removed
+    // the supervisor. Future updates must not infer an old service artifact and recreate it.
+    if (cfg) saveConfig({ ...cfg, serviceInstalled: false });
     if (flags.purge) {
-      const cfg = loadConfig(false);
       const specs = [PACKAGE_NAME, ...(cfg?.runtime?.packageName ? [cfg.runtime.packageName] : [])];
       run(npm.command, [...npm.args, 'uninstall', '--global', ...specs, '--no-audit', '--no-fund', '--loglevel=error']);
     }