@remcp/remcp 0.2.9 → 0.2.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/remcp",
-  "version": "0.2.9",
+  "version": "0.2.10",
   "description": "ReMCP device client: pair a computer with ReMCP and run the outbound-only agent that hosts the local MCP runtime.",
   "type": "module",
   "license": "MIT",

package/src/agent.mjs

@@ -1,12 +1,12 @@
 import os from 'node:os';
-import { existsSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
 import path from 'node:path';
 import process from 'node:process';
 import { spawn, spawnSync } from 'node:child_process';
 import WebSocket from 'ws';
 import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
-import { normalizeRuntime } from './runtime.mjs';
+import { isRuntimeSpecFor, normalizeRuntime } from './runtime.mjs';
 import { VERSION } from './version.mjs';
 
 const npmCommand = process.platform === 'win32' ? 'npm.cmd' : 'npm';
@@ -82,18 +82,74 @@ function isNewer(candidate, current) {
 // What the agent should install, if anything. The client version alone is not enough: a machine
 // that already runs the newest client but an older local runtime would otherwise never catch up,
 // because its runtime is what executes the tools.
-export function updateDecision({ advertised, cliVersion, runtimeVersion }) {
+export function updateDecision({ advertised, cliVersion, runtimeVersion, runtimePackageName, runtimeDown = false }) {
   const cliSpec = String(advertised?.cli || '');
-  const runtimeSpec = String(advertised?.runtime || '');
+  const advertisedRuntime = String(advertised?.runtime || '');
+  // A spec that is not a plain version of the configured runtime package is ignored rather than
+  // installed: this is the only place a server-chosen string reaches npm.
+  const runtimeSpec = runtimePackageName && advertisedRuntime && !isRuntimeSpecFor(runtimePackageName, advertisedRuntime) ? '' : advertisedRuntime;
   const installedRuntime = String(runtimeVersion || '');
   const runtimeKnown = Boolean(installedRuntime) && !/^unknown$/i.test(installedRuntime);
   if (isNewer(cliSpec, cliVersion)) return { needed: true, target: cliSpec, runtime: runtimeSpec, reason: 'client' };
-  if (runtimeKnown && runtimeSpec && isNewer(runtimeSpec, installedRuntime)) {
+  if (runtimeSpec && runtimeKnown && isNewer(runtimeSpec, installedRuntime)) {
     return { needed: true, target: cliSpec || `@remcp/remcp@${cliVersion}`, runtime: runtimeSpec, reason: 'runtime' };
   }
+  // A runtime that never reported a version cannot be compared, so a device whose runtime is down
+  // (or was never installed) would never repair itself. The cooldown in checkForUpdate keeps this
+  // from becoming an install loop.
+  if (runtimeSpec && !runtimeKnown && runtimeDown) {
+    return { needed: true, target: cliSpec || `@remcp/remcp@${cliVersion}`, runtime: runtimeSpec, reason: 'runtime-repair' };
+  }
   return { needed: false, target: cliSpec, runtime: runtimeSpec, reason: 'current' };
 }
 
+// Applies a freshly installed version. Exiting is what a supervisor needs; without one the new CLI is
+// started in this process' place. Either way the agent stops holding a stale runtime, which is what
+// makes an update actually take effect on a machine that no service manager watches.
+async function restartToApplyUpdate(cli, stopAgent, markStopping) {
+  try {
+    const installed = globalInstalledVersion();
+    if (installed && !isNewer(installed, VERSION)) {
+      console.log(`ReMCP ${VERSION} is already the installed version; nothing to restart.`);
+      return;
+    }
+    console.log(`ReMCP ${installed || 'a newer version'} installed; restarting to apply it.`);
+    if (!supervisorRestart()) {
+      spawn(process.execPath, [cli, 'start'], { detached: true, stdio: 'ignore', env: { ...process.env } }).unref();
+    }
+    markStopping();
+    await stopAgent().catch(() => {});
+    setTimeout(() => process.exit(0), 100);
+  } catch (error) {
+    console.error(`Could not restart after the update: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+
+// The version of the globally installed client, read from the package the CLI resolves to.
+function globalInstalledVersion() {
+  try {
+    const cli = globalCliEntry();
+    if (!cli) return null;
+    const base = path.dirname(cli);
+    const candidates = [
+      path.join(base, '..', 'lib', 'node_modules', '@remcp', 'remcp', 'package.json'),
+      path.join(base, '..', 'node_modules', '@remcp', 'remcp', 'package.json'),
+    ];
+    for (const manifest of candidates) {
+      try { return JSON.parse(readFileSync(manifest, 'utf8')).version || null; } catch {}
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+function supervisorRestart() {
+  if (process.env.INVOCATION_ID || process.env.JOURNAL_STREAM) return 'systemd';
+  try { if (existsSync('/.dockerenv')) return 'docker'; } catch {}
+  return null;
+}
+
 function globalCliEntry() {
   const prefix = spawnSync(npmCommand, ['prefix', '--global'], { encoding: 'utf8' });
   if (prefix.error || prefix.status !== 0) return null;
@@ -146,7 +202,15 @@ export async function runAgent(options) {
   let runtimeDown = false;
   const telemetryQueue = [];
   let telemetryTimer = null;
-  const runtimeEntry = localRuntimeEntry(options.runtime);
+  // A device whose runtime is missing or unreadable must still run the agent: the agent is what
+  // installs and repairs the runtime, so failing here would remove the only path back.
+  let runtimeEntry = '';
+  try {
+    runtimeEntry = localRuntimeEntry(options.runtime);
+  } catch (error) {
+    runtimeDown = true;
+    console.error(`${error instanceof Error ? error.message : String(error)} The agent keeps running and retries; remcp update reinstalls the runtime.`);
+  }
 
   // --- local runtime supervision ------------------------------------------------------
   // If the runtime dies (a bad shell, a broken pipe, an OOM) the agent used to stay
@@ -324,10 +388,12 @@ export async function runAgent(options) {
         return;
       }
       if (code === 1012) {
-        // 1012 ('service restart') is what the relay sends when another agent process took over
-        // this device. Reconnecting immediately produced two agents evicting each other in a loop,
-        // so back off and let the surviving process keep the connection.
-        console.error('Another ReMCP agent connected for this device; this process will stop. Run one agent per machine (systemd service or `remcp start`).');
+        // 1012 ('service restart') is what the relay sends when another agent process took over this
+        // device. Staying alive would keep a second runtime and a reconnect loop, so this process
+        // stops and leaves the device to the agent that owns the connection.
+        console.error('Another ReMCP agent connected for this device; this process will stop. Run one agent per machine (a service manager or the remcp start command).');
+        stopping = true;
+        void stop().finally(() => setTimeout(() => process.exit(0), 100));
         return;
       }
       reconnects += 1;
@@ -358,7 +424,7 @@ export async function runAgent(options) {
       if (minimum && isNewer(minimum, VERSION)) {
         console.error(`ReMCP ${VERSION} is older than the minimum supported agent ${minimum}; update with: remcp update`);
       }
-      const decision = updateDecision({ advertised, cliVersion: VERSION, runtimeVersion });
+      const decision = updateDecision({ advertised, cliVersion: VERSION, runtimeVersion, runtimePackageName: options.runtime?.packageName, runtimeDown });
       if (!decision.needed) return;
       const target = decision.target;
       queueEvent({ event: 'agent_update', at: Date.now(), reason: `${decision.reason}:${target}`.slice(0, 32), success: true });
@@ -375,13 +441,34 @@ export async function runAgent(options) {
       lastAttemptAt = Date.now();
       updateInFlight = true;
       console.log(`Updating ReMCP to ${target}${decision.runtime ? ` with ${decision.runtime}` : ''} (${decision.reason})…`);
-      const child = spawn(process.execPath, [cli, 'update', '--trust-runtime', ...(decision.runtime ? ['--runtime', decision.runtime] : [])], {
+      // The trust flag is only forwarded when this machine's owner trusted the server at pairing
+      // time; otherwise the update stops at the server's own version and asks the user.
+      const trustFlag = options.trustRuntime === true ? ['--trust-runtime'] : [];
+      const child = spawn(process.execPath, [cli, 'update', ...trustFlag, ...(decision.runtime ? ['--runtime', decision.runtime] : [])], {
         detached: true,
-        stdio: 'ignore',
+        // The updater's own output is the only record of why an install failed, so it is piped back
+        // into this agent's log instead of being discarded.
+        stdio: ['ignore', 'pipe', 'pipe'],
         env: { ...process.env },
       });
-      child.on('exit', () => { updateInFlight = false; });
-      child.on('error', () => { updateInFlight = false; });
+      const forward = chunk => {
+        const line = String(chunk).trim();
+        if (line) console.error(`remcp update: ${line}`);
+      };
+      child.stdout?.on('data', forward);
+      child.stderr?.on('data', forward);
+      child.on('exit', code => {
+        updateInFlight = false;
+        if (code !== 0) {
+          console.error(`remcp update exited with ${code}; keeping ${VERSION} and retrying after the cooldown.`);
+          return;
+        }
+        void restartToApplyUpdate(cli, stop, () => { stopping = true; });
+      });
+      child.on('error', error => {
+        updateInFlight = false;
+        console.error(`remcp update could not start: ${error.message}`);
+      });
       child.unref();
     } catch {
       // Offline, DNS failure, older server without the endpoint: keep running as-is.

package/src/cli.mjs

@@ -5,7 +5,7 @@ import process from 'node:process';
 import { spawnSync } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
 import { runAgent } from './agent.mjs';
-import { normalizeRuntime } from './runtime.mjs';
+import { isRuntimeSpecFor, normalizeRuntime } from './runtime.mjs';
 import { PACKAGE_NAME, VERSION } from './version.mjs';
 
 const home = os.homedir();
@@ -200,12 +200,41 @@ function restartPersistentServiceIfInstalled() {
   if (platform === 'linux' && fs.existsSync(linuxServiceFile)) {
     run('systemctl', ['--user', 'daemon-reload']);
     run('systemctl', ['--user', 'restart', 'remcp-agent.service']);
-  } else if (platform === 'darwin' && fs.existsSync(macServiceFile)) {
+    return 'remcp-agent.service';
+  }
+  if (platform === 'darwin' && fs.existsSync(macServiceFile)) {
     run('launchctl', ['kickstart', '-k', `${macLaunchDomain()}/${macServiceLabel}`]);
-  } else if (platform === 'win32') {
+    return macServiceLabel;
+  }
+  if (platform === 'win32') {
     const result = spawnSync('schtasks.exe', ['/Query', '/TN', windowsTaskName], { stdio: 'ignore' });
-    if (result.status === 0) run('schtasks.exe', ['/Run', '/TN', windowsTaskName]);
+    if (result.status === 0) {
+      run('schtasks.exe', ['/Run', '/TN', windowsTaskName]);
+      return windowsTaskName;
+    }
   }
+  return null;
+}
+
+// The agent the user installed with `remcp install` is the one this CLI manages. A machine can also
+// be supervised by its own systemd unit, by Docker, or by a terminal, and in those cases installing
+// a new version is not enough: the running process keeps the old code until something restarts it.
+// systemd marks every unit process with INVOCATION_ID and Docker leaves /.dockerenv, so those two
+// cases can be handed over by exiting (the supervisor starts the new build); anything else gets an
+// explicit instruction instead of a silent exit that would take the device offline.
+function supervisorRestart() {
+  if (process.env.INVOCATION_ID || process.env.JOURNAL_STREAM) return 'systemd';
+  try { if (fs.existsSync('/.dockerenv')) return 'docker'; } catch {}
+  return null;
+}
+
+// Reads the version a freshly installed global package reports, so an update that installed
+// nothing (wrong prefix, npm cache, permissions) is reported instead of assumed successful.
+function installedVersion(packageName) {
+  const prefix = spawnSync(npmCommand, ['prefix', '--global'], { encoding: 'utf8' });
+  if (prefix.error || prefix.status !== 0) return null;
+  const manifest = path.join(String(prefix.stdout || '').trim(), 'lib', 'node_modules', ...packageName.split('/'), 'package.json');
+  try { return JSON.parse(fs.readFileSync(manifest, 'utf8')).version || null; } catch { return null; }
 }
 
 function uninstallPersistentService() {
@@ -262,6 +291,9 @@ export async function main(argv = process.argv.slice(2)) {
       deviceName: String(flags.name || os.hostname()),
       runtime: normalizeRuntime(paired.runtime),
       machineId: ensureMachineId(),
+      // Remember whether this machine's owner trusted the server to name a runtime version. The
+      // auto-updater must not widen that decision on its own later.
+      trustRuntime: Boolean(flags['trust-runtime']) || new URL(server).origin === officialOrigin,
     };
     saveConfig(config);
     console.log(`Paired ${os.hostname()} with ${server}`);
@@ -275,6 +307,9 @@ export async function main(argv = process.argv.slice(2)) {
     await runAgent({
       ...cfg,
       autoUpdate: cfg.autoUpdate !== false,
+      trustRuntime: cfg.trustRuntime === true
+        || process.env.REMCP_TRUST_RUNTIME === '1'
+        || new URL(cfg.serverUrl).origin === officialOrigin,
       telemetryEnabled: telemetry.enabled,
       installReported: telemetry.installReported,
       installSpec: `${PACKAGE_NAME}@${VERSION}`,
@@ -338,26 +373,50 @@ export async function main(argv = process.argv.slice(2)) {
     // parses, and an explicit --trust-runtime before a custom server may change it.
     let runtimeSpec = cfg.runtime.packageSpec;
     if (requested) {
-      const parsed = requested.match(/^(@?[a-z0-9._-]+(?:\/[a-z0-9._-]+)?)@(\S+)$/i);
-      if (!parsed) throw new Error('--runtime must look like @scope/package@1.2.3');
-      if (parsed[1] !== cfg.runtime.packageName) {
-        throw new Error(`--runtime must stay on ${cfg.runtime.packageName}; refusing to install ${parsed[1]}`);
+      // Only `<configured package>@<semver>` is installable: an alias, a git/URL/file spec, a tag or
+      // a range would run code the user never agreed to.
+      if (!isRuntimeSpecFor(cfg.runtime.packageName, requested)) {
+        throw new Error(`--runtime must be ${cfg.runtime.packageName}@<version>`);
       }
-      if (!flags['trust-runtime'] && !flags['yes']) {
-        throw new Error('Installing a runtime version from the server requires --trust-runtime.');
+      const trusted = cfg.trustRuntime === true
+        || Boolean(flags['trust-runtime'])
+        || process.env.REMCP_TRUST_RUNTIME === '1'
+        // A configuration written before the field existed paired with the official server, which is
+        // trusted by definition; refusing it would silently stop every existing device updating.
+        || new URL(cfg.serverUrl).origin === officialOrigin;
+      if (!trusted) {
+        throw new Error(`This machine was paired without trusting ${cfg.serverUrl} to choose a runtime version. Re-run with --trust-runtime if you trust that server.`);
       }
-      runtimeSpec = normalizeRuntime({ kind: 'npm', packageName: parsed[1], packageSpec: requested, entry: cfg.runtime.entry }).packageSpec;
+      runtimeSpec = normalizeRuntime({ kind: 'npm', packageName: cfg.runtime.packageName, packageSpec: requested, entry: cfg.runtime.entry }).packageSpec;
     }
     if (flags.check) {
-      console.log(JSON.stringify({ current: VERSION, runtime: cfg.runtime.packageSpec, available: `${PACKAGE_NAME}@latest` }, null, 2));
+      console.log(JSON.stringify({
+        current: VERSION,
+        installedRuntime: installedVersion(cfg.runtime.packageName),
+        runtimeSpec: runtimeSpec,
+        available: `${PACKAGE_NAME}@latest`,
+        managedService: fs.existsSync(linuxServiceFile) || fs.existsSync(macServiceFile),
+        supervisor: supervisorRestart() ?? 'none',
+      }, null, 2));
       return;
     }
+    const before = { cli: VERSION, runtime: installedVersion(cfg.runtime.packageName) };
     console.log(`Updating ReMCP to the latest published version (${runtimeSpec})…`);
     npmGlobalInstall(`${PACKAGE_NAME}@latest`, runtimeSpec);
     // Only a validated spec is persisted, so a failed update cannot leave the install unable to start.
     if (requested && runtimeSpec !== cfg.runtime.packageSpec) saveConfig({ ...cfg, runtime: { ...cfg.runtime, packageSpec: runtimeSpec } });
-    restartPersistentServiceIfInstalled();
-    console.log('ReMCP updated. Run `remcp --version` or `remcp status` to verify.');
+    const after = { cli: installedVersion(PACKAGE_NAME), runtime: installedVersion(cfg.runtime.packageName) };
+    const restarted = restartPersistentServiceIfInstalled();
+    if (restarted) {
+      console.log(`ReMCP updated and ${restarted} restarted (client ${before.cli} → ${after.cli ?? '?'}, runtime ${before.runtime ?? '?'} → ${after.runtime ?? '?'}).`);
+      return;
+    }
+    // This process is the updater, not the agent: exiting here would restart nothing. The agent sees
+    // the exit status, verifies the installed version, and restarts itself.
+    console.log(`ReMCP updated (client ${before.cli} → ${after.cli ?? '?'}, runtime ${before.runtime ?? '?'} → ${after.runtime ?? '?'}). The running agent restarts itself to apply it.`);
+    if (after.cli === before.cli && after.runtime === before.runtime) {
+      console.log('Nothing changed: the installed versions already match the requested ones.');
+    }
     return;
   }
 

package/src/runtime.mjs

@@ -1,7 +1,10 @@
 import path from 'node:path';
 
 const PACKAGE_NAME = /^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+$/i;
-const PACKAGE_SPEC = /^[^\s]+$/;
+// A runtime spec is a plain published version of one package. Anything else — an npm alias
+// (`npm:@other/pkg`), a git/https/file spec, a tag, or a version range — is a way to make a device
+// install and execute code the user never agreed to, so only `name@x.y.z[-pre][+build]` is accepted.
+const SEMVER = '\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?(?:\\+[0-9A-Za-z.-]+)?';
 
 export function normalizeRuntime(value) {
   if (!value || value.kind !== 'npm') throw new Error('Pairing server did not provide a supported local runtime');
@@ -9,7 +12,15 @@ export function normalizeRuntime(value) {
   const packageSpec = String(value.packageSpec || '');
   const entry = String(value.entry || '');
   if (!PACKAGE_NAME.test(packageName)) throw new Error('Pairing server returned an invalid runtime package name');
-  if (!PACKAGE_SPEC.test(packageSpec) || !packageSpec.startsWith(`${packageName}@`)) throw new Error('Pairing server returned an invalid runtime package spec');
+  if (!isRuntimeSpecFor(packageName, packageSpec)) throw new Error(`Runtime package spec must be ${packageName}@<version>`);
   if (!entry || path.isAbsolute(entry) || entry.split(/[\\/]+/).includes('..')) throw new Error('Pairing server returned an invalid runtime entry');
   return { kind: 'npm', packageName, packageSpec, entry };
 }
+
+// True only for `<packageName>@<semver>` of exactly that package. Exported so the CLI and the agent
+// can validate a server-advertised version without repeating the rule.
+export function isRuntimeSpecFor(packageName, packageSpec) {
+  if (!PACKAGE_NAME.test(String(packageName || ''))) return false;
+  const escaped = String(packageName).replace(/[.*+?^${}()|[\]\\/]/g, '\\$&');
+  return new RegExp(`^${escaped}@(${SEMVER})$`).test(String(packageSpec || ''));
+}