@remcp/runtime 0.2.0 → 0.2.5

package/src/catalog.mjs

@@ -28,6 +28,24 @@ export const toolDefinitions = [
     annotations: readOnly,
     handler: fileToolHandlers.read_file,
   },
+  {
+    name: 'read_files',
+    title: 'Read files by glob',
+    description: 'Read every file matching a glob under a directory in one call, each section prefixed with its path and line count. Use this to load a whole project area into context quickly instead of one read per file.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        path: { type: 'string', description: 'Absolute directory (or single file) to start from.' },
+        pattern: { type: 'string', description: 'Glob matched against the relative path and the file name, such as "src/**/*.ts" or "*.md". Default **/* .' },
+        max_files: { type: 'number', description: 'Stop after this many files. Default 100, maximum 500.' },
+        max_lines_per_file: { type: 'number', description: 'Lines kept per file. Default 2000.' },
+        include_ignored: { type: 'boolean', description: 'Also descend into .git and node_modules. Default false.' },
+      },
+      additionalProperties: false,
+    },
+    annotations: readOnly,
+    handler: fileToolHandlers.read_files,
+  },
   {
     name: 'read_multiple_files',
     title: 'Read multiple files',
@@ -43,15 +61,81 @@ export const toolDefinitions = [
     annotations: readOnly,
     handler: fileToolHandlers.read_multiple_files,
   },
+  {
+    name: 'read_image',
+    title: 'Read image',
+    description: 'Return an image file (PNG, JPEG, GIF, WebP, BMP, AVIF, or SVG) as a viewable image, so screenshots and diagrams can be inspected. Fails above the inline size limit.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        path: { type: 'string', description: 'Absolute path of the image file.' },
+      },
+      required: ['path'],
+      additionalProperties: false,
+    },
+    annotations: readOnly,
+    handler: fileToolHandlers.read_image,
+  },
+  {
+    name: 'read_binary',
+    title: 'Read binary chunk',
+    description: 'Read any file as base64, in chunks, for transferring binaries, images, archives, or documents off the computer. Returns size, offset, and nextOffsetBytes; call again with offset_bytes set to nextOffsetBytes until complete is true.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        path: { type: 'string', description: 'Absolute path of the file to read.' },
+        offset_bytes: { type: 'number', description: 'Byte offset to start at. Default 0.' },
+        length_bytes: { type: 'number', description: 'Chunk size in bytes. Default and maximum 1048576 (1 MiB).' },
+      },
+      required: ['path'],
+      additionalProperties: false,
+    },
+    annotations: readOnly,
+    handler: fileToolHandlers.read_binary,
+  },
+  {
+    name: 'write_binary',
+    title: 'Write binary chunk',
+    description: 'Write base64 data to a file byte for byte, creating parent directories. Use mode "append" to send a large file as consecutive chunks. Replaces the file by default.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        path: { type: 'string', description: 'Absolute path of the file to write.' },
+        data: { type: 'string', description: 'Base64-encoded content.' },
+        mode: { type: 'string', enum: ['rewrite', 'append'], description: 'rewrite replaces the file, append adds to the end. Default rewrite.' },
+      },
+      required: ['path', 'data'],
+      additionalProperties: false,
+    },
+    annotations: mutating,
+    handler: fileToolHandlers.write_binary,
+  },
+  {
+    name: 'hash_file',
+    title: 'Hash file',
+    description: 'Compute a checksum of a file without reading it into memory. Useful to verify a copy, compare two files, or confirm a download.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        path: { type: 'string', description: 'Absolute path of the file to hash.' },
+        algorithm: { type: 'string', enum: ['sha256', 'sha1', 'md5'], description: 'Hash algorithm. Default sha256.' },
+      },
+      required: ['path'],
+      additionalProperties: false,
+    },
+    annotations: readOnly,
+    handler: fileToolHandlers.hash_file,
+  },
   {
     name: 'list_directory',
     title: 'List directory',
-    description: 'List the files and directories at a path. Entries are prefixed with [DIR], [FILE], or [LINK]; depth controls how many directory levels are included.',
+    description: 'List the files and directories at a path. Entries are prefixed with [DIR], [FILE], [LINK], or [DENIED] when a subdirectory cannot be read. depth controls how many directory levels are included and pattern filters file names by glob.',
     inputSchema: {
       type: 'object',
       properties: {
         path: { type: 'string', description: 'Absolute path of the directory to list.' },
         depth: { type: 'number', description: 'Directory levels to list, from 1 to 5. Default 1.' },
+        pattern: { type: 'string', description: 'Optional glob that filters file names, such as "*.log". Directories are always listed.' },
       },
       required: ['path'],
       additionalProperties: false,
@@ -77,7 +161,7 @@ export const toolDefinitions = [
   {
     name: 'write_file',
     title: 'Write file',
-    description: 'Create a file or replace its full content. Parent directories are created automatically. Use mode "append" to add to the end instead of replacing the file.',
+    description: 'Create a file or change its full content. Parent directories are created automatically. Replaces the file by default; use mode "append" to add to the end. For binary data pass encoding-free base64 through write_binary instead.',
     inputSchema: {
       type: 'object',
       properties: {
@@ -91,10 +175,74 @@ export const toolDefinitions = [
     annotations: mutating,
     handler: fileToolHandlers.write_file,
   },
+  {
+    name: 'write_files',
+    title: 'Write multiple files',
+    description: 'Create or replace many files in one call, each with its own path, content, and optional mode. Use this to scaffold a project or apply a multi-file change without one round trip per file.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        files: {
+          type: 'array',
+          description: 'Files to write, at most 200 per call.',
+          items: {
+            type: 'object',
+            properties: {
+              path: { type: 'string', description: 'Absolute path of the file.' },
+              content: { type: 'string', description: 'Full file content.' },
+              mode: { type: 'string', enum: ['rewrite', 'append'], description: 'rewrite replaces the file (default), append adds to the end.' },
+            },
+            required: ['path', 'content'],
+            additionalProperties: false,
+          },
+        },
+      },
+      required: ['files'],
+      additionalProperties: false,
+    },
+    annotations: mutating,
+    handler: fileToolHandlers.write_files,
+  },
+  {
+    name: 'apply_patch',
+    title: 'Apply patch',
+    description: 'Apply a unified diff to one file or to several files at once, matching each hunk with a little fuzz so small offsets and whitespace differences still apply. This is the fastest way to land a multi-line change a model has already worked out. Pass dry_run to see the result as a diff first.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        patch: { type: 'string', description: 'Unified diff, including ---/+++ headers and @@ hunks.' },
+        path: { type: 'string', description: 'Apply every hunk to this file, ignoring the patch headers.' },
+        dry_run: { type: 'boolean', description: 'Report the diff without writing. Default false.' },
+      },
+      required: ['patch'],
+      additionalProperties: false,
+    },
+    annotations: mutating,
+    handler: fileToolHandlers.apply_patch,
+  },
+  {
+    name: 'set_permissions',
+    title: 'Set permissions',
+    description: 'Change the permission mode of a file or directory, optionally recursively and optionally with a numeric owner. Use this to make a script executable after writing it.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        path: { type: 'string', description: 'Absolute path whose permissions should change.' },
+        mode: { type: 'string', description: 'Octal mode such as "755" or "0644".' },
+        recursive: { type: 'boolean', description: 'Apply to a directory and everything inside it. Default false.' },
+        uid: { type: 'number', description: 'Optional numeric user id to set as owner.' },
+        gid: { type: 'number', description: 'Optional numeric group id to set as owner.' },
+      },
+      required: ['path', 'mode'],
+      additionalProperties: false,
+    },
+    annotations: mutating,
+    handler: fileToolHandlers.set_permissions,
+  },
   {
     name: 'edit_block',
     title: 'Edit file',
-    description: 'Replace an exact block of text in a file. Provide enough surrounding context to make old_string unique; the call fails unless the number of matches equals expected_replacements. When the exact text is not found, a whitespace-tolerant match is attempted and reported.',
+    description: 'Replace an exact block of text in a file. Provide enough surrounding context to make old_string unique; the call fails unless the number of matches equals expected_replacements. When the exact text is not found, a whitespace-tolerant match is attempted and reported. Pass dry_run to preview the change as a diff without writing.',
     inputSchema: {
       type: 'object',
       properties: {
@@ -103,6 +251,7 @@ export const toolDefinitions = [
         new_string: { type: 'string', description: 'Replacement text.' },
         expected_replacements: { type: 'number', description: 'Number of matches required for the edit to apply. Default 1.' },
         allow_fuzzy: { type: 'boolean', description: 'Allow a whitespace-tolerant fallback when the exact text is not found. Default true.' },
+        dry_run: { type: 'boolean', description: 'Return the diff without changing the file. Default false.' },
       },
       required: ['file_path', 'old_string', 'new_string'],
       additionalProperties: false,
@@ -110,16 +259,88 @@ export const toolDefinitions = [
     annotations: mutating,
     handler: fileToolHandlers.edit_block,
   },
+  {
+    name: 'replace_lines',
+    title: 'Replace lines',
+    description: 'Replace an inclusive 1-based line range with new text. The rest of the file, including its line endings, is preserved. Pass dry_run to preview the change as a diff without writing.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        path: { type: 'string', description: 'Absolute path of the file to edit.' },
+        start_line: { type: 'number', description: 'First line to replace, 1-based and inclusive.' },
+        end_line: { type: 'number', description: 'Last line to replace, 1-based and inclusive.' },
+        content: { type: 'string', description: 'Replacement text; an empty string deletes the range.' },
+        dry_run: { type: 'boolean', description: 'Return the diff without changing the file. Default false.' },
+      },
+      required: ['path', 'start_line', 'end_line', 'content'],
+      additionalProperties: false,
+    },
+    annotations: mutating,
+    handler: fileToolHandlers.replace_lines,
+  },
+  {
+    name: 'replace_in_files',
+    title: 'Replace in files',
+    description: 'Replace text or a regular expression across the text files under a path and report what changed. Applies immediately; pass dry_run true to preview the affected files first.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        path: { type: 'string', description: 'Absolute path of a file or directory to search.' },
+        pattern: { type: 'string', description: 'Text or regular expression to find.' },
+        replacement: { type: 'string', description: 'Replacement text. In regex mode, $1 and friends refer to capture groups.' },
+        filePattern: { type: 'string', description: 'Optional glob limiting which file names are changed, such as "*.ts".' },
+        regex: { type: 'boolean', description: 'Treat pattern as a regular expression. Default false (plain text).' },
+        dry_run: { type: 'boolean', description: 'Only report the files that would change. Default false.' },
+        maxFiles: { type: 'number', description: 'Stop after this many changed files. Default 100, maximum 500.' },
+      },
+      required: ['path', 'pattern', 'replacement'],
+      additionalProperties: false,
+    },
+    annotations: mutating,
+    handler: fileToolHandlers.replace_in_files,
+  },
+  {
+    name: 'diff_files',
+    title: 'Diff files',
+    description: 'Show a unified diff between two local text files, with line counts. Useful to check what changed before reporting or reverting it.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        left: { type: 'string', description: 'Absolute path of the original file.' },
+        right: { type: 'string', description: 'Absolute path of the file to compare against it.' },
+        context_lines: { type: 'number', description: 'Lines of context around each change. Default 3, maximum 20.' },
+      },
+      required: ['left', 'right'],
+      additionalProperties: false,
+    },
+    annotations: readOnly,
+    handler: fileToolHandlers.diff_files,
+  },
+  {
+    name: 'move_to_trash',
+    title: 'Move to trash',
+    description: 'Move a file or directory to the system trash instead of deleting it, so the change can be undone. When the trash is outside the device allowed roots, a .remcp-trash folder beside the file is used instead.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        source: { type: 'string', description: 'Absolute path to move to the trash.' },
+      },
+      required: ['source'],
+      additionalProperties: false,
+    },
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+    handler: fileToolHandlers.move_to_trash,
+  },
   {
     name: 'create_directory',
-    title: 'Create directory',
-    description: 'Create a directory, including any missing parent directories. Succeeds when the directory already exists.',
+    title: 'Create directories',
+    description: 'Create one directory or many in a single call, including any missing parent directories. Succeeds when a directory already exists.',
     inputSchema: {
       type: 'object',
       properties: {
         path: { type: 'string', description: 'Absolute path of the directory to create.' },
+        paths: { type: 'array', items: { type: 'string' }, description: 'Several directories to create at once, at most 200.' },
       },
-      required: ['path'],
       additionalProperties: false,
     },
     annotations: additive,
@@ -128,36 +349,173 @@ export const toolDefinitions = [
   {
     name: 'move_file',
     title: 'Move or rename',
-    description: 'Move or rename a file or directory. The call fails when the destination already exists, so nothing is overwritten.',
+    description: 'Move or rename a file or directory. Replaces an existing destination file by default; pass overwrite false to refuse instead.',
     inputSchema: {
       type: 'object',
       properties: {
         source: { type: 'string', description: 'Absolute path to move.' },
         destination: { type: 'string', description: 'Absolute destination path.' },
+        overwrite: { type: 'boolean', description: 'Replace an existing destination file. Default true.' },
       },
       required: ['source', 'destination'],
       additionalProperties: false,
     },
-    annotations: additive,
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
     handler: fileToolHandlers.move_file,
   },
   {
     name: 'copy_file',
     title: 'Copy file',
-    description: 'Copy one file to a new path. The call fails when the destination exists unless overwrite is true. Directories are not copied recursively.',
+    description: 'Copy one file to a new path, replacing the destination by default. Pass overwrite false to refuse an existing destination. Directories are not copied recursively.',
     inputSchema: {
       type: 'object',
       properties: {
         source: { type: 'string', description: 'Absolute path of the file to copy.' },
         destination: { type: 'string', description: 'Absolute destination path.' },
-        overwrite: { type: 'boolean', description: 'Replace the destination when it already exists. Default false.' },
+        overwrite: { type: 'boolean', description: 'Replace the destination when it already exists. Default true.' },
       },
       required: ['source', 'destination'],
       additionalProperties: false,
     },
-    annotations: additive,
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
     handler: fileToolHandlers.copy_file,
   },
+  {
+    name: 'copy_paths',
+    title: 'Copy paths',
+    description: 'Copy many files or whole directories in one call, each with its own source and destination. Directories are copied recursively.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        paths: {
+          type: 'array',
+          description: 'Pairs to copy, at most 200 per call.',
+          items: {
+            type: 'object',
+            properties: {
+              source: { type: 'string', description: 'Absolute path to copy.' },
+              destination: { type: 'string', description: 'Absolute destination path.' },
+            },
+            required: ['source', 'destination'],
+            additionalProperties: false,
+          },
+        },
+        overwrite: { type: 'boolean', description: 'Replace an existing destination. Default true.' },
+      },
+      required: ['paths'],
+      additionalProperties: false,
+    },
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+    handler: fileToolHandlers.copy_paths,
+  },
+  {
+    name: 'move_paths',
+    title: 'Move paths',
+    description: 'Move or rename many files or whole directories in one call, each with its own source and destination. Falls back to copy-and-delete across filesystems.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        paths: {
+          type: 'array',
+          description: 'Pairs to move, at most 200 per call.',
+          items: {
+            type: 'object',
+            properties: {
+              source: { type: 'string', description: 'Absolute path to move.' },
+              destination: { type: 'string', description: 'Absolute destination path.' },
+            },
+            required: ['source', 'destination'],
+            additionalProperties: false,
+          },
+        },
+        overwrite: { type: 'boolean', description: 'Replace an existing destination. Default true.' },
+      },
+      required: ['paths'],
+      additionalProperties: false,
+    },
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+    handler: fileToolHandlers.move_paths,
+  },
+  {
+    name: 'delete_path',
+    title: 'Delete path',
+    description: 'Delete a file or a directory on the computer. Directories are removed with their contents unless recursive is false. The filesystem root is refused.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        path: { type: 'string', description: 'Absolute path to delete.' },
+        recursive: { type: 'boolean', description: 'Delete a non-empty directory with its contents. Default true.' },
+      },
+      required: ['path'],
+      additionalProperties: false,
+    },
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+    handler: fileToolHandlers.delete_path,
+  },
+  {
+    name: 'delete_paths',
+    title: 'Delete paths',
+    description: 'Delete many files and directories in one call, reporting each result. Use move_to_trash instead when the deletion should be reversible.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        paths: { type: 'array', items: { type: 'string' }, description: 'Absolute paths to delete, at most 500 per call.' },
+        recursive: { type: 'boolean', description: 'Delete non-empty directories with their contents. Default true.' },
+      },
+      required: ['paths'],
+      additionalProperties: false,
+    },
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+    handler: fileToolHandlers.delete_paths,
+  },
+  {
+    name: 'create_archive',
+    title: 'Create archive',
+    description: 'Pack files and directories into a tar, tar.gz, or zip archive on the device, so a whole tree can be transferred or backed up in one call.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        paths: { type: 'array', items: { type: 'string' }, description: 'Absolute paths of the files and directories to include.' },
+        destination: { type: 'string', description: 'Absolute path of the archive to create.' },
+        format: { type: 'string', enum: ['tar', 'tar.gz', 'zip'], description: 'Archive format. Default tar.gz, or zip when the destination ends in .zip.' },
+      },
+      required: ['paths', 'destination'],
+      additionalProperties: false,
+    },
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+    handler: fileToolHandlers.create_archive,
+  },
+  {
+    name: 'extract_archive',
+    title: 'Extract archive',
+    description: 'Extract a tar, tar.gz, tar.bz2, tar.xz, or zip archive on the device into a directory, creating it when needed.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        archive: { type: 'string', description: 'Absolute path of the archive to extract.' },
+        destination: { type: 'string', description: 'Absolute directory to extract into. Defaults to the archive directory.' },
+      },
+      required: ['archive'],
+      additionalProperties: false,
+    },
+    annotations: mutating,
+    handler: fileToolHandlers.extract_archive,
+  },
+  {
+    name: 'take_screenshot',
+    title: 'Take screenshot',
+    description: 'Capture the screen of the paired computer and return it as an image, for GUI work, visual checks, and demonstrating what is on screen. Uses grim, gnome-screenshot, spectacle, scrot, ImageMagick import, screencapture, or PowerShell depending on the platform.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        directory: { type: 'string', description: 'Absolute directory to write the temporary PNG into. Defaults to the system temp directory.' },
+        keep: { type: 'boolean', description: 'Keep the PNG on disk instead of deleting it after it is returned. Default false.' },
+      },
+      additionalProperties: false,
+    },
+    annotations: readOnly,
+    handler: fileToolHandlers.take_screenshot,
+  },
   {
     name: 'start_search',
     title: 'Start search',
@@ -313,6 +671,14 @@ export const toolDefinitions = [
     annotations: readOnly,
     handler: terminalToolHandlers.list_sessions,
   },
+  {
+    name: 'get_system_info',
+    title: 'Get system info',
+    description: 'Report host details for the paired computer: operating system and kernel, CPU model and load, memory pressure, free disk space on the working volume, uptime, and the default shell.',
+    inputSchema: { type: 'object', properties: {}, additionalProperties: false },
+    annotations: readOnly,
+    handler: systemToolHandlers.get_system_info,
+  },
   {
     name: 'list_processes',
     title: 'List processes',

package/src/config.mjs

@@ -7,8 +7,35 @@ const configDir = process.env.REMCP_RUNTIME_CONFIG_DIR || path.join(os.homedir()
 export const runtimeConfigPath = path.join(configDir, 'runtime.json');
 export const runtimeConfigDir = configDir;
 
+// The MCP SDK's stdio client closes the connection on a message above 10 MB, which kills
+// this process. Keep the runtime's own output cap well below that so raising an env var
+// cannot turn a large tool result into a dead device.
+export const HARD_OUTPUT_CEILING_BYTES = 8 * 1024 * 1024;
+
+let configError = null;
+
 function readConfigFile() {
-  try { return JSON.parse(readFileSync(runtimeConfigPath, 'utf8')); } catch { return {}; }
+  let raw;
+  try {
+    raw = readFileSync(runtimeConfigPath, 'utf8');
+  } catch (error) {
+    if (error?.code === 'ENOENT') return {};
+    configError = `Could not read ${runtimeConfigPath}: ${error instanceof Error ? error.message : String(error)}`;
+    return {};
+  }
+  if (!raw.trim()) return {};
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+      configError = `${runtimeConfigPath} must contain a JSON object`;
+      return {};
+    }
+    return parsed;
+  } catch (error) {
+    // A trailing comma used to silently drop allowedRoots and re-enable usage metrics.
+    configError = `${runtimeConfigPath} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`;
+    return {};
+  }
 }
 
 const file = readConfigFile();
@@ -34,7 +61,10 @@ function booleanValue(value, fallback) {
 
 const DANGEROUS_MODES = ['block', 'warn', 'allow'];
 
-function dangerousMode(value, fallback = 'block') {
+// `warn` runs the command and adds a note when it matches the destructive-command list:
+// nothing is ever blocked or delayed, but a catastrophic command is visible in the tool
+// result. Set `allow` for zero noise or `block` to refuse.
+function dangerousMode(value, fallback = 'warn') {
   const normalized = String(value ?? '').trim().toLowerCase();
   return DANGEROUS_MODES.includes(normalized) ? normalized : fallback;
 }
@@ -50,19 +80,29 @@ const telemetryEnabled = telemetryDisabled
   ? false
   : booleanValue(process.env.REMCP_RUNTIME_TELEMETRY ?? file.telemetryEnabled, true);
 
+// 2 MiB of tool result per call by default: enough for a large file read or a batch of
+// files, still comfortably below the transport ceiling.
+const configuredOutputBytes = positiveNumber(process.env.REMCP_RUNTIME_MAX_OUTPUT_BYTES ?? file.maxOutputBytes, 2 * 1024 * 1024);
+
 export const runtimeConfig = Object.freeze({
   allowedRoots: Object.freeze(allowedRoots),
   blockedCommands: Object.freeze(stringList(process.env.REMCP_RUNTIME_BLOCKED_COMMANDS ?? file.blockedCommands)),
   dangerousCommands: dangerousMode(process.env.REMCP_RUNTIME_DANGEROUS_COMMANDS ?? file.dangerousCommands),
-  maxOutputBytes: positiveNumber(process.env.REMCP_RUNTIME_MAX_OUTPUT_BYTES ?? file.maxOutputBytes, 1024 * 1024),
-  maxReadLines: positiveNumber(process.env.REMCP_RUNTIME_MAX_READ_LINES ?? file.maxReadLines, 2000),
-  maxBufferedLines: positiveNumber(process.env.REMCP_RUNTIME_MAX_BUFFERED_LINES ?? file.maxBufferedLines, 50000),
+  maxOutputBytes: Math.min(configuredOutputBytes, HARD_OUTPUT_CEILING_BYTES),
+  maxReadLines: positiveNumber(process.env.REMCP_RUNTIME_MAX_READ_LINES ?? file.maxReadLines, 4000),
+  maxBufferedLines: positiveNumber(process.env.REMCP_RUNTIME_MAX_BUFFERED_LINES ?? file.maxBufferedLines, 100000),
   maxWriteBytes: positiveNumber(process.env.REMCP_RUNTIME_MAX_WRITE_BYTES ?? file.maxWriteBytes, 8 * 1024 * 1024),
   defaultShell: String(process.env.REMCP_RUNTIME_SHELL || file.defaultShell || '').trim(),
   name: String(process.env.REMCP_RUNTIME_NAME || file.name || os.hostname()).trim(),
   telemetryEnabled,
 });
 
+// A configuration the user cannot read is not a configuration we should quietly ignore:
+// it is how allowedRoots and an opt-out silently disappear.
+export function configurationError() {
+  return configError;
+}
+
 export function describeConfig() {
   return {
     name: runtimeConfig.name,
@@ -70,10 +110,12 @@ export function describeConfig() {
     arch: process.arch,
     node: process.versions.node,
     configFile: runtimeConfigPath,
+    configError,
     allowedRoots: [...runtimeConfig.allowedRoots],
     blockedCommands: [...runtimeConfig.blockedCommands],
     dangerousCommands: runtimeConfig.dangerousCommands,
     maxOutputBytes: runtimeConfig.maxOutputBytes,
+    maxOutputBytesCeiling: HARD_OUTPUT_CEILING_BYTES,
     maxReadLines: runtimeConfig.maxReadLines,
     maxBufferedLines: runtimeConfig.maxBufferedLines,
     maxWriteBytes: runtimeConfig.maxWriteBytes,

package/src/diff.mjs

@@ -0,0 +1,86 @@
+import { splitLines } from './util.mjs';
+
+// Compact line diff. Files routinely have a large identical prefix and suffix, so those
+// are trimmed first; the remaining window is diffed with an LCS table capped at a size
+// that keeps memory bounded on pathological input.
+
+const MAX_DIFF_LINES = 4000;
+const CONTEXT = 3;
+
+function commonPrefix(a, b) {
+  const limit = Math.min(a.length, b.length);
+  let index = 0;
+  while (index < limit && a[index] === b[index]) index += 1;
+  return index;
+}
+
+function commonSuffix(a, b, fromStart) {
+  const limit = Math.min(a.length, b.length) - fromStart;
+  let count = 0;
+  while (count < limit && a[a.length - 1 - count] === b[b.length - 1 - count]) count += 1;
+  return count;
+}
+
+function lcsOperations(a, b) {
+  const rows = a.length + 1;
+  const cols = b.length + 1;
+  const table = Array.from({ length: rows }, () => new Uint32Array(cols));
+  for (let i = a.length - 1; i >= 0; i -= 1) {
+    for (let j = b.length - 1; j >= 0; j -= 1) {
+      table[i][j] = a[i] === b[j] ? table[i + 1][j + 1] + 1 : Math.max(table[i + 1][j], table[i][j + 1]);
+    }
+  }
+  const operations = [];
+  let i = 0;
+  let j = 0;
+  while (i < a.length && j < b.length) {
+    if (a[i] === b[j]) { operations.push({ type: 'equal', line: a[i] }); i += 1; j += 1; }
+    else if (table[i + 1][j] >= table[i][j + 1]) { operations.push({ type: 'delete', line: a[i] }); i += 1; }
+    else { operations.push({ type: 'insert', line: b[j] }); j += 1; }
+  }
+  while (i < a.length) { operations.push({ type: 'delete', line: a[i] }); i += 1; }
+  while (j < b.length) { operations.push({ type: 'insert', line: b[j] }); j += 1; }
+  return operations;
+}
+
+export function diffStats(oldText, newText) {
+  const before = splitLines(oldText);
+  const after = splitLines(newText);
+  const prefix = commonPrefix(before, after);
+  const suffix = commonSuffix(before, after, prefix);
+  const middleBefore = before.slice(prefix, before.length - suffix);
+  const middleAfter = after.slice(prefix, after.length - suffix);
+  const operations = middleBefore.length > MAX_DIFF_LINES || middleAfter.length > MAX_DIFF_LINES
+    ? [...middleBefore.map(line => ({ type: 'delete', line })), ...middleAfter.map(line => ({ type: 'insert', line }))]
+    : lcsOperations(middleBefore, middleAfter);
+  return {
+    added: operations.filter(op => op.type === 'insert').length,
+    removed: operations.filter(op => op.type === 'delete').length,
+    truncated: middleBefore.length > MAX_DIFF_LINES || middleAfter.length > MAX_DIFF_LINES,
+  };
+}
+
+export function unifiedDiff(oldText, newText, { oldLabel = 'before', newLabel = 'after', context = CONTEXT } = {}) {
+  const before = splitLines(oldText);
+  const after = splitLines(newText);
+  if (before.join('\n') === after.join('\n')) return '';
+
+  const prefix = commonPrefix(before, after);
+  const suffix = commonSuffix(before, after, prefix);
+  const middleBefore = before.slice(prefix, before.length - suffix);
+  const middleAfter = after.slice(prefix, after.length - suffix);
+  const truncated = middleBefore.length > MAX_DIFF_LINES || middleAfter.length > MAX_DIFF_LINES;
+  const operations = truncated
+    ? [...middleBefore.map(line => ({ type: 'delete', line })), ...middleAfter.map(line => ({ type: 'insert', line }))]
+    : lcsOperations(middleBefore, middleAfter);
+
+  const rows = [];
+  for (let index = 0; index < Math.min(prefix, context); index += 1) rows.push({ type: 'equal', line: before[prefix - Math.min(prefix, context) + index] });
+  rows.push(...operations);
+  for (let index = 0; index < Math.min(suffix, context); index += 1) rows.push({ type: 'equal', line: before[before.length - suffix + index] });
+
+  const header = `--- ${oldLabel}\n+++ ${newLabel}`;
+  const body = rows.map(row => `${row.type === 'insert' ? '+' : row.type === 'delete' ? '-' : ' '}${row.line}`);
+  if (truncated) body.unshift('… diff truncated to the changed region (file is very large) …');
+  return [header, `@@ -${prefix + 1},${middleBefore.length} +${prefix + 1},${middleAfter.length} @@`, ...body].join('\n');
+}