@remcp/runtime 0.2.0 → 0.2.5

package/src/index.mjs

@@ -3,7 +3,7 @@ import process from 'node:process';
 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
 import { toolDefinitions } from './catalog.mjs';
-import { describeConfig, runtimeConfigDir } from './config.mjs';
+import { describeConfig, configurationError, runtimeConfigDir } from './config.mjs';
 import { invokeTool } from './invoke.mjs';
 import { shutdownSessions, startSessionSweeper } from './sessions.mjs';
 import { flush, setTelemetrySink, shutdownTelemetry, telemetryEnabled } from './telemetry.mjs';
@@ -49,6 +49,15 @@ if (args.includes('--describe')) {
   process.exit(0);
 }
 
+// A configuration file the user cannot read must not be ignored: that is how allowedRoots
+// and an opt-out quietly disappear. Metadata commands above still work, so an operator can
+// inspect the device; the server itself refuses to start.
+const configProblem = configurationError();
+if (configProblem) {
+  console.error(`ReMCP runtime refuses to start: ${configProblem}`);
+  process.exit(2);
+}
+
 function announceTelemetryOnce() {
   if (!telemetryEnabled()) return;
   const marker = path.join(runtimeConfigDir, '.telemetry-notice');
@@ -81,8 +90,8 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
   tools: toolDefinitions.map(({ name, title, description, inputSchema, annotations }) => ({ name, title, description, inputSchema, annotations })),
 }));
 
-server.setRequestHandler(CallToolRequestSchema, async request => {
-  return invokeTool(request.params.name, request.params.arguments);
+server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
+  return invokeTool(request.params.name, request.params.arguments, extra);
 });
 
 // Telemetry leaves this process only as an MCP notification to the agent that started
@@ -91,17 +100,41 @@ setTelemetrySink(async payload => {
   await server.notification({ method: 'notifications/remcp/telemetry', params: payload });
 });
 
+const SHUTDOWN_BUDGET_MS = 1500;
+let shutdownStarted = false;
+
 async function shutdown(code = 0) {
+  if (shutdownStarted) return;
+  shutdownStarted = true;
+  const deadline = Date.now() + SHUTDOWN_BUDGET_MS;
   shutdownSessions();
-  try { await flush(); } catch {}
-  shutdownTelemetry();
+  // The SDK gives a closing server about two seconds before it kills the process, so the
+  // telemetry flush is bounded and awaited instead of fire-and-forget: an unawaited
+  // notification() after close is an unhandled rejection.
+  try {
+    await Promise.race([flush(), new Promise(resolve => setTimeout(resolve, Math.max(0, deadline - Date.now())))]);
+  } catch {}
+  await shutdownTelemetry();
   try { await server.close(); } catch {}
   process.exit(code);
 }
 
+// A dead agent leaves a broken stdout pipe. Without this the process died on an
+// uncaught EPIPE with a stack trace and left its terminal children behind.
+process.stdout.on('error', error => {
+  if (error?.code === 'EPIPE' || error?.code === 'ERR_STREAM_DESTROYED') void shutdown(0);
+  else console.error(`ReMCP runtime stdout error: ${error instanceof Error ? error.message : String(error)}`);
+});
+process.on('uncaughtException', error => {
+  console.error(`ReMCP runtime uncaught exception: ${error instanceof Error ? error.stack || error.message : String(error)}`);
+  void shutdown(1);
+});
+process.on('unhandledRejection', reason => {
+  console.error(`ReMCP runtime unhandled rejection: ${reason instanceof Error ? reason.stack || reason.message : String(reason)}`);
+});
 process.on('SIGINT', () => void shutdown(0));
 process.on('SIGTERM', () => void shutdown(0));
-process.on('exit', () => { shutdownSessions(); shutdownTelemetry(); });
+process.on('exit', () => { shutdownSessions(); });
 
 const transport = new StdioServerTransport();
 await server.connect(transport);

package/src/invoke.mjs

@@ -12,15 +12,18 @@ function errorKind(error) {
   return typeof code === 'string' && code ? code.slice(0, 32) : 'runtime_error';
 }
 
-export async function invokeTool(name, args = {}) {
+export async function invokeTool(name, args = {}, extra = {}) {
   const started = performance.now();
   const definition = toolHandlers.get(name);
   if (!definition) {
     recordEvent('tool_call', { tool: 'unknown_tool', success: false, errorKind: 'unknown_tool', durationMs: 0 });
     return text(`Unknown tool: ${name}`, true);
   }
+  if (extra?.signal?.aborted) {
+    return text(`Tool ${name} was cancelled by the client before it started.`, true);
+  }
   try {
-    const result = await definition.handler(args || {});
+    const result = await definition.handler(args || {}, extra || {});
     recordEvent('tool_call', { tool: definition.name, durationMs: performance.now() - started, success: result?.isError !== true });
     return result;
   } catch (error) {

package/src/patch.mjs

@@ -0,0 +1,95 @@
+import { splitLines } from './util.mjs';
+
+// Minimal unified-diff applier. Models produce `--- a/file` / `+++ b/file` patches with
+// `@@ -start,count +start,count @@` hunks; applying them directly is far more reliable
+// than asking a model to re-send whole files or exact blocks.
+
+const HUNK_HEADER = /^@@\s+-(\d+)(?:,(\d+))?\s+\+(\d+)(?:,(\d+))?\s+@@/;
+
+export function parseUnifiedDiff(patch) {
+  const lines = String(patch).replace(/\r\n/g, '\n').split('\n');
+  const files = [];
+  let current = null;
+  let hunk = null;
+  for (const line of lines) {
+    if (line.startsWith('--- ')) {
+      current = { oldPath: line.slice(4).trim(), newPath: null, hunks: [] };
+      files.push(current);
+      hunk = null;
+      continue;
+    }
+    if (line.startsWith('+++ ')) {
+      if (current) current.newPath = line.slice(4).trim();
+      continue;
+    }
+    const header = line.match(HUNK_HEADER);
+    if (header) {
+      if (!current) { current = { oldPath: null, newPath: null, hunks: [] }; files.push(current); }
+      hunk = {
+        oldStart: Number(header[1]),
+        oldCount: header[2] === undefined ? 1 : Number(header[2]),
+        newStart: Number(header[3]),
+        newCount: header[4] === undefined ? 1 : Number(header[4]),
+        lines: [],
+      };
+      current.hunks.push(hunk);
+      continue;
+    }
+    if (!hunk) continue;
+    if (line.startsWith('\\')) continue; // ""
+    if (line === '' && hunk.lines.length === 0) continue;
+    const marker = line[0];
+    if (marker === ' ' || marker === '+' || marker === '-') hunk.lines.push({ type: marker, text: line.slice(1) });
+  }
+  return files.filter(file => file.hunks.length);
+}
+
+function normalize(line) {
+  return String(line).replace(/[ \t]+/g, ' ').trim();
+}
+
+// Find the block a hunk expects, allowing for a few lines of drift and for whitespace
+// differences, the same way patch(1) does with fuzz.
+function locate(lines, hunk) {
+  const expected = hunk.lines.filter(entry => entry.type !== '+').map(entry => entry.text);
+  if (!expected.length) return { index: hunk.oldStart - 1, fuzz: 0 };
+  const candidates = [];
+  const anchor = Math.max(0, hunk.oldStart - 1);
+  for (let offset = 0; offset <= 200; offset += 1) {
+    for (const index of offset === 0 ? [anchor] : [anchor - offset, anchor + offset]) {
+      if (index < 0 || index + expected.length > lines.length) continue;
+      const window = lines.slice(index, index + expected.length);
+      if (window.every((line, position) => line === expected[position])) candidates.push({ index, fuzz: offset });
+      else if (window.every((line, position) => normalize(line) === normalize(expected[position]))) candidates.push({ index, fuzz: offset + 1000 });
+    }
+    if (candidates.length) break;
+  }
+  if (!candidates.length) return null;
+  candidates.sort((a, b) => a.fuzz - b.fuzz || a.index - b.index);
+  return candidates[0];
+}
+
+export function applyHunks(content, hunks) {
+  const eol = content.includes('\r\n') ? '\r\n' : '\n';
+  const endsWithNewline = /\n$/.test(content);
+  const lines = splitLines(content);
+  const applied = [];
+  const failed = [];
+  // Apply from the bottom of the file upwards so earlier hunks keep their line numbers.
+  const ordered = [...hunks].sort((a, b) => b.oldStart - a.oldStart);
+  for (const hunk of ordered) {
+    const found = locate(lines, hunk);
+    if (!found) { failed.push(hunk); continue; }
+    let cursor = found.index;
+    const replacement = [];
+    for (const entry of hunk.lines) {
+      if (entry.type === ' ') { replacement.push(lines[cursor]); cursor += 1; continue; }
+      if (entry.type === '-') { cursor += 1; continue; }
+      replacement.push(entry.text);
+    }
+    lines.splice(found.index, cursor - found.index, ...replacement);
+    applied.push({ hunk, fuzz: found.fuzz });
+  }
+  const updated = `${lines.join(eol)}${endsWithNewline && lines.length ? eol : ''}`;
+  return { updated, applied, failed };
+}

package/src/policy.mjs

@@ -1,38 +1,84 @@
 import { runtimeConfig } from './config.mjs';
+import { recordEvent } from './telemetry.mjs';
 import { fail } from './util.mjs';
 
-// Catastrophic host-level commands that a remote model should never run by accident.
-// This is a guardrail, not a sandbox: it protects against obvious mistakes and
-// prompt-injected one-liners, not against a determined adversary who already has
-// shell access through the paired account.
-const DANGEROUS_PATTERNS = [
-  { id: 'filesystem-format', description: 'formats a filesystem', pattern: /\bmkfs(\.[a-z0-9]+)?\b/i },
-  { id: 'raw-disk-write', description: 'writes raw data to a block device', pattern: /\bdd\b[^\n]*\bof=\s*\/dev\//i },
-  { id: 'disk-partition', description: 'repartitions a disk', pattern: /\b(fdisk|sfdisk|cfdisk|parted|diskpart)\b/i },
-  { id: 'redirect-to-device', description: 'redirects output into a block device', pattern: />>?\s*\/dev\/(sd|hd|vd|nvme|mmcblk|disk)/i },
-  { id: 'host-power', description: 'powers off or reboots the machine', pattern: /\b(shutdown|reboot|halt|poweroff)\b/i },
-  { id: 'init-runlevel', description: 'changes the init runlevel', pattern: /\binit\s+[06]\b/i },
-  { id: 'fork-bomb', description: 'starts a fork bomb', pattern: /:\s*\(\s*\)\s*\{[^}]*\}\s*;\s*:/ },
-  { id: 'recursive-root-delete', description: 'recursively deletes a root or home path', pattern: /\brm\b(?=[^\n]*\s-[a-z]*r)(?=[^\n]*\s-[a-z]*f)[^\n]*\s(\/|\/\*|~|\$HOME|\$\{HOME\})(\s|$)/i },
-  { id: 'chmod-root', description: 'recursively rewrites permissions on a root path', pattern: /\bchmod\b[^\n]*\s(\/|\/\*)(\s|$)/i },
-  { id: 'chown-root', description: 'recursively rewrites ownership on a root path', pattern: /\bchown\b[^\n]*\s(\/|\/\*)(\s|$)/i },
-  { id: 'history-rewrite', description: 'clears shell history to hide activity', pattern: /\b(history\s+-c|shred\b[^\n]*\.bash_history|>\s*~?\/?\.bash_history)/i },
-  { id: 'windows-destructive', description: 'destroys Windows system state', pattern: /\b(format|diskpart|bcdedit|cipher\s+\/w)\b/i },
+// Optional hardening rules for catastrophic host-level commands. The default is `allow`:
+// ReMCP is a remote-control tool for computers you own, and the agent needs to be able to
+// do anything you could do at a shell. Deployments that want a safety net can set
+// `dangerousCommands` to `warn` (run and report) or `block` (refuse before running).
+//
+// Rules are matched against the *command word* of each shell segment, so a read-only
+// command that merely mentions a dangerous word (`grep -n format README.md`,
+// `cat notes/shutdown.md`) is not refused.
+const WRAPPERS = new Set(['sudo', 'doas', 'env', 'nohup', 'command', 'builtin', 'time', 'nice', 'ionice', 'stdbuf', 'timeout', 'setsid', 'exec']);
+
+const DANGEROUS_RULES = [
+  { id: 'filesystem-format', description: 'formats a filesystem', commands: /^mkfs(\.[a-z0-9]+)?$/i, args: () => true },
+  { id: 'raw-disk-write', description: 'writes raw data to a block device', commands: /^dd$/i, args: segment => /\bof=\s*\/dev\//i.test(segment) || /\bof=\s*\\\\\.\\/i.test(segment) },
+  { id: 'disk-partition', description: 'repartitions a disk', commands: /^(fdisk|sfdisk|cfdisk|parted|diskpart|gdisk)$/i, args: () => true },
+  { id: 'redirect-to-device', description: 'redirects output into a block device', commands: null, anySegment: />>?\s*\/dev\/(sd|hd|vd|nvme|mmcblk|disk)/i },
+  { id: 'host-power', description: 'powers off or reboots the machine', commands: /^(shutdown|reboot|halt|poweroff|restart-computer|stop-computer)$/i, args: () => true },
+  { id: 'init-runlevel', description: 'changes the init runlevel', commands: /^init$/i, args: segment => /\binit\s+[06]\b/i.test(segment) },
+  { id: 'fork-bomb', description: 'starts a fork bomb', commands: null, anySegment: /:\s*\(\s*\)\s*\{[^}]*\}\s*;\s*:/ },
+  {
+    id: 'recursive-root-delete',
+    description: 'recursively deletes a root or home path',
+    commands: /^rm$/i,
+    args: segment => /(^|\s)-[a-z]*r[a-z]*(\s|$)/i.test(segment)
+      && /(^|\s)-[a-z]*f[a-z]*(\s|$)/i.test(segment)
+      && /(\s)(\/|\/\*|~|~\/\*|\$HOME|\$\{HOME\})(\s|$)/i.test(segment),
+  },
+  { id: 'chmod-root', description: 'recursively rewrites permissions on a root path', commands: /^chmod$/i, args: segment => /(\s)(\/|\/\*)(\s|$)/.test(segment) },
+  { id: 'chown-root', description: 'recursively rewrites ownership on a root path', commands: /^chown$/i, args: segment => /(\s)(\/|\/\*)(\s|$)/.test(segment) },
+  { id: 'history-rewrite', description: 'clears shell history to hide activity', commands: /^(history|shred)$/i, args: segment => /history\s+-c/.test(segment) || /\.(bash_)?history/.test(segment) },
+  { id: 'windows-destructive', description: 'destroys Windows system state', commands: /^(format|bcdedit|diskpart)$/i, args: () => true },
+  { id: 'windows-cipher-wipe', description: 'wipes free space on a Windows volume', commands: /^cipher$/i, args: segment => /\/w\b/i.test(segment) },
 ];
 
 function normalize(command) {
   return String(command).replace(/\s+/g, ' ').trim();
 }
 
+// Split on shell control operators so each simple command is judged on its own command
+// word instead of on every word in the line.
+function segments(command) {
+  return normalize(command)
+    .split(/&&|\|\||[;|\n]/)
+    .map(part => part.trim())
+    .filter(Boolean);
+}
+
+function commandWord(segment) {
+  const tokens = segment.split(' ').filter(Boolean);
+  while (tokens.length) {
+    const token = tokens[0];
+    if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(token)) { tokens.shift(); continue; }
+    if (WRAPPERS.has(token.toLowerCase())) {
+      tokens.shift();
+      while (tokens.length && tokens[0].startsWith('-')) tokens.shift();
+      if (token.toLowerCase() === 'timeout' && tokens.length && /^\d+[smhd]?$/.test(tokens[0])) tokens.shift();
+      continue;
+    }
+    break;
+  }
+  const word = tokens[0] || '';
+  return word.replace(/^.*[\\/]/, '').replace(/\.(exe|cmd|bat)$/i, '');
+}
+
 export function checkCommand(command) {
   const normalized = normalize(command);
+  const parts = segments(normalized);
   const findings = [];
   for (const blocked of runtimeConfig.blockedCommands) {
     if (normalized.toLowerCase().includes(blocked.toLowerCase())) findings.push({ id: 'policy', description: blocked, source: 'device-policy' });
   }
   if (runtimeConfig.dangerousCommands !== 'allow') {
-    for (const entry of DANGEROUS_PATTERNS) {
-      if (entry.pattern.test(normalized)) findings.push({ id: entry.id, description: entry.description, source: 'builtin' });
+    for (const part of parts) {
+      const word = commandWord(part);
+      for (const rule of DANGEROUS_RULES) {
+        const matches = rule.anySegment ? rule.anySegment.test(part) : Boolean(word && rule.commands?.test(word) && rule.args(part));
+        if (matches) findings.push({ id: rule.id, description: rule.description, source: 'builtin' });
+      }
     }
   }
   if (!findings.length) return { warned: false, mode: runtimeConfig.dangerousCommands };
@@ -49,7 +95,12 @@ export function assertAllowedCommand(command) {
     const detail = verdict.findings.map(item => item.description).join(', ');
     fail(`Command blocked by ReMCP device policy (${detail}). Set REMCP_RUNTIME_BLOCKED_COMMANDS to adjust the device list, or REMCP_RUNTIME_DANGEROUS_COMMANDS=allow to disable the built-in catastrophic-command guardrail.`);
   }
+  if (verdict.warned) {
+    const detail = verdict.findings.map(item => item.description).join(', ');
+    recordEvent('policy_warning', { reason: verdict.findings[0]?.id || 'builtin', success: true });
+    return { ...verdict, note: `Note: this command matches the optional destructive-command guardrail (${detail}). It was executed.` };
+  }
   return verdict;
 }
 
-export const dangerousPatternIds = DANGEROUS_PATTERNS.map(entry => entry.id);
+export const dangerousPatternIds = DANGEROUS_RULES.map(entry => entry.id);

package/src/sessions.mjs

@@ -1,3 +1,4 @@
+import process from 'node:process';
 import { runtimeConfig } from './config.mjs';
 
 const processSessions = new Map();
@@ -5,12 +6,28 @@ const searchSessions = new Map();
 let searchCounter = 0;
 
 const EXITED_SESSION_TTL_MS = 30 * 60 * 1000;
+// A stream with no newlines (a minified bundle, `yes`, a binary accidentally catted)
+// used to grow `partial` without bound: 40 MB measured, then a RangeError inside the
+// data handler killed the runtime. Split long partials and cap the retained characters.
+const MAX_PARTIAL_BYTES = 64 * 1024;
+const MAX_BUFFERED_CHARS = 8 * 1024 * 1024;
 
 function trimBuffer(session) {
   const overflow = session.lines.length - runtimeConfig.maxBufferedLines;
-  if (overflow <= 0) return;
-  session.lines.splice(0, overflow);
-  session.droppedLines += overflow;
+  if (overflow > 0) {
+    const removed = session.lines.splice(0, overflow);
+    for (const line of removed) session.bufferedChars -= line.length;
+    session.droppedLines += overflow;
+  }
+  while (session.bufferedChars > MAX_BUFFERED_CHARS && session.lines.length > 0) {
+    session.bufferedChars -= session.lines.shift().length;
+    session.droppedLines += 1;
+  }
+}
+
+function pushLine(session, line) {
+  session.lines.push(line);
+  session.bufferedChars += line.length;
 }
 
 function notify(session) {
@@ -49,6 +66,7 @@ export function createProcessSession({ pid, child, command, shell }) {
     partial: '',
     lastPartialRead: null,
     droppedLines: 0,
+    bufferedChars: 0,
     cursor: 0,
     exitCode: null,
     signal: null,
@@ -60,25 +78,35 @@ export function createProcessSession({ pid, child, command, shell }) {
   return session;
 }
 
+function drainPartial(session) {  while (session.partial.length > MAX_PARTIAL_BYTES) {
+    pushLine(session, session.partial.slice(0, MAX_PARTIAL_BYTES));
+    session.partial = session.partial.slice(MAX_PARTIAL_BYTES);
+    session.partialSplit = true;
+  }
+}
+
 export function appendProcessOutput(session, chunk) {
   const combined = session.partial + chunk;
   const parts = combined.split('\n');
   session.partial = parts.pop() ?? '';
-  for (const line of parts) session.lines.push(line);
+  for (const line of parts) pushLine(session, line);
+  drainPartial(session);
   trimBuffer(session);
   session.lastActivityAt = Date.now();
   notify(session);
 }
 
 export function markProcessExited(session, code, signal) {
+  if (session.exited) return;
   if (session.partial) {
-    session.lines.push(session.partial);
+    pushLine(session, session.partial);
     session.partial = '';
   }
   session.exited = true;
   session.exitCode = code;
   session.signal = signal;
   session.finishedAt = Date.now();
+  trimBuffer(session);
   notify(session);
 }
 
@@ -100,7 +128,8 @@ export function totalLines(session) {
 }
 
 export function readNewOutput(session) {
-  const complete = session.lines.slice(Math.max(0, session.cursor - session.droppedLines));
+  const from = Math.max(0, session.cursor - session.droppedLines);
+  const complete = session.lines.slice(from);
   session.cursor = session.droppedLines + session.lines.length;
   const parts = [...complete];
   if (session.partial && session.partial !== session.lastPartialRead) parts.push(session.partial);
@@ -108,6 +137,13 @@ export function readNewOutput(session) {
   return parts;
 }
 
+export function hasNewOutput(session) {
+  if (session.cursor < session.droppedLines + session.lines.length) return true;
+  return Boolean(session.partial && session.partial !== session.lastPartialRead);
+}
+
+// A ranged read is a peek: it must not consume the new-output cursor, or reading a tail
+// makes the lines before it undeliverable.
 export function readOutputRange(session, offset, length) {
   const snapshot = session.lines.concat(session.partial ? [session.partial] : []);
   const total = session.droppedLines + snapshot.length;
@@ -121,7 +157,6 @@ export function readOutputRange(session, offset, length) {
     start = Math.max(0, Math.min(requested - session.droppedLines, snapshot.length));
     end = Math.min(snapshot.length, start + Math.max(1, Math.trunc(length || 200)));
   }
-  session.cursor = session.droppedLines + session.lines.length;
   return { slice: snapshot.slice(start, end), start: session.droppedLines + start + 1, end: session.droppedLines + end, total };
 }
 
@@ -204,12 +239,25 @@ export function startSessionSweeper(intervalMs = 5 * 60 * 1000) {
   sweepTimer.unref?.();
 }
 
+// The child is spawned detached on POSIX so it owns a process group; killing the group
+// takes the whole tree with it (`sleep 20 | cat` used to survive `force_terminate`).
+export function killSessionTree(session, signal = 'SIGKILL') {
+  const child = session.child;
+  if (!child || session.exited) return false;
+  try {
+    if (process.platform === 'win32') return child.kill(signal);
+    if (child.pid) process.kill(-child.pid, signal);
+    else return child.kill(signal);
+    return true;
+  } catch {
+    try { return child.kill(signal); } catch { return false; }
+  }
+}
+
 export function shutdownSessions() {
   if (sweepTimer) { clearInterval(sweepTimer); sweepTimer = null; }
   for (const session of processSessions.values()) {
-    if (!session.exited) {
-      try { session.child.kill('SIGKILL'); } catch {}
-    }
+    if (!session.exited) killSessionTree(session, 'SIGKILL');
   }
   for (const session of searchSessions.values()) {
     if (session.status === 'running' && session.cancel) {

package/src/telemetry.mjs

@@ -135,12 +135,26 @@ export async function flush() {
   }
 }
 
-export function shutdownTelemetry() {
+export async function shutdownTelemetry() {
   if (state.timer) {
     clearInterval(state.timer);
     state.timer = null;
   }
-  try { state.sink?.({ runtimeVersion: VERSION, platform: process.platform, arch: process.arch, name: runtimeConfig.name, events: state.buffer.splice(0, state.buffer.length) }); } catch {}
+  const sink = state.sink;
+  state.sink = null;
+  const events = state.buffer.splice(0, state.buffer.length);
+  if (!sink || !events.length) return;
+  try {
+    // Bounded: the SDK closes the transport about two seconds after shutdown starts, and a
+    // notification sent after that is a rejected promise nobody awaits.
+    await Promise.race([
+      sink({ runtimeVersion: VERSION, platform: process.platform, arch: process.arch, name: runtimeConfig.name, events }),
+      new Promise(resolve => setTimeout(resolve, 500)),
+    ]);
+    state.sent += events.length;
+  } catch {
+    state.dropped += events.length;
+  }
 }
 
 export function resetTelemetryForTests() {