@remcp/runtime 0.2.0 → 0.2.5

package/src/tools/search.mjs

@@ -21,6 +21,9 @@ const MAX_PATTERN_LENGTH = 400;
 let ripgrepPath;
 
 function ripgrep() {
+  // REMCP_RUNTIME_FORCE_FALLBACK=1 exercises the dependency-free scanner even where
+  // ripgrep is installed, which is how CI covers both code paths.
+  if (process.env.REMCP_RUNTIME_FORCE_FALLBACK === '1') return null;
   if (ripgrepPath !== undefined) return ripgrepPath;
   try {
     const result = spawnSync('rg', ['--version'], { encoding: 'utf8' });
@@ -29,11 +32,13 @@ function ripgrep() {
   return ripgrepPath;
 }
 
-function normalizePattern(value, literal) {
+function normalizePattern(value, literal, ignoreCase) {
   const pattern = requireString(value, 'pattern');
   if (pattern.length > MAX_PATTERN_LENGTH) fail(`pattern must be at most ${MAX_PATTERN_LENGTH} characters`);
   if (literal) return { regex: null, literal: pattern, patternIsLiteral: true };
-  try { return { regex: new RegExp(pattern, 'g'), literal: null, patternIsLiteral: false }; } catch (error) {
+  // The flag has to be baked into the expression: the fallback scanner has no separate
+  // case-folding step, so `ignoreCase` used to be silently ignored without ripgrep.
+  try { return { regex: new RegExp(pattern, ignoreCase ? 'gi' : 'g'), literal: null, patternIsLiteral: false }; } catch (error) {
     // Silently downgrading an invalid regular expression to a substring search changes the
     // meaning of the call without telling anyone.
     fail(`pattern is not a valid regular expression (${error instanceof Error ? error.message : String(error)}). Pass literalSearch: true to search for this text literally.`);
@@ -92,7 +97,9 @@ function runRipgrep(session, { path: target, pattern, searchType, filePattern, i
   for (const glob of splitGlobs(filePattern)) args.push('-g', glob);
   if (searchType === 'files') {
     args.push('--files');
-    args.push('-g', fileNameGlob(pattern));
+    // Globs are case-sensitive even under --ignore-case, so a case-insensitive file
+    // search needs --iglob.
+    args.push(ignoreCase ? '--iglob' : '-g', fileNameGlob(pattern));
     args.push('--', target);
   } else {
     args.push('--line-number', '--with-filename');
@@ -180,7 +187,7 @@ export async function startSearchTool(args) {
   const includeIgnored = args.includeIgnored === true;
   const contextLines = clampInteger(args.contextLines, 0, 0, 10);
   const maxResults = clampInteger(args.maxResults, 200, 1, 5000);
-  const matcher = searchType === 'content' ? normalizePattern(pattern, args.literalSearch === true) : { regex: null, literal: pattern, patternIsLiteral: false };
+  const matcher = searchType === 'content' ? normalizePattern(pattern, args.literalSearch === true, ignoreCase) : { regex: null, literal: pattern, patternIsLiteral: false };
   const session = createSearchSession({ type: searchType, pattern, path: target, filePattern });
   countEvent('searchesStarted');
   recordEvent('session_started', { sessionKind: 'search', success: true });
@@ -189,7 +196,7 @@ export async function startSearchTool(args) {
   // only runs when ripgrep is unavailable.
   if (ripgrep()) runRipgrep(session, options);
   else void runFallback(session, options).catch(error => finishSearchSession(session, 'failed', error instanceof Error ? error.message : String(error)));
-  await waitForSearchResults(session, 1, 1500);
+  await waitForSearchResults(session, 1, 800);
   const initial = session.results.slice(0, 50);
   const status = session.error ? `failed: ${session.error}` : session.status;
   return text([

package/src/tools/system.mjs

@@ -1,6 +1,8 @@
+import os from 'node:os';
 import process from 'node:process';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
+import { runtimeConfig } from '../config.mjs';
 import { clampInteger, fail, requireInteger, text } from '../util.mjs';
 
 const run = promisify(execFile);
@@ -12,7 +14,61 @@ export function redactSecrets(command) {
   return String(command).replace(SECRET_FLAG, '$1$2***');
 }
 
-export async function listProcessesTool(args = {}) {
+async function diskUsage() {
+  if (process.platform === 'win32') return null;
+  try {
+    const { stdout } = await run('df', ['-kP', process.cwd()], { maxBuffer: 1024 * 1024 });
+    const line = stdout.trim().split('\n')[1];
+    if (!line) return null;
+    const parts = line.split(/\s+/);
+    const sizeKb = Number(parts[1]);
+    const usedKb = Number(parts[2]);
+    const availableKb = Number(parts[3]);
+    if (![sizeKb, usedKb, availableKb].every(Number.isFinite)) return null;
+    return {
+      mount: parts[5] || null,
+      totalBytes: sizeKb * 1024,
+      usedBytes: usedKb * 1024,
+      availableBytes: availableKb * 1024,
+      usedRatio: sizeKb ? Number((usedKb / sizeKb).toFixed(3)) : 0,
+    };
+  } catch {
+    return null;
+  }
+}
+
+export async function getSystemInfoTool() {
+  const cpus = os.cpus();
+  const totalMem = os.totalmem();
+  const freeMem = os.freemem();
+  const load = os.loadavg();
+  return text(JSON.stringify({
+    hostname: os.hostname(),
+    platform: process.platform,
+    release: os.release(),
+    arch: process.arch,
+    uptimeSeconds: Math.round(os.uptime()),
+    node: process.versions.node,
+    shell: runtimeConfig.defaultShell || (process.platform === 'win32' ? process.env.ComSpec : process.env.SHELL) || null,
+    cpu: {
+      model: cpus[0]?.model?.trim() || 'unknown',
+      count: cpus.length,
+      loadAverage: process.platform === 'win32' ? null : load.map(value => Number(value.toFixed(2))),
+      loadPerCore: process.platform === 'win32' || !cpus.length ? null : Number((load[0] / cpus.length).toFixed(2)),
+    },
+    memory: {
+      totalBytes: totalMem,
+      freeBytes: freeMem,
+      usedRatio: totalMem ? Number(((totalMem - freeMem) / totalMem).toFixed(3)) : 0,
+    },
+    disk: await diskUsage(),
+    home: os.homedir(),
+    tempDir: os.tmpdir(),
+    runtimeName: runtimeConfig.name,
+  }, null, 2));
+}
+
+export async function listProcessesTool(args) {
   const limit = clampInteger(args.limit, 100, 1, 1000);
   const rows = [];
   const parsed = [];
@@ -59,6 +115,7 @@ export async function killProcessTool(args) {
 }
 
 export const systemToolHandlers = {
+  get_system_info: getSystemInfoTool,
   list_processes: listProcessesTool,
   kill_process: killProcessTool,
 };

package/src/tools/terminal.mjs

@@ -2,11 +2,13 @@ import process from 'node:process';
 import { spawn } from 'node:child_process';
 import { runtimeConfig } from '../config.mjs';
 import { assertAllowedCommand } from '../policy.mjs';
-import { countEvent, recordEvent } from '../telemetry.mjs';
+import { recordEvent } from '../telemetry.mjs';
 import {
   appendProcessOutput,
   createProcessSession,
   getProcessSession,
+  hasNewOutput,
+  killSessionTree,
   listProcessSessions,
   markProcessExited,
   readNewOutput,
@@ -33,41 +35,66 @@ function describeSession(session) {
   return { pid: session.pid, status, runtimeMs: (session.finishedAt || Date.now()) - session.startedAt, lines: totalLines(session) };
 }
 
-export async function startProcessTool(args) {
+function abortError() {
+  return new Error('Tool call was cancelled by the client');
+}
+
+function throwIfAborted(signal) {
+  if (signal?.aborted) throw abortError();
+}
+
+export async function startProcessTool(args, extra = {}) {
   const command = requireString(args.command, 'command');
   const verdict = assertAllowedCommand(command);
-  if (verdict.warned) {
-    countEvent('policyBlocks');
-    recordEvent('policy_block', { reason: verdict.findings?.[0]?.id || 'builtin', success: false });
-  }
-  const timeoutMs = clampInteger(args.timeout_ms, 1000, 0, 120000);
+  const timeoutMs = clampInteger(args.timeout_ms, 500, 0, 120000);
   const shell = shellCommand();
+  // `detached` gives the child its own process group so a session can be stopped as a
+  // tree; a pipeline such as `sleep 20 | cat` otherwise survives force_terminate.
   const child = spawn(shell, shellArgs(command), {
     cwd: process.cwd(),
     env: process.env,
     stdio: ['pipe', 'pipe', 'pipe'],
     windowsHide: true,
+    detached: process.platform !== 'win32',
+  });
+  // The error listener has to exist before anything can throw: a bogus REMCP_RUNTIME_SHELL
+  // used to surface as an unhandled ENOENT that took the whole runtime down.
+  child.on('error', error => {
+    const session = child.remcpSession;
+    if (session) {
+      appendProcessOutput(session, `${error.message}\n`);
+      markProcessExited(session, null, null);
+    }
   });
-  if (!child.pid) fail('Could not start the command');
+  if (!child.pid) fail(`Could not start the command with ${shell}`);
   const session = createProcessSession({ pid: child.pid, child, command, shell });
+  child.remcpSession = session;
   recordEvent('session_started', { sessionKind: 'process', success: true });
+
+  if (child.stdin) {
+    child.stdin.on('error', () => {});
+    child.stdin.on('close', () => { session.stdinClosed = true; });
+  }
   child.stdout?.on('data', chunk => appendProcessOutput(session, chunk.toString('utf8')));
   child.stderr?.on('data', chunk => appendProcessOutput(session, chunk.toString('utf8')));
-  child.on('error', error => { appendProcessOutput(session, `${error.message}\n`); markProcessExited(session, null, null); });
+  // `exit` carries the real status; `close` only follows once every stdio stream is done,
+  // which for a backgrounded child can be seconds later.
+  child.on('exit', (code, signal) => markProcessExited(session, code, signal));
   child.on('close', (code, signal) => markProcessExited(session, code, signal));
+
   await waitForProcessExit(session, timeoutMs);
   const headline = session.exited
-    ? `Process ${session.pid} finished${session.exitCode === null ? '' : ` with code ${session.exitCode}`}.`
+    ? `Process ${session.pid} finished${session.exitCode === null ? '' : ` with code ${session.exitCode}`}${session.signal ? ` (${session.signal})` : ''}.`
     : `Process ${session.pid} is running.`;
   const output = session.lines.slice(-200).join('\n');
   const partial = session.partial;
   session.cursor = session.droppedLines + session.lines.length;
   session.lastPartialRead = session.partial || null;
-  const warning = verdict.warned ? `Warning: this command matches the built-in dangerous-command guardrail (${verdict.findings.map(item => item.description).join(', ')}).\n` : '';
+  const warning = verdict.note ? `${verdict.note}\n` : '';
   return text(`${warning}${[headline, output, partial].filter(Boolean).join('\n')}`);
 }
 
-export async function readProcessOutputTool(args) {
+export async function readProcessOutputTool(args, extra = {}) {
   const pid = requireInteger(args.pid, 'pid');
   const session = getProcessSession(pid);
   if (!session) fail(`No ReMCP session with pid ${pid}`);
@@ -76,16 +103,21 @@ export async function readProcessOutputTool(args) {
   let slice;
   let range;
   if (hasOffset) {
-    // An explicit offset always means a line range: zero-based from the first line the
-    // session produced, or a negative value for the last N lines. Omit the argument to get
-    // only the output produced since the previous read. Lines evicted by the buffer cap are
-    // gone, so the earliest readable line is droppedLines.
-    const requested = Number(args.offset);
-    const page = readOutputRange(session, requested, clampInteger(args.length, 200, 1, 5000));
+    // An explicit offset is a peek at a line range: it does not consume the new-output
+    // cursor, so a caller can look at the tail and still read everything afterwards.
+    // Zero-based from the first line the session produced; negative reads the last N.
+    const page = readOutputRange(session, Number(args.offset), clampInteger(args.length, 200, 1, 5000));
     slice = page.slice;
     range = `${page.start}-${page.end} of ${page.total}`;
   } else {
-    if (timeoutMs) await waitForProcessActivity(session, timeoutMs);
+    // Never sleep over output that is already buffered.
+    if (timeoutMs && !hasNewOutput(session)) {
+      const deadline = Date.now() + timeoutMs;
+      while (!hasNewOutput(session) && !session.exited && Date.now() < deadline) {
+        throwIfAborted(extra.signal);
+        await waitForProcessActivity(session, Math.min(200, Math.max(20, deadline - Date.now())));
+      }
+    }
     slice = readNewOutput(session);
     const first = Math.max(1, session.cursor - slice.length + 1);
     range = slice.length ? `${first}-${session.cursor} of ${totalLines(session)}` : `no new output (${totalLines(session)} lines total)`;
@@ -105,31 +137,37 @@ function waiterMatches(lines, matcher) {
   return lines.some(line => matcher.regex.test(line));
 }
 
-export async function waitForProcessOutputTool(args) {
+export async function waitForProcessOutputTool(args, extra = {}) {
   const pid = requireInteger(args.pid, 'pid');
   const session = getProcessSession(pid);
   if (!session) fail(`No ReMCP session with pid ${pid}`);
   const pattern = requireString(args.pattern, 'pattern');
   const matcher = compileWaiter(pattern);
   const timeoutMs = clampInteger(args.timeout_ms, 10000, 0, 120000);
-  const startLine = Math.max(0, session.cursor - session.droppedLines);
+  const cursorStart = Math.max(0, session.cursor - session.droppedLines);
+  // Output that was already buffered before the call still counts: a pattern printed
+  // earlier should answer immediately instead of spinning for the whole timeout.
+  let slice = session.lines.slice(cursorStart);
+  const bufferedMatch = waiterMatches(slice, matcher);
   const deadline = Date.now() + timeoutMs;
-  let slice = session.lines.slice(startLine);
-  while (!waiterMatches(slice, matcher) && Date.now() < deadline && !session.exited) {
-    await waitForProcessActivity(session, Math.min(250, Math.max(20, deadline - Date.now())));
-    slice = session.lines.slice(startLine);
+  if (!bufferedMatch) {
+    while (!waiterMatches(session.lines.slice(cursorStart), matcher) && Date.now() < deadline && !session.exited) {
+      throwIfAborted(extra.signal);
+      await waitForProcessActivity(session, Math.min(250, Math.max(20, deadline - Date.now())));
+    }
+    slice = session.lines.slice(cursorStart);
   }
   const matched = waiterMatches(slice, matcher);
   session.cursor = session.droppedLines + session.lines.length;
   session.lastPartialRead = session.partial || null;
   const status = describeSession(session);
   const headline = matched
-    ? `pid ${pid} ${status.status} · pattern matched`
+    ? `pid ${pid} ${status.status} · pattern matched${bufferedMatch ? ' (already buffered)' : ''}`
     : `pid ${pid} ${status.status} · pattern not matched within ${timeoutMs}ms`;
   return text([headline, slice.join('\n')].filter(Boolean).join('\n'));
 }
 
-export async function interactWithProcessTool(args) {
+export async function interactWithProcessTool(args, extra = {}) {
   const pid = requireInteger(args.pid, 'pid');
   const session = getProcessSession(pid);
   if (!session) fail(`No ReMCP session with pid ${pid}`);
@@ -138,8 +176,23 @@ export async function interactWithProcessTool(args) {
   const timeoutMs = clampInteger(args.timeout_ms, 1000, 0, 120000);
   session.cursor = session.droppedLines + session.lines.length;
   session.lastPartialRead = null;
-  session.child.stdin?.write(`${input}\n`);
-  await waitForProcessActivity(session, timeoutMs);
+  throwIfAborted(extra.signal);
+  const stdin = session.child?.stdin;
+  if (!stdin || stdin.destroyed || session.stdinClosed) {
+    fail(`Process ${pid} no longer accepts input`);
+  }
+  try {
+    stdin.write(`${input}\n`);
+  } catch (error) {
+    // A closed read end used to raise an async EPIPE that killed the runtime.
+    session.stdinClosed = true;
+    fail(`Could not write to process ${pid}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  const deadline = Date.now() + timeoutMs;
+  while (!hasNewOutput(session) && !session.exited && Date.now() < deadline) {
+    throwIfAborted(extra.signal);
+    await waitForProcessActivity(session, Math.min(200, Math.max(20, deadline - Date.now())));
+  }
   const slice = readNewOutput(session);
   const status = describeSession(session);
   return text([`pid ${pid} ${status.status}`, slice.join('\n')].filter(Boolean).join('\n'));
@@ -150,15 +203,15 @@ export async function forceTerminateTool(args) {
   const session = getProcessSession(pid);
   if (!session) fail(`No ReMCP session with pid ${pid}`);
   if (session.exited) return text(`Process ${pid} already exited.`);
-  try { session.child.kill('SIGTERM'); } catch {}
+  killSessionTree(session, 'SIGTERM');
   const deadline = Date.now() + 2000;
   while (!session.exited && Date.now() < deadline) await waitForProcessActivity(session, 100);
   if (!session.exited) {
-    try { session.child.kill('SIGKILL'); } catch {}
+    killSessionTree(session, 'SIGKILL');
     await waitForProcessActivity(session, 1000);
   }
   const status = describeSession(session);
-  return text(`Terminated session ${pid}. Status: ${status.status}.`);
+  return text(`Terminated session ${pid}${status.status.startsWith('exited') ? '' : ' (still running)'}. Status: ${status.status}.`);
 }
 
 export async function listSessionsTool() {

package/src/util.mjs

@@ -44,7 +44,11 @@ export function resolveInputPath(value, field = 'path') {
 }
 
 export function isInsideRoot(candidate, root) {
-  return candidate === root || candidate.startsWith(root + path.sep);
+  if (candidate === root) return true;
+  // `allowedRoots: ["/"]` is a legitimate way to say "the whole filesystem"; a naive
+  // `root + sep` check turns it into "//" and rejects every path.
+  const prefix = root.endsWith(path.sep) ? root : root + path.sep;
+  return candidate.startsWith(prefix);
 }
 
 function isInsideAnyRoot(candidate) {
@@ -113,6 +117,14 @@ export function text(value, isError = false) {
   return { content: [{ type: 'text', text: truncate(body) }], ...(isError ? { isError: true } : {}) };
 }
 
+export function image(data, mimeType) {
+  return { type: 'image', data, mimeType };
+}
+
+export function multi(parts) {
+  return { content: parts };
+}
+
 export function splitLines(value) {
   const normalized = String(value).replace(/\r\n/g, '\n').replace(/\r/g, '\n');
   if (normalized === '') return [];
@@ -125,6 +137,23 @@ export function looksBinary(buffer) {
   return buffer.subarray(0, 8000).includes(0);
 }
 
+// Text decoding that keeps Windows-authored files readable: UTF-16LE/BE with a BOM, and
+// UTF-8 with a BOM, are decoded rather than reported as binary.
+export function decodeText(buffer) {
+  if (buffer.length >= 2 && buffer[0] === 0xff && buffer[1] === 0xfe) {
+    return { text: buffer.subarray(2).toString('utf16le'), encoding: 'utf16le' };
+  }
+  if (buffer.length >= 2 && buffer[0] === 0xfe && buffer[1] === 0xff) {
+    const swapped = Buffer.from(buffer.subarray(2));
+    swapped.swap16();
+    return { text: swapped.toString('utf16le'), encoding: 'utf16be' };
+  }
+  if (buffer.length >= 3 && buffer[0] === 0xef && buffer[1] === 0xbb && buffer[2] === 0xbf) {
+    return { text: buffer.subarray(3).toString('utf8'), encoding: 'utf8bom' };
+  }
+  return { text: buffer.toString('utf8'), encoding: 'utf8' };
+}
+
 export function pageLines(lines, offset, length) {
   const total = lines.length;
   const requested = Math.trunc(offset || 0);
@@ -138,10 +167,13 @@ export function pageLines(lines, offset, length) {
 }
 
 export function globToRegExp(pattern) {
+  // `**/` may match no directory at all, so `**/*` also matches a file in the root.
   const escaped = String(pattern).replace(/[.+^${}()|[\]\\]/g, '\\$&')
+    .replace(/\*\*\//g, '\u0001')
     .replace(/\*\*/g, '\u0000')
     .replace(/\*/g, '[^/]*')
     .replace(/\?/g, '.')
-    .replace(/\u0000/g, '.*');
+    .replace(/\u0000/g, '.*')
+    .replace(/\u0001/g, '(?:.*/)?');
   return new RegExp(`^${escaped}$`);
 }