@remcp/runtime 0.2.106 → 0.2.108

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.2.108 — 2026-09-25
+
+- Standalone production runtimes keep browser control disabled unless explicitly enabled; the authenticated paired agent enables its owned local runtime. IP-literal production allowlisting and persistent CDP guards cover page and worker sessions, delayed navigation, redirects, and subresources.
+- Archive and document operations use descriptor-bound Linux traversal where available; macOS/Windows preserve bounded source snapshots, canonical confinement, link/special-file rejection, and atomic staging through portable filesystem APIs instead of losing document/archive tools.
+- Linux semantic scroll/drag targets refresh accessibility geometry, and empty AT-SPI snapshots retry once before using the conservative depth fallback. Runtime tool names and schemas are unchanged.
+
 ## 0.2.106 — 2026-09-22
 
 - Wayland EIS records the emulated device used for each button press and sends the matching release through that same device, preventing cross-region/device drags from losing `pointerup`.

package/README.md

@@ -143,6 +143,12 @@ in `~/.config/remcp/runtime.json`. `--describe` always reports the current state
   agent. Browser control accepts only loopback CDP endpoints. The explicit `network` diagnostic can
   open a bounded TCP connection to a host/port, and shell/browser actions can reach the network when
   the requested operation itself requires it.
+- **Remote browser safety.** A standalone production runtime keeps browser control disabled unless
+  `REMCP_BROWSER_REMOTE_ENABLED=1`; the authenticated ReMCP device agent explicitly enables it for the local
+  runtime it owns. Production navigation requires an explicit `REMCP_BROWSER_ALLOWED_HOSTS` allowlist of IP
+  literals. Hostname navigation is refused unless `REMCP_BROWSER_ALLOW_DNS_REBIND=1` is set behind an external
+  DNS/egress boundary. Local navigation requires a separate `REMCP_BROWSER_ALLOW_LOCAL_NAVIGATION=1` opt-in,
+  and CDP request guards reject private, file, and WebSocket destinations.
 - **Optional confinement.** `allowedRoots` is empty by default. When you set it, it is enforced
   against the resolved real path of the deepest existing ancestor rather than the lexical string, so
   `<allowed>/link -> /etc` cannot be used to read or write outside the allowed directories.
@@ -159,6 +165,10 @@ in `~/.config/remcp/runtime.json`. `--describe` always reports the current state
   transport limit), writes are capped (`maxWriteBytes`), buffered session output is capped by both
   line count and total characters - a stream with no newlines cannot grow without limit - and reads
   are paged or chunked.
+- **Filesystem structural safety.** Archive and document snapshot/publication operations use
+  descriptor-bound directory traversal on Linux. macOS and Windows preserve the same bounded snapshot,
+  link/special-file rejection, canonical root confinement and atomic staging semantics, while using their
+  portable path APIs where Node does not expose directory-fd-relative open/rename/unlink primitives.
 - **Crash-resistant sessions.** A bogus shell, a closed stdin, or a dead parent cannot take the
   runtime down; sessions run in their own process group so `force_terminate` stops a whole pipeline;
   the agent restarts the runtime if it ever exits, so a device recovers instead of going silently
@@ -195,8 +205,10 @@ Optional settings live in `~/.config/remcp/runtime.json` (override the directory
 Every value can also be set with an environment variable: `REMCP_RUNTIME_ALLOWED_ROOTS`,
 `REMCP_RUNTIME_BLOCKED_COMMANDS`, `REMCP_RUNTIME_DANGEROUS_COMMANDS`, `REMCP_RUNTIME_TELEMETRY`,
 `REMCP_RUNTIME_DISABLE_TELEMETRY`, `REMCP_RUNTIME_MAX_OUTPUT_BYTES`, `REMCP_RUNTIME_MAX_READ_LINES`,
-`REMCP_RUNTIME_MAX_BUFFERED_LINES`, `REMCP_RUNTIME_MAX_WRITE_BYTES`, `REMCP_RUNTIME_SHELL`,
-`REMCP_RUNTIME_NAME`.
+  `REMCP_RUNTIME_MAX_BUFFERED_LINES`, `REMCP_RUNTIME_MAX_WRITE_BYTES`, `REMCP_RUNTIME_SHELL`,
+  `REMCP_RUNTIME_NAME`, `REMCP_BROWSER_REMOTE_ENABLED`, `REMCP_BROWSER_ALLOWED_HOSTS`,
+  `REMCP_BROWSER_ALLOW_LOCAL_NAVIGATION`, `REMCP_BROWSER_ALLOW_DNS_REBIND`.
+
 
 `allowedRoots` is empty by default, which means the paired device can reach anything the operating
 system user running the agent can reach. Set it when you want the device to be scoped to specific

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/runtime",
-  "version": "0.2.106",
+  "version": "0.2.108",
   "description": "First-party ReMCP local device runtime: filesystem, terminal, computer-use, browser, diagnostics and document tools over MCP.",
   "type": "module",
   "license": "MIT",
@@ -21,7 +21,7 @@
   "scripts": {
     "start": "node src/index.mjs",
     "check": "node scripts/check.mjs",
-    "test": "node --test test/*.test.mjs"
+    "test": "node --import ./test/setup.mjs --test test/*.test.mjs"
   },
   "dependencies": {
     "@jellybrick/dbus-next": "^0.11.3",

package/src/catalog.mjs

@@ -830,6 +830,14 @@ export const toolDefinitions = [
   },
 ];
 
+export function coreToolSupported(definition) {
+  return !['create_archive', 'extract_archive'].includes(definition.name) || process.platform === 'linux';
+}
+
+export function supportedCoreTools() {
+  return toolDefinitions.filter(coreToolSupported);
+}
+
 export function advertisedTools() {
   return toolDefinitions.map(({ name, title, description, inputSchema, annotations, outputSchema }) => ({
     name,

package/src/compact-catalog.mjs

@@ -1,4 +1,4 @@
-import { TEXT_OUTPUT_SCHEMA, toolDefinitions } from './catalog.mjs';
+import { TEXT_OUTPUT_SCHEMA, supportedCoreTools, toolDefinitions } from './catalog.mjs';
 import { advertisedExtendedTools, extendedToolDefinitions } from './extended/catalog.mjs';
 
 export const compactRuntimeGroups = Object.freeze({
@@ -127,7 +127,7 @@ function groupedDefinition(name, members) {
 export async function supportedRuntimeOperationNames() {
   const supportedExtended = new Set((await advertisedExtendedTools()).map(tool => tool.name));
   return new Set([
-    ...toolDefinitions.map(tool => tool.name),
+    ...supportedCoreTools().map(tool => tool.name),
     ...extendedToolDefinitions.filter(tool => supportedExtended.has(tool.name)).map(tool => tool.name),
   ]);
 }

package/src/config.mjs

@@ -1,6 +1,6 @@
 import os from 'node:os';
 import path from 'node:path';
-import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { chmodSync, lstatSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
 import { expandHome } from './util.mjs';
 
 const configDir = process.env.REMCP_RUNTIME_CONFIG_DIR || path.join(os.homedir(), '.config', 'remcp');
@@ -161,7 +161,17 @@ export function persistConfigValue(key, value) {
   const file = readConfigFile();
   const next = { ...file, [key]: value };
   mkdirSync(runtimeConfigDir, { recursive: true, mode: 0o700 });
-  writeFileSync(runtimeConfigPath, `${JSON.stringify(next, null, 2)}\n`, { mode: 0o600 });
+  const existing = lstatSync(runtimeConfigPath, { throwIfNoEntry: false });
+  if (existing && (existing.isSymbolicLink() || !existing.isFile())) throw new Error('runtime configuration path must be a regular file');
+  const temporary = `${runtimeConfigPath}.${process.pid}.${Date.now()}.tmp`;
+  try {
+    writeFileSync(temporary, `${JSON.stringify(next, null, 2)}\n`, { mode: 0o600, flag: 'wx' });
+    renameSync(temporary, runtimeConfigPath);
+    chmodSync(runtimeConfigPath, 0o600);
+  } catch (error) {
+    try { unlinkSync(temporary); } catch {}
+    throw error;
+  }
   return runtimeConfigPath;
 }
 

package/src/documents.mjs

@@ -14,6 +14,8 @@ import { inflateRawSync, inflateSync } from 'node:zlib';
 // Nothing here writes, and nothing leaves the computer.
 
 const MAX_INFLATE_BYTES = 32 * 1024 * 1024;
+const MAX_PDF_DECODED_BYTES = 128 * 1024 * 1024;
+const MAX_PDF_STREAMS = 10_000;
 
 function inflate(buffer, raw = false) {
   try {
@@ -260,6 +262,8 @@ function pdfTextPieces(content) {
 export function readPdfText(buffer) {
   const raw = buffer.toString('latin1');
   const chunks = [];
+  let decodedBytes = 0;
+  let streamCount = 0;
   let index = 0;
   while (index < raw.length) {
     const streamStart = raw.indexOf('stream', index);
@@ -271,6 +275,9 @@ export function readPdfText(buffer) {
     if (end < 0) break;
     const body = Buffer.from(raw.slice(start, end), 'latin1');
     const decoded = body.subarray(0, 5).toString('latin1') === '<?xml' ? body : (inflate(body) ?? inflate(body, true) ?? body);
+    decodedBytes += decoded.length;
+    streamCount += 1;
+    if (decodedBytes > MAX_PDF_DECODED_BYTES || streamCount > MAX_PDF_STREAMS) throw new Error('PDF decoded content exceeds the safety limit');
     chunks.push(decoded.toString('latin1'));
     index = end + 'endstream'.length;
   }