@remcp/runtime 0.2.190 → 0.2.191

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.2.191 — 2026-10-28
+
+- Correct the catastrophic-command heuristic for shell wrappers that consume option values, including sudo, nice, ionice, and env split-string.
+- Add no-side-effect guardrail regression cases; no new MCP tool or expanded device permission.
+- Make the short-process terminal assertion wait for the real exit event after buffered output without changing runtime I/O behavior.
+- This matcher is not a shell sandbox and cannot protect computers running with unrestricted God Mode; deployment still requires OS least-privilege mitigation.
+
 ## 0.2.190 — 2026-10-27
 
 - Publish the runtime alongside the compatible ReMCP agent; the device HTTPS network probe is agent-owned and does not add runtime MCP tools.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/runtime",
-  "version": "0.2.190",
+  "version": "0.2.191",
   "description": "First-party ReMCP local device runtime: filesystem, terminal, computer-use, browser, diagnostics and document tools over MCP.",
   "type": "module",
   "license": "MIT",

package/src/policy.mjs

@@ -60,19 +60,49 @@ function segments(command) {
     .filter(Boolean);
 }
 
+// A wrapper option may consume the following token. Dropping the option but
+// not its value makes the guardrail examine "root"/"10" instead of "rm".
+const WRAPPER_VALUE_FLAGS = Object.freeze({
+  sudo: new Set(['-u', '--user', '-g', '--group', '-h', '--host', '-p', '--prompt', '-C', '--close-from', '-D', '--chdir', '-R', '--chroot', '-T', '--command-timeout']),
+  doas: new Set(['-u']),
+  env: new Set(['-u', '--unset', '-C', '--chdir', '-S', '--split-string']),
+  nice: new Set(['-n', '--adjustment']),
+  ionice: new Set(['-c', '--class', '-n', '--classdata', '-p', '--pid', '-P', '--pgid', '-u', '--uid']),
+  stdbuf: new Set(['-i', '--input', '-o', '--output', '-e', '--error']),
+  timeout: new Set(['-s', '--signal', '-k', '--kill-after']),
+});
+
 function commandWord(segment) {
   const tokens = matchingText(segment).split(' ').filter(Boolean);
   while (tokens.length) {
     const token = tokens[0];
     if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(token)) { tokens.shift(); continue; }
     const tokenName = path.basename(token).replace(/\.(exe|cmd|bat)$/i, '').toLowerCase();
-    if (WRAPPERS.has(tokenName)) {
+    if (!WRAPPERS.has(tokenName)) break;
+    tokens.shift();
+    const valueFlags = WRAPPER_VALUE_FLAGS[tokenName];
+    while (tokens.length) {
+      const option = tokens[0];
+      if (option === '--') { tokens.shift(); break; }
+      if (tokenName === 'env' && /^[A-Za-z_][A-Za-z0-9_]*=/.test(option)) {
+        tokens.shift();
+        continue;
+      }
+      // env -S/--split-string executes its argument as command words; never
+      // discard that argument as an ordinary wrapper option value.
+      if (tokenName === 'env' && (option === '-S' || option === '--split-string')) {
+        tokens.shift();
+        break;
+      }
+      if (tokenName === 'env' && (option.startsWith('--split-string=') || /^-S.+/.test(option))) {
+        tokens[0] = option.startsWith('--split-string=') ? option.slice('--split-string='.length) : option.slice(2);
+        break;
+      }
+      if (!option.startsWith('-') || option === '-') break;
       tokens.shift();
-      while (tokens.length && tokens[0].startsWith('-')) tokens.shift();
-      if (tokenName === 'timeout' && tokens.length && /^\d+[smhd]?$/.test(tokens[0])) tokens.shift();
-      continue;
+      if (valueFlags?.has(option) && tokens.length) tokens.shift();
     }
-    break;
+    if (tokenName === 'timeout' && tokens.length && /^\d+(?:\.\d+)?[smhd]?$/.test(tokens[0])) tokens.shift();
   }
   const word = tokens[0] || '';
   return word.replace(/^.*[\\/]/, '').replace(/\.(exe|cmd|bat)$/i, '');