@remcp/runtime 0.2.215 → 0.2.217

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/runtime",
-  "version": "0.2.215",
+  "version": "0.2.217",
   "description": "First-party ReMCP local device runtime: filesystem, terminal, computer-use, browser, diagnostics and document tools over MCP.",
   "type": "module",
   "license": "MIT",

package/src/extended/desktop-computer-snapshot.mjs

@@ -16,19 +16,30 @@ import { findOcrText, ocrImage } from './ocr.mjs';
 import { boundedComputerSnapshot, clipboard, cursorPosition, displayInventory, listWindows, objectRecord, resultValue, screenshotRegion, snapshotError, suggestedUiAction, toolResultMessage, uiSnapshot } from './desktop-core.mjs';
 import { activeWindowCaptureBounds, browserTitleHint, computerScreenshotTask, hasExplicitComputerScreenshotTarget, ocrScreenshotResult } from './desktop-vision.mjs';
 
-// Several simultaneous Windows PowerShell starts can stall until their shared
-// timeout on low-core hosts, which made the whole snapshot report every probe
-// as unavailable. Queue the probes on Windows; other platforms stay parallel.
-export async function settleComputerSnapshotProbes(tasks, { serial = process.platform === 'win32' } = {}) {
-  if (!serial) return Promise.allSettled(tasks.map((task) => task()));
-  const results = [];
-  for (const task of tasks) {
-    try {
-      results.push({ status: 'fulfilled', value: await task() });
-    } catch (reason) {
-      results.push({ status: 'rejected', reason });
+// Four simultaneous Windows PowerShell starts can stall until their shared
+// timeout on low-core hosts, while two finish normally. Keep a small pool on
+// Windows so the snapshot stays under the relay timeout; other platforms stay
+// fully parallel.
+export async function settleComputerSnapshotProbes(tasks, {
+  concurrency = process.platform === 'win32' ? 2 : Math.max(tasks.length, 1),
+} = {}) {
+  const limit = Math.max(1, Math.min(Number(concurrency) || 1, tasks.length || 1));
+  if (limit >= tasks.length) return Promise.allSettled(tasks.map((task) => task()));
+  const results = new Array(tasks.length);
+  let next = 0;
+  const worker = async () => {
+    for (;;) {
+      const index = next;
+      next += 1;
+      if (index >= tasks.length) return;
+      try {
+        results[index] = { status: 'fulfilled', value: await tasks[index]() };
+      } catch (reason) {
+        results[index] = { status: 'rejected', reason };
+      }
     }
-  }
+  };
+  await Promise.all(Array.from({ length: limit }, () => worker()));
   return results;
 }
 

package/src/tools/files-secure-paths.mjs

@@ -3,7 +3,7 @@ import os from 'node:os';
 import { spawnSync } from 'node:child_process';
 import { createHash, randomUUID } from 'node:crypto';
 import { constants, createReadStream } from 'node:fs';
-import { access, chmod, chown, copyFile, cp, lstat, mkdir, mkdtemp, open, readFile, readdir, rename, rm, stat, unlink } from 'node:fs/promises';
+import { access, chmod, chown, copyFile, cp, lstat, mkdir, mkdtemp, open, readFile, readdir, realpath, rename, rm, stat, unlink } from 'node:fs/promises';
 import { pipeline } from 'node:stream/promises';
 import { liveConfig, runtimeConfig } from '../config.mjs';
 import { documentKind, readDocxText, readPdfText } from '../documents.mjs';
@@ -316,14 +316,43 @@ export async function openRegularFile(absolute, flags = READ_NOFOLLOW) {
   return openRegularFileAtPath(absolute, flags, absolute);
 }
 
+async function openLinuxDirectoryAnchor(absolute, options = {}) {
+  try {
+    return await openDirectoryPath(absolute, options);
+  } catch (error) {
+    if (runtimeConfig.allowedRoots.length) throw error;
+    // Unrestricted mode may traverse trusted links such as macOS-style aliases
+    // or user-created symlinked directories. Resolve only the anchor; returned
+    // tool paths stay lexical so the caller still sees the path it supplied.
+    if (options.create) await mkdir(absolute, { recursive:true }).catch(() => {});
+    const resolved = await realpath(absolute).catch(() => null);
+    if (!resolved) throw error;
+    return openDirectoryPath(resolved, options);
+  }
+}
+
+async function trustedNonLinuxDirectory(absolute, { create = false } = {}) {
+  if (create) await mkdir(absolute, { recursive: true });
+  const info = await lstat(absolute);
+  if (info.isSymbolicLink()) {
+    // With configured roots the path is already canonicalized; a remaining
+    // symlink component could be a confinement escape. Only unrestricted mode
+    // may follow trusted system links such as macOS /tmp -> /private/tmp.
+    if (runtimeConfig.allowedRoots.length) fail('Filesystem path component is not a directory');
+    const resolved = await realpath(absolute);
+    const target = await stat(resolved);
+    if (!target.isDirectory()) fail('Filesystem path component is not a directory');
+    return resolved;
+  }
+  if (!info.isDirectory()) fail('Filesystem path component is not a directory');
+  return absolute;
+}
+
 export async function openWritableParent(absolute, options = {}) {
   if (process.platform === 'linux' && constants.O_NOFOLLOW && constants.O_DIRECTORY) {
-    return openDirectoryPath(absolute, { create:true, ...options });
+    return openLinuxDirectoryAnchor(absolute, { create:true, ...options });
   }
-  await mkdir(absolute, { recursive:true });
-  const info = await lstat(absolute);
-  if (info.isSymbolicLink() || !info.isDirectory()) fail('Filesystem path component is not a directory');
-  return { anchor:absolute, close:async() => {} };
+  return { anchor: await trustedNonLinuxDirectory(absolute, { create:true }), close:async() => {} };
 }
 
 export async function writeResolvedFile(absolute, content, { append = false } = {}) {
@@ -352,11 +381,9 @@ export async function withWritableParent(absolute, callback) {
 
 export async function openExistingParent(absolute) {
   if (process.platform === 'linux' && constants.O_NOFOLLOW && constants.O_DIRECTORY) {
-    return openDirectoryPath(absolute);
+    return openLinuxDirectoryAnchor(absolute);
   }
-  const info = await lstat(absolute);
-  if (info.isSymbolicLink() || !info.isDirectory()) fail('Filesystem path component is not a directory');
-  return { anchor:absolute, close:async() => {} };
+  return { anchor: await trustedNonLinuxDirectory(absolute), close:async() => {} };
 }
 
 export async function withExistingParent(absolute, callback) {
@@ -370,13 +397,11 @@ export async function withExistingParent(absolute, callback) {
 
 export async function ensureDirectoryPath(absolute, options = {}) {
   if (process.platform === 'linux' && constants.O_NOFOLLOW && constants.O_DIRECTORY) {
-    const directory = await openDirectoryPath(absolute, { create:true, ...options });
+    const directory = await openLinuxDirectoryAnchor(absolute, { create:true, ...options });
     await directory.close();
     return;
   }
-  await mkdir(absolute, { recursive:true });
-  const info = await lstat(absolute);
-  if (info.isSymbolicLink() || !info.isDirectory()) fail('Filesystem path component is not a directory');
+  await trustedNonLinuxDirectory(absolute, { create:true });
 }
 
 export async function readRegularBuffer(absolute, maxBytes = Infinity) {

package/src/tools/system.mjs

@@ -111,7 +111,7 @@ export async function listProcessesTool(args) {
     }
     parsed.sort((a, b) => b.cpu - a.cpu || b.mem - a.mem);
   }
-  rows.push('pid,ppid,cpu%,mem%,elapsed,command');
+  rows.push(process.platform === 'win32' ? 'name,pid,session,mem' : 'pid,ppid,cpu%,mem%,elapsed,command');
   rows.push(...parsed.slice(0, limit).map(entry => entry.row));
   if (parsed.length > limit) rows.push(`… ${parsed.length - limit} more processes hidden; call list_processes with a higher limit to see them`);
   return text(rows.join('\n'));