@remcp/runtime 0.2.29 → 0.2.31

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## 0.2.30
+
+- **Unrestricted mode.** `REMCP_RUNTIME_UNRESTRICTED=1` (or `"unrestricted": true` in `runtime.json`,
+  or `remcp godmode on`) lifts the access roots, the configured command blocklist and the
+  catastrophic-command guardrail for this computer. It is not settable through MCP: `set_config_value`
+  still accepts only the four preferences it lists, so a model cannot widen its own reach.
+  `get_runtime_info` reports `policy.unrestricted` and says how to turn it off. Size limits
+  (`maxWriteBytes`, `maxOutputBytes`, line limits) are unchanged, and commands still run as the user
+  the agent runs as.
+
+## 0.2.29
+
+- Screenshot failures on GNOME Wayland name the tool that works (`gnome-screenshot`); previously the
+  message suggested `grim`, which cannot read a GNOME session at all.
+
+## 0.2.26
+
+- Screenshot failures explain the platform's own gate: Screen Recording on macOS, an interactive
+  session on Windows, `grim`/`gnome-screenshot` on Wayland, and "no graphical session" on a server.
+- A PNG above the inline limit is saved on the computer and the result says how to fetch it in
+  chunks, instead of failing the call.
+
+## 0.2.25
+
+- `EACCES`/`EPERM`/`EROFS`/`ENOSPC`/`EBUSY` from the file system are explained instead of printed
+  raw: macOS privacy folders (Full Disk Access for the exact `node` binary), Windows Controlled
+  folder access, Linux ownership, read-only mounts and full disks. Every filesystem failure in the
+  runtime goes through it.
+
 ## 0.2.20
 
 - `set_config_value`: a model may change this runtime’s own preferences (telemetry opt-out, read

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/runtime",
-  "version": "0.2.29",
+  "version": "0.2.31",
   "description": "First-party ReMCP local device runtime: file, search, terminal and process tools over MCP for computers paired with ReMCP.",
   "type": "module",
   "license": "MIT",

package/src/config.mjs

@@ -72,6 +72,19 @@ function dangerousMode(value, fallback = 'warn') {
 const allowedRoots = stringList(process.env.REMCP_RUNTIME_ALLOWED_ROOTS ?? file.allowedRoots)
   .map(root => path.resolve(expandHome(root)));
 
+// "Everything is allowed" mode. It is deliberately *not* settable through MCP: a model that could
+// widen its own reach would turn any prompt injection into root. The person at the computer turns it
+// on (environment variable, runtime.json, or `remcp godmode on`), and the runtime then reports it in
+// get_runtime_info so the model and the workspace can say so out loud.
+//
+// What it changes: no access-root confinement (allowedRoots becomes empty, which the path resolver
+// already reads as "the whole filesystem"), the configured command blocklist is ignored, and the
+// catastrophic-command guardrail is set to `allow`. What it does not change: the per-call size limits
+// (maxWriteBytes, maxOutputBytes, line limits) — they bound one call, not what a person may do — and
+// the fact that commands run as the user the agent runs as. To act as root, run the agent as root
+// (`sudo remcp install --system`) or start it under sudo.
+const unrestricted = booleanValue(process.env.REMCP_RUNTIME_UNRESTRICTED, booleanValue(file.unrestricted, false));
+
 // Telemetry is opt-out, matching the ReMCP client: it is on unless the user (or the
 // ReMCP agent that spawned this runtime) turns it off. It never sends file paths,
 // command strings, arguments, or tool output - only tool names, timings and outcomes.
@@ -85,9 +98,10 @@ const telemetryEnabled = telemetryDisabled
 const configuredOutputBytes = positiveNumber(process.env.REMCP_RUNTIME_MAX_OUTPUT_BYTES ?? file.maxOutputBytes, 2 * 1024 * 1024);
 
 export const runtimeConfig = Object.freeze({
-  allowedRoots: Object.freeze(allowedRoots),
-  blockedCommands: Object.freeze(stringList(process.env.REMCP_RUNTIME_BLOCKED_COMMANDS ?? file.blockedCommands)),
-  dangerousCommands: dangerousMode(process.env.REMCP_RUNTIME_DANGEROUS_COMMANDS ?? file.dangerousCommands),
+  unrestricted,
+  allowedRoots: Object.freeze(unrestricted ? [] : allowedRoots),
+  blockedCommands: Object.freeze(unrestricted ? [] : stringList(process.env.REMCP_RUNTIME_BLOCKED_COMMANDS ?? file.blockedCommands)),
+  dangerousCommands: unrestricted ? 'allow' : dangerousMode(process.env.REMCP_RUNTIME_DANGEROUS_COMMANDS ?? file.dangerousCommands),
   maxOutputBytes: Math.min(configuredOutputBytes, HARD_OUTPUT_CEILING_BYTES),
   maxReadLines: positiveNumber(process.env.REMCP_RUNTIME_MAX_READ_LINES ?? file.maxReadLines, 4000),
   maxBufferedLines: positiveNumber(process.env.REMCP_RUNTIME_MAX_BUFFERED_LINES ?? file.maxBufferedLines, 100000),

package/src/policy.mjs

@@ -66,6 +66,7 @@ function commandWord(segment) {
 }
 
 export function checkCommand(command) {
+  if (runtimeConfig.unrestricted) return { warned: false, mode: 'allow', unrestricted: true, findings: [] };
   const normalized = normalize(command);
   const parts = segments(normalized);
   const findings = [];

package/src/tools/stats.mjs

@@ -14,6 +14,11 @@ export async function getRuntimeInfoTool() {
     version: VERSION,
     runtime: describeConfig(),
     policy: {
+      // Reported first because it changes how everything below should be read.
+      unrestricted: runtimeConfig.unrestricted,
+      ...(runtimeConfig.unrestricted
+        ? { unrestrictedNote: 'Unrestricted mode is on for this computer: any path and any command is allowed, and commands still run as the user the agent runs as, so sudo needs your own sudoers rules. Turn it off with `remcp godmode off` (or REMCP_RUNTIME_UNRESTRICTED=0) and restart the agent.' }
+        : {}),
       allowedRoots: [...runtimeConfig.allowedRoots],
       blockedCommands: [...runtimeConfig.blockedCommands],
       dangerousCommands: runtimeConfig.dangerousCommands,