@remcp/runtime 0.2.46 → 0.2.48

package/src/mcp-v2.mjs

@@ -0,0 +1,104 @@
+import process from 'node:process';
+import { toolDefinitions, TEXT_OUTPUT_SCHEMA } from './catalog.mjs';
+import { advertisedExtendedTools, extendedToolDefinitions } from './extended/catalog.mjs';
+import { invokeTool } from './invoke.mjs';
+
+const DEFAULT_CAPABILITY_POLL_MS = 3000;
+
+function pollIntervalMs() {
+  const requested = Number(process.env.REMCP_CAPABILITY_POLL_MS);
+  return Math.min(60_000, Math.max(250, Number.isFinite(requested) && requested > 0 ? requested : DEFAULT_CAPABILITY_POLL_MS));
+}
+
+function toolConfig(definition, fromJsonSchema) {
+  return {
+    title: definition.title,
+    description: definition.description,
+    inputSchema: fromJsonSchema(definition.inputSchema || { type: 'object' }),
+    outputSchema: fromJsonSchema(definition.outputSchema || TEXT_OUTPUT_SCHEMA),
+    annotations: definition.annotations,
+  };
+}
+
+export async function startRuntimeMcpServer({ version, instructions, onError = () => {} } = {}) {
+  const [{ McpServer, fromJsonSchema }, { serveStdio }] = await Promise.all([
+    import('@modelcontextprotocol/server'),
+    import('@modelcontextprotocol/server/stdio'),
+  ]);
+
+  const initiallySupported = new Set((await advertisedExtendedTools()).map(tool => tool.name));
+  let activeServer = null;
+  let capabilityTimer = null;
+  let closed = false;
+
+  const serverHandle = serveStdio(() => {
+    const server = new McpServer(
+      { name: 'remcp-runtime', version },
+      {
+        capabilities: {
+          tools: { listChanged: true },
+          experimental: { 'remcp/telemetry': { version: 1, optOut: true } },
+        },
+        instructions,
+        cacheHints: {
+          'tools/list': { ttlMs: 1500, cacheScope: 'private' },
+          'server/discover': { ttlMs: 3000, cacheScope: 'private' },
+        },
+      },
+    );
+    activeServer = server;
+
+    const registrations = new Map();
+    for (const definition of [...toolDefinitions, ...extendedToolDefinitions]) {
+      const registered = server.registerTool(
+        definition.name,
+        toolConfig(definition, fromJsonSchema),
+        async (args, context) => invokeTool(definition.name, args || {}, { signal: context?.mcpReq?.signal }),
+      );
+      registrations.set(definition.name, registered);
+      if (extendedToolDefinitions.includes(definition) && !initiallySupported.has(definition.name)) registered.disable();
+    }
+
+    let lastSupported = initiallySupported;
+    capabilityTimer = setInterval(async () => {
+      if (closed) return;
+      try {
+        const next = new Set((await advertisedExtendedTools()).map(tool => tool.name));
+        for (const definition of extendedToolDefinitions) {
+          const before = lastSupported.has(definition.name);
+          const after = next.has(definition.name);
+          if (before === after) continue;
+          const registered = registrations.get(definition.name);
+          if (after) registered?.enable();
+          else registered?.disable();
+        }
+        lastSupported = next;
+      } catch (error) {
+        onError(error instanceof Error ? error : new Error(String(error)));
+      }
+    }, pollIntervalMs());
+    capabilityTimer.unref?.();
+
+    return server;
+  }, {
+    legacy: 'serve',
+    onerror(error) {
+      onError(error instanceof Error ? error : new Error(String(error)));
+    },
+  });
+
+  return {
+    async notification(notification) {
+      if (!activeServer) return;
+      await activeServer.server.notification(notification);
+    },
+    async close() {
+      if (closed) return;
+      closed = true;
+      if (capabilityTimer) clearInterval(capabilityTimer);
+      capabilityTimer = null;
+      await serverHandle.close();
+      activeServer = null;
+    },
+  };
+}

package/src/permissions.mjs

@@ -75,7 +75,7 @@ export function filesystemErrorExplanation(error, options = {}) {
     return `Windows Controlled folder access is blocking ${windowsLocation} (${code}). Add the binary that runs the tools (${execPath}) under Windows Security → Virus & threat protection → Ransomware protection → Allow an app through Controlled folder access, then restart the agent with \`remcp start\`. A folder outside Desktop, Documents, Downloads and OneDrive needs no new permission.`;
   }
   if (platform === 'darwin') {
-    return `macOS denied access to ${where} (${code}). Check the ownership and permissions of that folder, or add ${execPath} to System Settings → Privacy & Security → Full Disk Access and restart the agent with \`remcp start\`.`;
+    return `macOS denied access to ${where} (${code}). Check that this user owns the folder and its parents, or choose another path. If normal permissions are correct and macOS privacy still blocks it, add ${execPath} to System Settings → Privacy & Security → Full Disk Access and restart the agent with \`remcp start\`.`;
   }
   if (platform === 'win32') {
     return `Windows denied access to ${where} (${code}). Check whether the file is read-only, open in another program, or inside a Controlled folder access area, then allow ${execPath} through Windows Security (Controlled folder access) and restart the agent with \`remcp start\`.`;

package/src/util.mjs

@@ -88,8 +88,16 @@ function resolvedRoots() {
 // Canonical, allowlist-checked path for every file tool. The canonical path is what
 // callers must use, so a symlink cannot be swapped between the check and the access.
 export async function resolveSafePath(value, field = 'path') {
-  const absolute = resolveInputPath(value, field);
+  const raw = expandHome(requireString(value, field));
+  if (raw.includes('\0')) fail(`${field} contains an invalid character`);
+  const absolute = path.resolve(raw);
   if (!runtimeConfig.allowedRoots.length) return absolute;
+
+  // Canonicalize both sides before enforcing confinement. This matters on macOS where
+  // /var is a symlink to /private/var: a safe path returned by an earlier canonicalization
+  // must not be rejected merely because its lexical prefix differs from the configured root.
+  // Symlink escapes remain blocked because the final canonical target must still be inside
+  // one of the canonical allowed roots.
   const canonical = await canonicalizePath(absolute);
   const roots = await resolvedRoots();
   if (!roots.some(root => isInsideRoot(canonical, root))) {
@@ -145,6 +153,21 @@ export function text(value, isError = false) {
   return { content: [{ type: 'text', text: rendered }], structuredContent: { text: mirror }, ...(isError ? { isError: true } : {}) };
 }
 
+export function structured(value, fallbackText = null) {
+  const serialized = JSON.stringify(value);
+  const bytes = Buffer.byteLength(serialized ?? 'null', 'utf8');
+  const rendered = truncate(fallbackText == null ? JSON.stringify(value, null, 2) : String(fallbackText));
+  let structuredContent;
+  if (bytes > STRUCTURED_MIRROR_LIMIT_BYTES) {
+    structuredContent = { truncated: true, bytes, preview: rendered.slice(0, 2048) };
+  } else if (value && typeof value === 'object' && !Array.isArray(value)) {
+    structuredContent = value;
+  } else {
+    structuredContent = { data: value };
+  }
+  return { content: [{ type: 'text', text: rendered }], structuredContent };
+}
+
 export function image(data, mimeType) {
   return { type: 'image', data, mimeType };
 }