@remcp/runtime 0.2.47 → 0.2.49

package/src/mcp-v2.mjs

@@ -0,0 +1,104 @@
+import process from 'node:process';
+import { toolDefinitions, TEXT_OUTPUT_SCHEMA } from './catalog.mjs';
+import { advertisedExtendedTools, extendedToolDefinitions } from './extended/catalog.mjs';
+import { invokeTool } from './invoke.mjs';
+
+const DEFAULT_CAPABILITY_POLL_MS = 3000;
+
+function pollIntervalMs() {
+  const requested = Number(process.env.REMCP_CAPABILITY_POLL_MS);
+  return Math.min(60_000, Math.max(250, Number.isFinite(requested) && requested > 0 ? requested : DEFAULT_CAPABILITY_POLL_MS));
+}
+
+function toolConfig(definition, fromJsonSchema) {
+  return {
+    title: definition.title,
+    description: definition.description,
+    inputSchema: fromJsonSchema(definition.inputSchema || { type: 'object' }),
+    outputSchema: fromJsonSchema(definition.outputSchema || TEXT_OUTPUT_SCHEMA),
+    annotations: definition.annotations,
+  };
+}
+
+export async function startRuntimeMcpServer({ version, instructions, onError = () => {} } = {}) {
+  const [{ McpServer, fromJsonSchema }, { serveStdio }] = await Promise.all([
+    import('@modelcontextprotocol/server'),
+    import('@modelcontextprotocol/server/stdio'),
+  ]);
+
+  const initiallySupported = new Set((await advertisedExtendedTools()).map(tool => tool.name));
+  let activeServer = null;
+  let capabilityTimer = null;
+  let closed = false;
+
+  const serverHandle = serveStdio(() => {
+    const server = new McpServer(
+      { name: 'remcp-runtime', version },
+      {
+        capabilities: {
+          tools: { listChanged: true },
+          experimental: { 'remcp/telemetry': { version: 1, optOut: true } },
+        },
+        instructions,
+        cacheHints: {
+          'tools/list': { ttlMs: 1500, cacheScope: 'private' },
+          'server/discover': { ttlMs: 3000, cacheScope: 'private' },
+        },
+      },
+    );
+    activeServer = server;
+
+    const registrations = new Map();
+    for (const definition of [...toolDefinitions, ...extendedToolDefinitions]) {
+      const registered = server.registerTool(
+        definition.name,
+        toolConfig(definition, fromJsonSchema),
+        async (args, context) => invokeTool(definition.name, args || {}, { signal: context?.mcpReq?.signal }),
+      );
+      registrations.set(definition.name, registered);
+      if (extendedToolDefinitions.includes(definition) && !initiallySupported.has(definition.name)) registered.disable();
+    }
+
+    let lastSupported = initiallySupported;
+    capabilityTimer = setInterval(async () => {
+      if (closed) return;
+      try {
+        const next = new Set((await advertisedExtendedTools()).map(tool => tool.name));
+        for (const definition of extendedToolDefinitions) {
+          const before = lastSupported.has(definition.name);
+          const after = next.has(definition.name);
+          if (before === after) continue;
+          const registered = registrations.get(definition.name);
+          if (after) registered?.enable();
+          else registered?.disable();
+        }
+        lastSupported = next;
+      } catch (error) {
+        onError(error instanceof Error ? error : new Error(String(error)));
+      }
+    }, pollIntervalMs());
+    capabilityTimer.unref?.();
+
+    return server;
+  }, {
+    legacy: 'serve',
+    onerror(error) {
+      onError(error instanceof Error ? error : new Error(String(error)));
+    },
+  });
+
+  return {
+    async notification(notification) {
+      if (!activeServer) return;
+      await activeServer.server.notification(notification);
+    },
+    async close() {
+      if (closed) return;
+      closed = true;
+      if (capabilityTimer) clearInterval(capabilityTimer);
+      capabilityTimer = null;
+      await serverHandle.close();
+      activeServer = null;
+    },
+  };
+}

package/src/permissions.mjs

@@ -75,7 +75,7 @@ export function filesystemErrorExplanation(error, options = {}) {
     return `Windows Controlled folder access is blocking ${windowsLocation} (${code}). Add the binary that runs the tools (${execPath}) under Windows Security → Virus & threat protection → Ransomware protection → Allow an app through Controlled folder access, then restart the agent with \`remcp start\`. A folder outside Desktop, Documents, Downloads and OneDrive needs no new permission.`;
   }
   if (platform === 'darwin') {
-    return `macOS denied access to ${where} (${code}). Check the ownership and permissions of that folder, or add ${execPath} to System Settings → Privacy & Security → Full Disk Access and restart the agent with \`remcp start\`.`;
+    return `macOS denied access to ${where} (${code}). Check that this user owns the folder and its parents, or choose another path. If normal permissions are correct and macOS privacy still blocks it, add ${execPath} to System Settings → Privacy & Security → Full Disk Access and restart the agent with \`remcp start\`.`;
   }
   if (platform === 'win32') {
     return `Windows denied access to ${where} (${code}). Check whether the file is read-only, open in another program, or inside a Controlled folder access area, then allow ${execPath} through Windows Security (Controlled folder access) and restart the agent with \`remcp start\`.`;

package/src/tools/terminal.mjs

@@ -17,7 +17,7 @@ import {
   waitForProcessExit,
   waitForProcessActivity,
 } from '../sessions.mjs';
-import { clampInteger, fail, requireInteger, requireString, text } from '../util.mjs';
+import { clampInteger, fail, requireInteger, requireString, structured, text } from '../util.mjs';
 
 function shellCommand() {
   if (runtimeConfig.defaultShell) return runtimeConfig.defaultShell;
@@ -32,7 +32,15 @@ function shellArgs(command) {
 
 function describeSession(session) {
   const status = session.exited ? `exited${session.signal ? ` (${session.signal})` : session.exitCode === null ? '' : ` (code ${session.exitCode})`}` : 'running';
-  return { pid: session.pid, status, runtimeMs: (session.finishedAt || Date.now()) - session.startedAt, lines: totalLines(session) };
+  return {
+    pid: session.pid,
+    status,
+    runtimeMs: (session.finishedAt || Date.now()) - session.startedAt,
+    lines: totalLines(session),
+    exited: Boolean(session.exited),
+    exitCode: session.exitCode ?? null,
+    signal: session.signal ?? null,
+  };
 }
 
 function abortError() {
@@ -90,8 +98,16 @@ export async function startProcessTool(args, extra = {}) {
   const partial = session.partial;
   session.cursor = session.droppedLines + session.lines.length;
   session.lastPartialRead = session.partial || null;
-  const warning = verdict.note ? `${verdict.note}\n` : '';
-  return text(`${warning}${[headline, output, partial].filter(Boolean).join('\n')}`);
+  const warning = verdict.note ? String(verdict.note) : '';
+  const rendered = [warning, headline, output, partial].filter(Boolean).join('\n');
+  const status = describeSession(session);
+  return structured({
+    ...status,
+    command,
+    output,
+    ...(partial ? { partial } : {}),
+    ...(warning ? { warning } : {}),
+  }, rendered);
 }
 
 export async function readProcessOutputTool(args, extra = {}) {
@@ -124,7 +140,13 @@ export async function readProcessOutputTool(args, extra = {}) {
   }
   const status = describeSession(session);
   const header = `pid ${pid} ${status.status} · lines ${range}`;
-  return text(`${header}\n${slice.join('\n')}`);
+  const output = slice.join('\n');
+  return structured({
+    ...status,
+    range,
+    output,
+    explicitOffset:hasOffset,
+  }, `${header}\n${output}`);
 }
 
 function compileWaiter(pattern) {
@@ -164,7 +186,15 @@ export async function waitForProcessOutputTool(args, extra = {}) {
   const headline = matched
     ? `pid ${pid} ${status.status} · pattern matched${bufferedMatch ? ' (already buffered)' : ''}`
     : `pid ${pid} ${status.status} · pattern not matched within ${timeoutMs}ms`;
-  return text([headline, slice.join('\n')].filter(Boolean).join('\n'));
+  const output = slice.join('\n');
+  return structured({
+    ...status,
+    pattern,
+    matched,
+    bufferedMatch,
+    timeoutMs,
+    output,
+  }, [headline, output].filter(Boolean).join('\n'));
 }
 
 export async function interactWithProcessTool(args, extra = {}) {
@@ -195,34 +225,49 @@ export async function interactWithProcessTool(args, extra = {}) {
   }
   const slice = readNewOutput(session);
   const status = describeSession(session);
-  return text([`pid ${pid} ${status.status}`, slice.join('\n')].filter(Boolean).join('\n'));
+  const output = slice.join('\n');
+  return structured({
+    ...status,
+    output,
+  }, [`pid ${pid} ${status.status}`, output].filter(Boolean).join('\n'));
 }
 
 export async function forceTerminateTool(args) {
   const pid = requireInteger(args.pid, 'pid');
   const session = getProcessSession(pid);
   if (!session) fail(`No ReMCP session with pid ${pid}`);
-  if (session.exited) return text(`Process ${pid} already exited.`);
+  if (session.exited) {
+    const status = describeSession(session);
+    return structured({ ...status, terminated:false, alreadyExited:true, escalated:false }, `Process ${pid} already exited.`);
+  }
   killSessionTree(session, 'SIGTERM');
   const deadline = Date.now() + 2000;
   while (!session.exited && Date.now() < deadline) await waitForProcessActivity(session, 100);
+  let escalated = false;
   if (!session.exited) {
+    escalated = true;
     killSessionTree(session, 'SIGKILL');
     await waitForProcessActivity(session, 1000);
   }
   const status = describeSession(session);
-  return text(`Terminated session ${pid}${status.status.startsWith('exited') ? '' : ' (still running)'}. Status: ${status.status}.`);
+  return structured(
+    { ...status, terminated:Boolean(session.exited), alreadyExited:false, escalated },
+    `Terminated session ${pid}${status.status.startsWith('exited') ? '' : ' (still running)'}. Status: ${status.status}.`,
+  );
 }
 
 export async function listSessionsTool() {
   const sessions = listProcessSessions();
-  if (!sessions.length) return text('No active terminal sessions.');
-  const rows = sessions.map(session => {
+  const facts = sessions.map(session => {
     const status = describeSession(session);
     const blocked = session.exited ? '' : session.partial ? 'blocked-possibly' : 'idle-or-running';
-    return `pid ${status.pid} · ${status.status} · ${Math.round(status.runtimeMs / 1000)}s · ${blocked} · ${session.command.slice(0, 120)}`;
+    return { ...status, blocked, command:session.command.slice(0, 120) };
   });
-  return text(rows.join('\n'));
+  if (!facts.length) return structured({ sessions:[] }, 'No active terminal sessions.');
+  const rows = facts.map(session =>
+    `pid ${session.pid} · ${session.status} · ${Math.round(session.runtimeMs / 1000)}s · ${session.blocked} · ${session.command}`
+  );
+  return structured({ sessions:facts }, rows.join('\n'));
 }
 
 export const terminalToolHandlers = {

package/src/util.mjs

@@ -88,8 +88,16 @@ function resolvedRoots() {
 // Canonical, allowlist-checked path for every file tool. The canonical path is what
 // callers must use, so a symlink cannot be swapped between the check and the access.
 export async function resolveSafePath(value, field = 'path') {
-  const absolute = resolveInputPath(value, field);
+  const raw = expandHome(requireString(value, field));
+  if (raw.includes('\0')) fail(`${field} contains an invalid character`);
+  const absolute = path.resolve(raw);
   if (!runtimeConfig.allowedRoots.length) return absolute;
+
+  // Canonicalize both sides before enforcing confinement. This matters on macOS where
+  // /var is a symlink to /private/var: a safe path returned by an earlier canonicalization
+  // must not be rejected merely because its lexical prefix differs from the configured root.
+  // Symlink escapes remain blocked because the final canonical target must still be inside
+  // one of the canonical allowed roots.
   const canonical = await canonicalizePath(absolute);
   const roots = await resolvedRoots();
   if (!roots.some(root => isInsideRoot(canonical, root))) {
@@ -145,6 +153,21 @@ export function text(value, isError = false) {
   return { content: [{ type: 'text', text: rendered }], structuredContent: { text: mirror }, ...(isError ? { isError: true } : {}) };
 }
 
+export function structured(value, fallbackText = null) {
+  const serialized = JSON.stringify(value);
+  const bytes = Buffer.byteLength(serialized ?? 'null', 'utf8');
+  const rendered = truncate(fallbackText == null ? JSON.stringify(value, null, 2) : String(fallbackText));
+  let structuredContent;
+  if (bytes > STRUCTURED_MIRROR_LIMIT_BYTES) {
+    structuredContent = { truncated: true, bytes, preview: rendered.slice(0, 2048) };
+  } else if (value && typeof value === 'object' && !Array.isArray(value)) {
+    structuredContent = value;
+  } else {
+    structuredContent = { data: value };
+  }
+  return { content: [{ type: 'text', text: rendered }], structuredContent };
+}
+
 export function image(data, mimeType) {
   return { type: 'image', data, mimeType };
 }