@remcp/runtime 0.2.5 → 0.2.7

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 0.2.7
+
+Security and correctness fixes for the device runtime.
+
+- **Symlink confinement fixed.** `read_files`, `replace_in_files` and `set_permissions` walked a
+  tree with `stat`, which follows symbolic links, and never re-checked the children they collected.
+  A directory symlink inside an allowed root could therefore be read *and rewritten* outside it.
+  Traversal now uses `lstat`, never follows a link, and re-resolves every collected path through
+  the same confinement check a single-file call uses.
+- **Large results no longer kill the runtime.** The inline image limit is 4 MiB instead of 8 MiB:
+  base64 costs a third more bytes and the MCP stdio client drops the connection above 10 MB, which
+  used to restart the runtime in the middle of a call. The text budget is shared between `content`
+  and `structuredContent`, which carry the same string.
+- **`apply_patch` inserts zero-context hunks at the right line**: `@@ -N,0 +M,K @@` inserts *after*
+  line N, and the previous calculation applied every such hunk one line early while reporting
+  success.
+- **Glob patterns honour `[abc]`, `{a,b}` and `?`**: character classes and brace alternatives were
+  escaped into literal text and matched nothing, and `?` could match a directory separator.
+
 ## 0.2.3
 
 Full surface and review-aligned annotations. (0.2.0 was published from an earlier snapshot that

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/runtime",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "description": "First-party ReMCP local device runtime: file, search, terminal and process tools over MCP for computers paired with ReMCP.",
   "type": "module",
   "license": "MIT",

package/src/catalog.mjs

@@ -4,6 +4,17 @@ import { terminalToolHandlers } from './tools/terminal.mjs';
 import { systemToolHandlers } from './tools/system.mjs';
 import { statsToolHandlers } from './tools/stats.mjs';
 
+// Every tool answers with a text result (image tools add an image part as well), so the
+// declared output schema is the same shape everywhere and clients can rely on it.
+export const TEXT_OUTPUT_SCHEMA = {
+  type: 'object',
+  properties: {
+    text: { type: 'string', description: 'Human-readable result of the tool call.' },
+  },
+  required: ['text'],
+  additionalProperties: false,
+};
+
 const readOnly = { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false };
 const readOnlyNonIdempotent = { readOnlyHint: true, destructiveHint: false, idempotentHint: false, openWorldHint: false };
 const additive = { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false };
@@ -726,4 +737,15 @@ export const toolDefinitions = [
   },
 ];
 
+export function advertisedTools() {
+  return toolDefinitions.map(({ name, title, description, inputSchema, annotations, outputSchema }) => ({
+    name,
+    title,
+    description,
+    inputSchema,
+    annotations,
+    outputSchema: outputSchema || TEXT_OUTPUT_SCHEMA,
+  }));
+}
+
 export const toolHandlers = new Map(toolDefinitions.map(definition => [definition.name, definition]));

package/src/index.mjs

@@ -2,7 +2,7 @@
 import process from 'node:process';
 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
-import { toolDefinitions } from './catalog.mjs';
+import { advertisedTools, toolDefinitions } from './catalog.mjs';
 import { describeConfig, configurationError, runtimeConfigDir } from './config.mjs';
 import { invokeTool } from './invoke.mjs';
 import { shutdownSessions, startSessionSweeper } from './sessions.mjs';
@@ -40,7 +40,7 @@ if (args.includes('--version')) {
 }
 
 if (args.includes('--print-tools')) {
-  process.stdout.write(`${JSON.stringify(toolDefinitions.map(({ name, title, description, inputSchema, annotations }) => ({ name, title, description, inputSchema, annotations })), null, 2)}\n`);
+  process.stdout.write(`${JSON.stringify(advertisedTools(), null, 2)}\n`);
   process.exit(0);
 }
 
@@ -86,9 +86,7 @@ const server = new Server(
   },
 );
 
-server.setRequestHandler(ListToolsRequestSchema, async () => ({
-  tools: toolDefinitions.map(({ name, title, description, inputSchema, annotations }) => ({ name, title, description, inputSchema, annotations })),
-}));
+server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: advertisedTools() }));
 
 server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
   return invokeTool(request.params.name, request.params.arguments, extra);

package/src/patch.mjs

@@ -52,7 +52,10 @@ function normalize(line) {
 // differences, the same way patch(1) does with fuzz.
 function locate(lines, hunk) {
   const expected = hunk.lines.filter(entry => entry.type !== '+').map(entry => entry.text);
-  if (!expected.length) return { index: hunk.oldStart - 1, fuzz: 0 };
+  // A hunk with no context and no removals is a pure insertion: `@@ -N,0 +M,K @@` inserts after
+  // line N, so the zero-based insertion point is N (and the end of file when N is the last line).
+  // Using N-1 here inserted every such hunk one line too early while still reporting success.
+  if (!expected.length) return { index: Math.min(Math.max(hunk.oldStart, 0), lines.length), fuzz: 0 };
   const candidates = [];
   const anchor = Math.max(0, hunk.oldStart - 1);
   for (let offset = 0; offset <= 200; offset += 1) {

package/src/tools/files.mjs

@@ -3,7 +3,7 @@ import os from 'node:os';
 import { spawnSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { constants, createReadStream } from 'node:fs';
-import { access, chmod, chown, copyFile, cp, mkdir, open, readFile, readdir, rename, rm, stat, unlink, writeFile } from 'node:fs/promises';
+import { access, chmod, chown, copyFile, cp, lstat, mkdir, open, readFile, readdir, rename, rm, stat, unlink, writeFile } from 'node:fs/promises';
 import { pipeline } from 'node:stream/promises';
 import { runtimeConfig } from '../config.mjs';
 import { diffStats, unifiedDiff } from '../diff.mjs';
@@ -12,7 +12,10 @@ import { countEvent, recordEvent } from '../telemetry.mjs';
 import { clampInteger, decodeText, displayPath, fail, globToRegExp, image, looksBinary, multi, pageLines, resolveSafePath, splitLines, text } from '../util.mjs';
 
 const MAX_INLINE_FILE_BYTES = 20 * 1024 * 1024;
-const MAX_IMAGE_BYTES = 8 * 1024 * 1024;
+// An image travels base64-encoded, which costs a third more bytes, and the MCP stdio client drops
+// the connection above 10 MB. 4 MiB of image is ~5.4 MiB on the wire, which leaves room for the
+// summary text and the frame overhead; anything larger goes through read_binary in chunks instead.
+const MAX_IMAGE_BYTES = 4 * 1024 * 1024;
 const MAX_BINARY_CHUNK_BYTES = 1024 * 1024;
 const IMAGE_TYPES = new Map([
   ['.png', 'image/png'], ['.jpg', 'image/jpeg'], ['.jpeg', 'image/jpeg'], ['.gif', 'image/gif'],
@@ -25,6 +28,40 @@ function detectEol(content) {
   return crlf > lf ? '\r\n' : '\n';
 }
 
+// Traversal helper for every multi-file tool. A symbolic link inside an allowed root can point
+// anywhere, so links are never followed and each collected path is resolved through
+// resolveSafePath again before a tool reads or writes it. `stat` follows links, which is exactly
+// how a symlinked directory inside a root used to expose files outside it.
+async function collectTree(root, { maxFiles = 500, skip = [] } = {}) {
+  const found = [];
+  const skipName = name => skip.some(entry => (entry.endsWith('*') ? name.startsWith(entry.slice(0, -1)) : name === entry));
+  async function visit(target) {
+    if (found.length >= maxFiles) return;
+    const info = await lstat(target).catch(() => null);
+    if (!info || info.isSymbolicLink()) return;
+    if (info.isFile()) { found.push(target); return; }
+    if (!info.isDirectory()) return;
+    const entries = await readdir(target, { withFileTypes: true }).catch(() => []);
+    for (const entry of entries) {
+      if (found.length >= maxFiles) return;
+      if (entry.isSymbolicLink() || skipName(entry.name)) continue;
+      await visit(path.join(target, entry.name));
+    }
+  }
+  await visit(root);
+  return found;
+}
+
+// Every path a multi-file tool is about to touch passes through the same confinement check as a
+// single-file call, so dropping the traversal shortcut cannot widen what is reachable.
+async function confineAll(paths) {
+  const safe = [];
+  for (const target of paths) {
+    try { safe.push(await resolveSafePath(target)); } catch { /* outside the allowed roots: skip it */ }
+  }
+  return safe;
+}
+
 async function readTextFile(absolute) {
   const info = await stat(absolute).catch(() => fail(`File not found: ${displayPath(absolute)}`));
   if (info.isDirectory()) fail(`${displayPath(absolute)} is a directory, not a file`);
@@ -366,22 +403,7 @@ export async function replaceInFilesTool(args) {
     }
   }
   const info = await stat(root).catch(() => fail(`Path not found: ${displayPath(root)}`));
-  const files = [];
-  async function collect(target) {
-    if (files.length > maxFiles) return;
-    const entryInfo = await stat(target).catch(() => null);
-    if (!entryInfo) return;
-    if (entryInfo.isFile()) { files.push(target); return; }
-    if (!entryInfo.isDirectory()) return;
-    const entries = await readdir(target, { withFileTypes: true }).catch(() => []);
-    for (const entry of entries) {
-      if (files.length > maxFiles) return;
-      if (entry.name === '.git' || entry.name === 'node_modules' || entry.name.startsWith('.remcp-trash')) continue;
-      await collect(path.join(target, entry.name));
-    }
-  }
-  if (info.isFile()) files.push(root);
-  else await collect(root);
+  const files = await confineAll(info.isFile() ? [root] : await collectTree(root, { maxFiles, skip: ['.git', 'node_modules', '.remcp-trash*'] }));
   const glob = filePattern ? globToRegExp(filePattern) : null;
   const changed = [];
   let scanned = 0;
@@ -471,30 +493,18 @@ export async function readFilesTool(args) {
   const maxLinesPerFile = clampInteger(args.max_lines_per_file, runtimeConfig.maxReadLines, 1, 20000);
   const includeIgnored = args.include_ignored === true;
   const matcher = globToRegExp(pattern);
-  const files = [];
-  async function collect(target) {
-    if (files.length > maxFiles) return;
-    const info = await stat(target).catch(() => null);
-    if (!info) return;
-    if (info.isFile()) {
-      const relative = path.relative(root, target) || path.basename(target);
-      if (matcher.test(relative.split(path.sep).join('/')) || matcher.test(path.basename(target))) files.push(target);
-      return;
-    }
-    if (!info.isDirectory()) return;
-    const entries = await readdir(target, { withFileTypes: true }).catch(() => []);
-    for (const entry of entries) {
-      if (files.length > maxFiles) return;
-      if (entry.name.startsWith('.remcp-trash')) continue;
-      if (!includeIgnored && (entry.name === 'node_modules' || entry.name === '.git')) continue;
-      await collect(path.join(target, entry.name));
-    }
-  }
-  if ((await stat(root).catch(() => null))?.isFile()) {
-    files.push(root);
-  } else {
-    await collect(root);
-  }
+  const rootInfo = await stat(root).catch(() => null);
+  // A file path is matched directly; a directory is walked without following links.
+  const candidates = rootInfo?.isFile()
+    ? [root]
+    : await confineAll(await collectTree(root, {
+      maxFiles: maxFiles + 1,
+      skip: includeIgnored ? ['.remcp-trash*'] : ['node_modules', '.git', '.remcp-trash*'],
+    }));
+  const files = candidates.filter(target => {
+    const relative = path.relative(root, target) || path.basename(target);
+    return matcher.test(relative.split(path.sep).join('/')) || matcher.test(path.basename(target));
+  }).slice(0, maxFiles);
   if (!files.length) return text(`No files matched ${pattern} under ${displayPath(root)}.`);
   const sections = [];
   let skipped = 0;
@@ -696,16 +706,24 @@ export async function setPermissionsTool(args) {
   const recursive = args.recursive === true;
   const uid = Number.isInteger(Number(args.uid)) ? Number(args.uid) : null;
   const gid = Number.isInteger(Number(args.gid)) ? Number(args.gid) : null;
-  const targets = [];
-  async function collect(target) {
-    targets.push(target);
-    const entry = await stat(target).catch(() => null);
-    if (!entry?.isDirectory() || !recursive) return;
-    for (const child of await readdir(target).catch(() => [])) await collect(path.join(target, child));
-  }
-  await collect(absolute);
+  const targets = [absolute];
+  if (recursive) {
+    // Directories are included, links are not: chmod follows a link and would change a target
+    // outside the allowed roots.
+    const walk = async target => {
+      const entries = await readdir(target, { withFileTypes: true }).catch(() => []);
+      for (const entry of entries) {
+        if (entry.isSymbolicLink()) continue;
+        const child = path.join(target, entry.name);
+        targets.push(child);
+        if (entry.isDirectory()) await walk(child);
+      }
+    };
+    await walk(absolute);
+  }
+  const confined = await confineAll(targets);
   let changed = 0;
-  for (const target of targets) {
+  for (const target of confined) {
     try {
       await chmod(target, mode);
       if (uid !== null || gid !== null) await chown(target, uid ?? -1, gid ?? -1);

package/src/util.mjs

@@ -112,9 +112,19 @@ export function truncate(text, maxBytes) {
   return `${head}\n… output truncated (${buffer.length} bytes, limit ${limit}) …\n${tail}`;
 }
 
+// structuredContent mirrors the text so a client can rely on the declared outputSchema, but the
+// same string twice doubles the message: above this size the mirror becomes a summary and the full
+// result stays in content, which is the primary channel every client reads.
+const STRUCTURED_MIRROR_LIMIT_BYTES = 256 * 1024;
+
 export function text(value, isError = false) {
   const body = typeof value === 'string' ? value : JSON.stringify(value, null, 2);
-  return { content: [{ type: 'text', text: truncate(body) }], ...(isError ? { isError: true } : {}) };
+  const rendered = truncate(body);
+  const size = Buffer.byteLength(rendered, 'utf8');
+  const mirror = size <= STRUCTURED_MIRROR_LIMIT_BYTES
+    ? rendered
+    : `${rendered.slice(0, 512)}… (${size} bytes total; the full result is in the text content)`;
+  return { content: [{ type: 'text', text: rendered }], structuredContent: { text: mirror }, ...(isError ? { isError: true } : {}) };
 }
 
 export function image(data, mimeType) {
@@ -122,7 +132,8 @@ export function image(data, mimeType) {
 }
 
 export function multi(parts) {
-  return { content: parts };
+  const summary = parts.find(part => part.type === 'text')?.text ?? '';
+  return { content: parts, structuredContent: { text: summary } };
 }
 
 export function splitLines(value) {
@@ -166,14 +177,49 @@ export function pageLines(lines, offset, length) {
   return { start, end, slice: lines.slice(start, end) };
 }
 
+// Glob translation for the file tools. `?` never crosses a directory separator, `[abc]` and
+// `{a,b}` are honoured, and `**/` may match no directory at all so `**/*` also matches a file in
+// the root. The previous version escaped class and brace syntax, so those patterns silently
+// matched nothing.
 export function globToRegExp(pattern) {
-  // `**/` may match no directory at all, so `**/*` also matches a file in the root.
-  const escaped = String(pattern).replace(/[.+^${}()|[\]\\]/g, '\\$&')
-    .replace(/\*\*\//g, '\u0001')
-    .replace(/\*\*/g, '\u0000')
-    .replace(/\*/g, '[^/]*')
-    .replace(/\?/g, '.')
-    .replace(/\u0000/g, '.*')
-    .replace(/\u0001/g, '(?:.*/)?');
-  return new RegExp(`^${escaped}$`);
+  const source = String(pattern);
+  let out = '';
+  for (let index = 0; index < source.length; index += 1) {
+    const char = source[index];
+    if (char === '*') {
+      if (source[index + 1] === '*') {
+        if (source[index + 2] === '/') { out += '(?:.*/)?'; index += 2; }
+        else { out += '.*'; index += 1; }
+      } else out += '[^/]*';
+      continue;
+    }
+    if (char === '?') { out += '[^/]'; continue; }
+    if (char === '[') {
+      const close = source.indexOf(']', index + 1);
+      if (close > index + 1) {
+        let body = source.slice(index + 1, close);
+        const negated = body.startsWith('!') || body.startsWith('^');
+        if (negated) body = body.slice(1);
+        body = body.replace(/\\/g, '\\\\').replace(/\]/g, '\\]').replace(/\^/g, '\\^');
+        out += `[${negated ? '^/' : ''}${body}]`;
+        index = close;
+        continue;
+      }
+      out += '\\[';
+      continue;
+    }
+    if (char === '{') {
+      const close = source.indexOf('}', index + 1);
+      if (close > index + 1) {
+        const alternatives = source.slice(index + 1, close).split(',').map(part => part.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'));
+        out += `(?:${alternatives.join('|')})`;
+        index = close;
+        continue;
+      }
+      out += '\\{';
+      continue;
+    }
+    out += /[.+^${}()|[\]\\]/.test(char) ? `\\${char}` : char;
+  }
+  return new RegExp(`^${out}$`);
 }