@remcp/runtime 0.2.8 → 0.2.10

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 0.2.10
+
+Tool-call reliability fixes found by the second audit round.
+
+- `apply_patch` accepts `diff -u` headers that carry a tab and timestamp (the timestamp is not part
+  of the file path), treats a blank line inside a hunk as an empty context line instead of dropping
+  it, and drops trailing empty context lines the diff's own line counts say are not part of the hunk.
+- The output budget now bounds the serialised frame, not the raw bytes: a control character becomes
+  six bytes once JSON-escaped, so an ANSI-heavy result used to pass the check and still exceed the
+  transport limit, closing the connection mid-call.
+- `read_file`, `read_binary`, `read_image` and `hash_file` refuse anything that is not a regular
+  file, so a FIFO cannot hang a call and a device node cannot flood it.
+- Tree walks report the directories they could not read instead of silently returning a partial
+  result, `read_files` reports the real number of matches, `set_permissions` reports per-path
+  failures instead of stopping at the first one, and a glob character class with an invalid range
+  falls back to a literal match instead of throwing out of the tool.
+
 ## 0.2.7
 
 Security and correctness fixes for the device runtime.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/runtime",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "description": "First-party ReMCP local device runtime: file, search, terminal and process tools over MCP for computers paired with ReMCP.",
   "type": "module",
   "license": "MIT",

package/src/patch.mjs

@@ -6,6 +6,16 @@ import { splitLines } from './util.mjs';
 
 const HUNK_HEADER = /^@@\s+-(\d+)(?:,(\d+))?\s+\+(\d+)(?:,(\d+))?\s+@@/;
 
+// `diff -u` writes `--- a/file<TAB>2026-09-17 12:00:00` and a model may paste that verbatim. The
+// tab-separated timestamp is not part of the path, and keeping it made apply_patch create a file
+// whose name contained the date while the real target was never touched.
+function patchPath(value) {
+  const raw = String(value || '').trim();
+  if (!raw) return '';
+  const [path] = raw.split('\t');
+  return path.trim();
+}
+
 export function parseUnifiedDiff(patch) {
   const lines = String(patch).replace(/\r\n/g, '\n').split('\n');
   const files = [];
@@ -13,13 +23,13 @@ export function parseUnifiedDiff(patch) {
   let hunk = null;
   for (const line of lines) {
     if (line.startsWith('--- ')) {
-      current = { oldPath: line.slice(4).trim(), newPath: null, hunks: [] };
+      current = { oldPath: patchPath(line.slice(4)), newPath: null, hunks: [] };
       files.push(current);
       hunk = null;
       continue;
     }
     if (line.startsWith('+++ ')) {
-      if (current) current.newPath = line.slice(4).trim();
+      if (current) current.newPath = patchPath(line.slice(4));
       continue;
     }
     const header = line.match(HUNK_HEADER);
@@ -37,10 +47,32 @@ export function parseUnifiedDiff(patch) {
     }
     if (!hunk) continue;
     if (line.startsWith('\\')) continue; // ""
-    if (line === '' && hunk.lines.length === 0) continue;
+    if (line === '') {
+      // A blank line inside a hunk is an empty context line (" " with its trailing space stripped by
+      // an editor or a chat client), not a separator. Dropping it shifted every following line and
+      // applied the hunk in the wrong place while still reporting success.
+      if (hunk.lines.length) hunk.lines.push({ type: ' ', text: '' });
+      continue;
+    }
     const marker = line[0];
     if (marker === ' ' || marker === '+' || marker === '-') hunk.lines.push({ type: marker, text: line.slice(1) });
   }
+  // A diff ends with a newline, and a chat client may strip the trailing space of the last context
+  // line, leaving an empty string that is not part of any hunk. The declared line counts say how
+  // many lines belong to a hunk, so trailing empty context lines beyond them are dropped.
+  for (const file of files) {
+    for (const entry of file.hunks) {
+      const countOld = lines => lines.filter(line => line.type !== '+').length;
+      const countNew = lines => lines.filter(line => line.type !== '-').length;
+      while (entry.lines.length > 1) {
+        const last = entry.lines[entry.lines.length - 1];
+        const overOld = countOld(entry.lines) > entry.oldCount;
+        const overNew = countNew(entry.lines) > entry.newCount;
+        if (last.type !== ' ' || last.text !== '' || (!overOld && !overNew)) break;
+        entry.lines.pop();
+      }
+    }
+  }
   return files.filter(file => file.hunks.length);
 }
 

package/src/tools/files.mjs

@@ -28,20 +28,38 @@ function detectEol(content) {
   return crlf > lf ? '\r\n' : '\n';
 }
 
+// Only regular files can be read: a FIFO blocks until a writer appears, a device node can be
+// endless, and both would hang or flood a tool call instead of returning an answer.
+function assertRegularFile(info, absolute) {
+  if (info.isDirectory()) fail(`${displayPath(absolute)} is a directory, not a file`);
+  if (!info.isFile()) fail(`${displayPath(absolute)} is not a regular file`);
+  return info;
+}
+
 // Traversal helper for every multi-file tool. A symbolic link inside an allowed root can point
 // anywhere, so links are never followed and each collected path is resolved through
 // resolveSafePath again before a tool reads or writes it. `stat` follows links, which is exactly
 // how a symlinked directory inside a root used to expose files outside it.
 async function collectTree(root, { maxFiles = 500, skip = [] } = {}) {
   const found = [];
+  const denied = [];
   const skipName = name => skip.some(entry => (entry.endsWith('*') ? name.startsWith(entry.slice(0, -1)) : name === entry));
   async function visit(target) {
     if (found.length >= maxFiles) return;
     const info = await lstat(target).catch(() => null);
+    // A symlink is skipped on purpose (it can point outside the allowed roots); that is not a denial
+    // and must not be reported as one.
     if (!info || info.isSymbolicLink()) return;
     if (info.isFile()) { found.push(target); return; }
     if (!info.isDirectory()) return;
-    const entries = await readdir(target, { withFileTypes: true }).catch(() => []);
+    let entries;
+    try {
+      entries = await readdir(target, { withFileTypes: true });
+    } catch {
+      // Reporting the skip matters: silently dropping a directory made a partial walk look complete.
+      denied.push(target);
+      return;
+    }
     for (const entry of entries) {
       if (found.length >= maxFiles) return;
       if (entry.isSymbolicLink() || skipName(entry.name)) continue;
@@ -49,7 +67,7 @@ async function collectTree(root, { maxFiles = 500, skip = [] } = {}) {
     }
   }
   await visit(root);
-  return found;
+  return { files: found, denied };
 }
 
 // Every path a multi-file tool is about to touch passes through the same confinement check as a
@@ -64,7 +82,7 @@ async function confineAll(paths) {
 
 async function readTextFile(absolute) {
   const info = await stat(absolute).catch(() => fail(`File not found: ${displayPath(absolute)}`));
-  if (info.isDirectory()) fail(`${displayPath(absolute)} is a directory, not a file`);
+  assertRegularFile(info, absolute);
   if (info.size > MAX_INLINE_FILE_BYTES) fail(`File is too large to read inline (${info.size} bytes)`);
   const buffer = await readFile(absolute);
   const decoded = decodeText(buffer);
@@ -116,8 +134,7 @@ export async function readMultipleFilesTool(args) {
 
 export async function readImageTool(args) {
   const absolute = await resolveSafePath(args.path);
-  const info = await stat(absolute).catch(() => fail(`File not found: ${displayPath(absolute)}`));
-  if (info.isDirectory()) fail(`${displayPath(absolute)} is a directory, not an image`);
+  const info = assertRegularFile(await stat(absolute).catch(() => fail(`File not found: ${displayPath(absolute)}`)), absolute);
   if (info.size > MAX_IMAGE_BYTES) fail(`Image is ${info.size} bytes, above the ${MAX_IMAGE_BYTES}-byte inline limit`);
   const mimeType = IMAGE_TYPES.get(path.extname(absolute).toLowerCase());
   if (!mimeType) fail(`${displayPath(absolute)} is not a supported image type (${[...IMAGE_TYPES.keys()].join(', ')})`);
@@ -134,8 +151,7 @@ export async function readImageTool(args) {
 
 export async function hashFileTool(args) {
   const absolute = await resolveSafePath(args.path);
-  const info = await stat(absolute).catch(() => fail(`File not found: ${displayPath(absolute)}`));
-  if (info.isDirectory()) fail(`${displayPath(absolute)} is a directory, not a file`);
+  const info = assertRegularFile(await stat(absolute).catch(() => fail(`File not found: ${displayPath(absolute)}`)), absolute);
   const algorithm = String(args.algorithm || 'sha256').toLowerCase();
   if (!['sha256', 'sha1', 'md5'].includes(algorithm)) fail('algorithm must be sha256, sha1, or md5');
   const hash = createHash(algorithm);
@@ -245,8 +261,7 @@ export async function writeFileTool(args) {
 // large file is read as a sequence of base64 slices and written back the same way.
 export async function readBinaryTool(args) {
   const absolute = await resolveSafePath(args.path);
-  const info = await stat(absolute).catch(() => fail(`File not found: ${displayPath(absolute)}`));
-  if (info.isDirectory()) fail(`${displayPath(absolute)} is a directory, not a file`);
+  const info = assertRegularFile(await stat(absolute).catch(() => fail(`File not found: ${displayPath(absolute)}`)), absolute);
   const offset = Math.max(0, Number.isFinite(Number(args.offset_bytes)) ? Math.trunc(Number(args.offset_bytes)) : 0);
   const length = clampInteger(args.length_bytes, MAX_BINARY_CHUNK_BYTES, 1, MAX_BINARY_CHUNK_BYTES);
   const start = Math.min(offset, info.size);
@@ -403,7 +418,8 @@ export async function replaceInFilesTool(args) {
     }
   }
   const info = await stat(root).catch(() => fail(`Path not found: ${displayPath(root)}`));
-  const files = await confineAll(info.isFile() ? [root] : await collectTree(root, { maxFiles, skip: ['.git', 'node_modules', '.remcp-trash*'] }));
+  const walk = info.isFile() ? { files: [root], denied: [] } : await collectTree(root, { maxFiles, skip: ['.git', 'node_modules', '.remcp-trash*'] });
+  const files = await confineAll(walk.files);
   const glob = filePattern ? globToRegExp(filePattern) : null;
   const changed = [];
   let scanned = 0;
@@ -495,16 +511,18 @@ export async function readFilesTool(args) {
   const matcher = globToRegExp(pattern);
   const rootInfo = await stat(root).catch(() => null);
   // A file path is matched directly; a directory is walked without following links.
-  const candidates = rootInfo?.isFile()
-    ? [root]
-    : await confineAll(await collectTree(root, {
+  const walk = rootInfo?.isFile()
+    ? { files: [root], denied: [] }
+    : await collectTree(root, {
       maxFiles: maxFiles + 1,
       skip: includeIgnored ? ['.remcp-trash*'] : ['node_modules', '.git', '.remcp-trash*'],
-    }));
-  const files = candidates.filter(target => {
+    });
+  const candidates = await confineAll(walk.files);
+  const matched = candidates.filter(target => {
     const relative = path.relative(root, target) || path.basename(target);
     return matcher.test(relative.split(path.sep).join('/')) || matcher.test(path.basename(target));
-  }).slice(0, maxFiles);
+  });
+  const files = matched.slice(0, maxFiles);
   if (!files.length) return text(`No files matched ${pattern} under ${displayPath(root)}.`);
   const sections = [];
   let skipped = 0;
@@ -520,7 +538,11 @@ export async function readFilesTool(args) {
       sections.push(`===== ${displayPath(file)} =====\n(skipped: ${error instanceof Error ? error.message : String(error)})`);
     }
   }
-  const header = `${files.length} file(s) matched ${pattern} under ${displayPath(root)}${files.length > maxFiles ? ` (showing the first ${maxFiles})` : ''}${skipped ? `, ${skipped} skipped` : ''}`;
+  const notes = [];
+  if (matched.length > files.length) notes.push(`showing the first ${files.length}`);
+  if (skipped) notes.push(`${skipped} unreadable`);
+  if (walk.denied.length) notes.push(`${walk.denied.length} unreadable director${walk.denied.length === 1 ? 'y' : 'ies'} skipped`);
+  const header = `${matched.length} file(s) matched ${pattern} under ${displayPath(root)}${notes.length ? ` (${notes.join(', ')})` : ''}`;
   return text(`${header}\n\n${sections.join('\n\n')}`);
 }
 
@@ -723,16 +745,20 @@ export async function setPermissionsTool(args) {
   }
   const confined = await confineAll(targets);
   let changed = 0;
+  const failures = [];
   for (const target of confined) {
     try {
       await chmod(target, mode);
       if (uid !== null || gid !== null) await chown(target, uid ?? -1, gid ?? -1);
       changed += 1;
     } catch (error) {
-      fail(`Could not change permissions on ${displayPath(target)}: ${error instanceof Error ? error.message : String(error)}`);
+      // One protected file must not abort a recursive change; the caller gets the full picture.
+      failures.push(`${displayPath(target)}: ${error instanceof Error ? error.message : String(error)}`);
     }
   }
-  return text(`Set mode ${raw}${uid !== null || gid !== null ? ` (uid ${uid ?? '-'} gid ${gid ?? '-'})` : ''} on ${changed} path(s) starting at ${displayPath(absolute)}.`);
+  const summary = `Set mode ${raw}${uid !== null || gid !== null ? ` (uid ${uid ?? '-'} gid ${gid ?? '-'})` : ''} on ${changed} path(s) starting at ${displayPath(absolute)}.`;
+  if (!failures.length) return text(summary);
+  return text(`${summary}\n${failures.length} path(s) could not be changed:\n${failures.slice(0, 20).join('\n')}`, true);
 }
 
 export async function createDirectoryTool(args) {

package/src/util.mjs

@@ -103,13 +103,31 @@ export function displayPath(absolute) {
   return absolute.startsWith(home + path.sep) ? `~/${absolute.slice(home.length + 1)}` : absolute;
 }
 
+// The transport measures the serialised frame, not the raw string: a control character becomes six
+// bytes once JSON-escaped, so an ANSI-heavy command output could pass this check and still exceed
+// the stdio/relay frame limit, which closes the connection and restarts the runtime.
+function frameBytes(text) {
+  return Buffer.byteLength(JSON.stringify(String(text)), 'utf8');
+}
+
 export function truncate(text, maxBytes) {
   const limit = maxBytes || runtimeConfig.maxOutputBytes;
-  const buffer = Buffer.from(text, 'utf8');
-  if (buffer.length <= limit) return text;
-  const head = buffer.subarray(0, Math.floor(limit * 0.7)).toString('utf8');
-  const tail = buffer.subarray(buffer.length - Math.floor(limit * 0.2)).toString('utf8');
-  return `${head}\n… output truncated (${buffer.length} bytes, limit ${limit}) …\n${tail}`;
+  const value = String(text);
+  if (Buffer.byteLength(value, 'utf8') <= limit && frameBytes(value) <= limit) return value;
+  // Shrink until the escaped frame fits, so the escaped size is what the caller gets is bounded.
+  let size = Math.min(Buffer.byteLength(value, 'utf8'), limit);
+  let rendered = '';
+  for (let attempt = 0; attempt < 8; attempt += 1) {
+    const buffer = Buffer.from(value, 'utf8');
+    const head = buffer.subarray(0, Math.max(0, Math.floor(size * 0.7))).toString('utf8');
+    const tail = buffer.subarray(Math.max(0, buffer.length - Math.floor(size * 0.2))).toString('utf8');
+    rendered = `${head}\n… output truncated (${buffer.length} bytes, limit ${limit}) …\n${tail}`;
+    if (frameBytes(rendered) <= limit) return rendered;
+    size = Math.floor(size * 0.6);
+    if (size < 512) break;
+  }
+  const buffer = Buffer.from(value, 'utf8');
+  return `${buffer.subarray(0, 256).toString('utf8')}\n… output truncated (${buffer.length} bytes, limit ${limit}) …`;
 }
 
 // structuredContent mirrors the text so a client can rely on the declared outputSchema, but the
@@ -196,12 +214,20 @@ export function globToRegExp(pattern) {
     if (char === '?') { out += '[^/]'; continue; }
     if (char === '[') {
       const close = source.indexOf(']', index + 1);
-      if (close > index + 1) {
+      if (close > index + 1 && close - index <= 64) {
         let body = source.slice(index + 1, close);
         const negated = body.startsWith('!') || body.startsWith('^');
         if (negated) body = body.slice(1);
         body = body.replace(/\\/g, '\\\\').replace(/\]/g, '\\]').replace(/\^/g, '\\^');
-        out += `[${negated ? '^/' : ''}${body}]`;
+        const candidate = `[${negated ? '^/' : ''}${body}]`;
+        // A class like [z-a] is not a valid range: the pattern falls back to a literal match instead
+        // of throwing out of the tool, because a user pattern must never break a call.
+        try {
+          new RegExp(candidate);
+          out += candidate;
+        } catch {
+          out += `\\${char}`;
+        }
         index = close;
         continue;
       }