@vo1d7bin/remote-mcp-agent 0.1.0 → 0.3.0

package/README.md

@@ -1,42 +1,66 @@
-# vo1d Remote MCP device agent
-
-Independent, open CLI for connecting an authorized Windows, Linux or macOS device to **your own** account at https://mcp.thelinuxserver.cloud. This is **not** the third-party Desktop Commander relay.
-
-Requires Node.js 22.14 or newer.
-
-### Pair this machine
-
-Sign in to https://mcp.thelinuxserver.cloud/dashboard and choose **Pair a device**. Copy the one-time code. Run:
-
-```powershell
-npx -y @vo1d7bin/remote-mcp-agent@latest enroll
-```
-
-Paste the code when prompted. The credentials are saved outside your source tree at `~/.vo1d-remote-mcp/device.json`. Never share this file.
-
-### Start the agent
-
-```powershell
-npx -y @vo1d7bin/remote-mcp-agent@latest remote --allow-root "C:\Users\Public\Documents"
-```
-
-For Linux: `npx -y @vo1d7bin/remote-mcp-agent@latest remote --allow-root /home/user/mcp-share`.
-
-Use `VO1D_ALLOWED_ROOTS` to set multiple allowed paths, separated by your system PATH delimiter (semicolon on Windows, colon on Linux). Without allowed roots the agent only returns basic system information. An allowed root may expose file and directory names within that folder to the account's explicitly approved MCP clients. Only select directories you're comfortable exposing.
-
-### Useful options
-
-```text
-enroll [--server https://mcp.thelinuxserver.cloud] [--name YOUR-PC]
-remote [--allow-root PATH]
-```
-
-For a second agent profile, set `VO1D_CONFIG_DIR` before enrollment and when starting its `remote` process.
-
-The initial release supports only `system_info` and `list_directory`. It cannot read file contents, write files, or run shell commands. It reconnects automatically while its process is running. To revoke credentials, open the vo1d Devices dashboard and select **Revoke**.
-
-### Security
-
-Only install this package from the official npm registry under the `@vo1d7bin` scope. Do not run agents as Administrator/root unless necessary. Do not forward or publish the device token. Use explicit, limited allowlisted roots and review client permissions.
-
-Maintained source: https://github.com/THE-L1NUX-USER/vo1d-remote-mcp/tree/main/agent
+# vo1d Remote MCP device agent
+
+Connect Windows, Linux or macOS to your account at **https://mcp.thelinuxserver.cloud**. Independent of Desktop Commander.
+
+Node.js 22.14+ required.
+
+## Connect in one command
+
+```powershell
+npx -y @vo1d7bin/remote-mcp-agent@latest remote
+```
+
+First run opens a browser to approve your device through your existing Google account. Compare the verification code in the browser and terminal, then approve. The agent stores its credentials under your user profile and connects automatically. Subsequent runs restore that authorization; you do not need to pair every time.
+
+A compact connection screen confirms the device name, account, unique device ID and connection status, with a short reminder to keep the terminal open.
+
+### Commands
+
+| Command | Purpose |
+| --- | --- |
+| `remote` | Connect, or authorize in browser the first time |
+| `status` | Check the server-recorded online/offline state, account and device ID |
+| `logout` | Revoke this device in the server and remove saved local credentials |
+| `open` | Open the dashboard in your browser |
+| `help` / `--help` | Show available commands and examples |
+| `--version` | Display the agent version |
+| `enroll` | Manual code-based pairing for advanced/headless setups |
+
+Use the same `npx -y @vo1d7bin/remote-mcp-agent@latest` prefix for each command. For example:
+
+```powershell
+npx -y @vo1d7bin/remote-mcp-agent@latest status
+npx -y @vo1d7bin/remote-mcp-agent@latest open
+npx -y @vo1d7bin/remote-mcp-agent@latest logout
+```
+
+`remote --help` and `remote --logout` are accepted as convenience aliases.
+
+**Logout revokes the device credential on the server**, disconnecting a running agent. For safety, if the relay is unreachable, the CLI preserves local credentials and tells you how to revoke through the dashboard. `logout --local` is a last-resort local cleanup only: it does **not** revoke server authorization, and you must also revoke the device in the dashboard.
+
+## Share a specific folder (optional)
+
+By default, the agent exposes basic system information only. To allow a client to list names in a safe directory:
+
+```powershell
+mkdir "$HOME\mcp-share" -Force
+npx -y @vo1d7bin/remote-mcp-agent@latest remote --allow-root "$HOME\mcp-share"
+```
+
+Never use a secrets directory or the entire system drive as an allowed root. File contents, file modifications and terminal commands are **not** enabled in this version. The public MCP endpoint also remains gated until the end-to-end OAuth integration is ready.
+
+The process needs to keep running to remain online. Closing the terminal makes the device offline but does not log it out.
+
+## Advanced options
+
+- `--server URL`: use a custom HTTPS server (local HTTP development is allowed only for localhost)
+- `--name NAME`: set a name during first-time authorization
+- `--no-browser`: print the verification link for another computer instead of attempting to open a local browser
+- `--allow-root PATH`: allow directory listing inside the specified safe path
+- `VO1D_ALLOWED_ROOTS`: additional allowed paths separated by the system path delimiter
+- `VO1D_CONFIG_DIR`: isolate a second authorized device profile
+- `NO_COLOR=1`: suppress terminal ANSI colors
+
+Future installers can run the same background agent without requiring users to install Node themselves.
+
+Source: https://github.com/THE-L1NUX-USER/vo1d-remote-mcp

package/bin/cli-ux.mjs

@@ -0,0 +1,70 @@
+const colors=Boolean(process.stdout.isTTY && !process.env.NO_COLOR && process.env.TERM!=='dumb');
+const tint=(s,c)=>colors?'['+c+'m'+s+'':s;
+const cyan=s=>tint(s,'96'), green=s=>tint(s,'92'), dim=s=>tint(s,'90');
+export const version='0.3.0';
+export function banner() {
+  console.log('');
+  console.log(cyan('  __   __   ___   _   ____'));
+  console.log(cyan('  \\ \\ / /  / _ \\ / | |  _ \\'));
+  console.log(cyan('   \\ V /  | (_) || | | | | |'));
+  console.log(cyan('    \\_/    \\___/ |_| |____/'));
+  console.log('');
+  console.log('  '+cyan('REMOTE MCP')+dim('  ·  v'+version));
+  console.log('  '+dim('Your machines. Your control.'));
+  console.log('');
+}
+export function heading(title) {console.log(cyan('◆ '+title));}
+export function info(label,value){console.log('  '+dim(label.padEnd(15))+String(value||'—'));}
+export function success(message){console.log(green('  ✓  '+message));}
+export function note(message){console.log(dim('  '+message));}
+export function divider(){console.log(dim('  ───────────────────────────────────────────────────'));}
+export function help() {
+  banner();
+  heading('Commands');
+  console.log('  remote       Connect this device (default; browser approval on first run)');
+  console.log('  status       Show this device, account and current relay status');
+  console.log('  logout       Revoke device authorization and delete local credentials');
+  console.log('  open         Open the online device dashboard in your browser');
+  console.log('  enroll       Manual pairing code for headless or advanced setups');
+  console.log('  help         Show these commands');
+  console.log('  --version    Show CLI version');
+  console.log('');
+  heading('Useful options');
+  console.log('  remote --allow-root PATH     Share directory names from an approved folder');
+  console.log('  remote --no-browser          Print approval link instead of opening it');
+  console.log('  remote --server URL          Use a custom vo1d server');
+  console.log('  logout --local               Forget credentials without remote revocation');
+  console.log('  --name DEVICE_NAME           Choose name when first pairing');
+  console.log('');
+  heading('Examples');
+  console.log('  npx -y @vo1d7bin/remote-mcp-agent@latest remote');
+  console.log('  npx -y @vo1d7bin/remote-mcp-agent@latest remote --allow-root ./mcp-share');
+  console.log('  npx -y @vo1d7bin/remote-mcp-agent@latest status');
+  console.log('  npx -y @vo1d7bin/remote-mcp-agent@latest logout');
+  console.log('');
+  note('Tip: keep the terminal open while you want this device online.');
+  note('Only system information is shared unless you specify an allowed folder.');
+}
+export function ready(details) {
+  console.log('');
+  divider();
+  success('Secure connection established');
+  success('Device is online');
+  console.log('');
+  info('Device',details.name);
+  info('Account',details.account||'Your vo1d workspace');
+  info('Device ID',details.id);
+  info('Server',details.server);
+  info('Status','Online');
+  info('Allowed roots',details.roots?.length?details.roots.join(' ; '):'None (system info only)');
+  console.log('');
+  heading('Next');
+  note('Return to your MCP-compatible assistant when the connection is enabled.');
+  note('Keep this terminal open, or minimize it.');
+  note('Press Ctrl+C to disconnect (not to log out).');
+  console.log('');
+  heading('Manage this device (in another terminal)');
+  note('Status: npx -y @vo1d7bin/remote-mcp-agent@latest status');
+  note('Log out: npx -y @vo1d7bin/remote-mcp-agent@latest logout');
+  console.log('');
+}

package/bin/management.mjs

@@ -0,0 +1,104 @@
+import { promises as fs } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { banner, heading, info, success, note } from './cli-ux.mjs';
+
+const profile = process.env.VO1D_CONFIG_DIR
+  ? path.resolve(process.env.VO1D_CONFIG_DIR)
+  : path.join(os.homedir(), '.vo1d-remote-mcp');
+const file=path.join(profile,'device.json');
+const publicServer=process.env.VO1D_SERVER || 'https://mcp.thelinuxserver.cloud';
+
+async function readProfile(){
+  let cfg;
+  try {cfg=JSON.parse(await fs.readFile(file,'utf8'));}
+  catch(error) {
+    if(error.code==='ENOENT')return null;
+    throw new Error('Unable to read device credentials: '+error.message);
+  }
+  if(typeof cfg.id!=='string' || typeof cfg.token!=='string' || cfg.token.length<30 ||
+    typeof cfg.server!=='string')throw new Error('Saved device credentials appear corrupted.');
+  const server=new URL(cfg.server);
+  if(server.protocol!=='https:' &&
+    !(server.protocol==='http:' && ['localhost','127.0.0.1'].includes(server.hostname)))
+    throw new Error('Saved profile has an invalid server address.');
+  return cfg;
+}
+async function call(cfg,endpoint,method='GET') {
+  const url=new URL(endpoint,cfg.server).href;
+  const response=await fetch(url,{method,headers:{Authorization:'Bearer '+cfg.token},signal:AbortSignal.timeout(12000)});
+  if(response.status===401)return {invalid:true};
+  if(!response.ok)throw new Error('Server responded HTTP '+response.status);
+  return response.json();
+}
+export async function showStatus(){
+  banner();
+  heading('Device status');
+  const cfg=await readProfile();
+  if(!cfg){
+    note('No saved device authorization for this profile.');
+    note('Start with: npx -y @vo1d7bin/remote-mcp-agent@latest remote');
+    return;
+  }
+  info('Device ID',cfg.id);
+  info('Server',cfg.server);
+  try {
+    const remote=await call(cfg,'/api/agent/me');
+    if(remote.invalid){
+      info('Status','Authorization invalid or revoked');
+      note('Use logout --local to clear this profile, then remote to reauthorize.');
+      process.exitCode=1;
+      return;
+    }
+    info('Device',remote.name);
+    info('Account',remote.account || 'vo1d account');
+    info('Status',remote.online?'Online':'Offline');
+    if(!remote.online)note('Run remote to bring this device online.');
+  }catch(error){
+    info('Status','Unknown (server unavailable)');
+    note(error.message);
+    process.exitCode=1;
+  }
+}
+export async function logOut(){
+  banner();
+  heading('Log out this device');
+  const cfg=await readProfile();
+  if(!cfg){note('Already logged out. No device credentials found.');return;}
+  if(process.argv.includes('--local')){
+    await fs.unlink(file);
+    note('Local credentials deleted, but server authorization was NOT revoked.');
+    note('Revoke this device in the online dashboard if it is still authorized.');
+    return;
+  }
+  try {
+    const result=await call(cfg,'/api/agent/revoke-self','POST');
+    if(!result.revoked && !result.invalid)throw new Error('Server did not confirm revocation');
+  }catch(error){
+    console.error('Could not revoke device: '+error.message);
+    note('Credentials have been kept so you can retry safely.');
+    note('Alternatively, revoke from the dashboard. --local only deletes locally.');
+    process.exitCode=1;
+    return;
+  }
+  await fs.unlink(file);
+  success('Server authorization revoked');
+  success('Local device credentials removed');
+  note('Run remote whenever you want to authorize this machine again.');
+}
+export async function openDashboard(){
+  banner();
+  const cfg=await readProfile();
+  const origin=cfg?.server || publicServer;
+  const url=new URL(origin);
+  if(url.protocol!=='https:' && !(url.protocol==='http:'&&['localhost','127.0.0.1'].includes(url.hostname)))
+    throw new Error('Dashboard URL must be HTTPS');
+  const address=url.origin+'/dashboard';
+  console.log('Dashboard:',address);
+  if(process.argv.includes('--no-browser') || process.env.VO1D_NO_BROWSER==='true')return;
+  const command=process.platform==='win32'?'explorer.exe':process.platform==='darwin'?'open':'xdg-open';
+  const child=spawn(command,[address],{stdio:'ignore',detached:true,windowsHide:true});
+  child.on('error',()=>note('Could not open browser; use the URL above.'));
+  child.unref();
+}

package/bin/vo1d-agent.mjs

@@ -1,112 +1,218 @@
-#!/usr/bin/env node
-import WebSocket from 'ws';
-import os from 'node:os';
-import { promises as fs } from 'node:fs';
-import path from 'node:path';
-import readline from 'node:readline/promises';
-
-const folder = process.env.VO1D_CONFIG_DIR ? path.resolve(process.env.VO1D_CONFIG_DIR) : path.join(os.homedir(), '.vo1d-remote-mcp');
-const configFile = path.join(folder, 'device.json');
-const arg = (name) => { const i = process.argv.indexOf(name); return i < 0 ? undefined : process.argv[i + 1]; };
-function normalizedServer(raw) {
-  const u = new URL(raw);
-  if (u.protocol !== 'https:' && !(u.protocol === 'http:' &&
-      ['127.0.0.1', 'localhost'].includes(u.hostname))) {
-    throw new Error('An HTTPS server URL is required outside localhost');
-  }
-  return u.origin;
-}
-async function enroll() {
-  const server = normalizedServer(arg('--server') || process.env.VO1D_SERVER || 'https://mcp.thelinuxserver.cloud');
-  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  let code;
-  try { code = (await rl.question('Paste the one-time pairing code: ')).trim(); }
-  finally { rl.close(); }
-  const res = await fetch(server + '/api/agent/enroll', {
-    method: 'POST', headers: { 'content-type': 'application/json' },
-    body: JSON.stringify({ code, name: arg('--name') || os.hostname(), platform: process.platform })
-  });
-  if (!res.ok) throw new Error('Device pairing failed (HTTP ' + res.status + ')');
-  const { id, token } = await res.json();
-  await fs.mkdir(folder, { recursive: true, mode: 0o700 });
-  try {
-    await fs.writeFile(configFile, JSON.stringify({ server, id, token }, null, 2), { mode: 0o600, flag: 'wx' });
-  } catch(error) {
-    if (error.code === 'EEXIST') {
-      throw new Error('A device is already enrolled in this profile. Run "remote" or specify VO1D_CONFIG_DIR to use a separate profile.');
-    }
-    throw error;
-  }
-  console.log('Paired successfully. Device ID:', id);
-  console.log('Credentials saved outside the Git repository:', configFile);
-  console.log('Run: node agent/index.mjs remote');
-}
-async function allowedRoots() {
-  const provided = process.env.VO1D_ALLOWED_ROOTS || arg('--allow-root') || '';
-  const paths = provided.split(path.delimiter).map(s => s.trim()).filter(Boolean);
-  const roots = [];
-  for (const p of paths) roots.push(await fs.realpath(path.resolve(p)));
-  return roots;
-}
-function includesRoot(p, root) {
-  const value = process.platform === 'win32' ? p.toLowerCase() : p;
-  const base = process.platform === 'win32' ? root.toLowerCase() : root;
-  return value === base || value.startsWith(base.endsWith(path.sep) ? base : base + path.sep);
-}
-async function directoryListing(requestPath, roots) {
-  if (!roots.length) throw new Error('No allowed roots configured; set VO1D_ALLOWED_ROOTS');
-  if (typeof requestPath !== 'string' || requestPath.length > 2000) throw new Error('Invalid directory path');
-  const resolved = await fs.realpath(path.resolve(requestPath));
-  if (!roots.some(root => includesRoot(resolved, root))) throw new Error('Path outside allowed directories');
-  const entries = await fs.readdir(resolved, { withFileTypes: true });
-  return { path: resolved, truncated: entries.length > 100, items: entries.slice(0, 100)
-    .map(entry => ({ name: entry.name, type: entry.isDirectory() ? 'directory' : entry.isFile() ? 'file' : 'other' })) };
-}
-async function remote() {
-  const cfg = JSON.parse(await fs.readFile(configFile, 'utf8'));
-  const server = normalizedServer(cfg.server);
-  const roots = await allowedRoots();
-  console.log('Device:', cfg.id, '| Allowed filesystem roots:', roots.length ? roots.join(' ; ') : '(none)');
-  const endpoint = server.replace(/^http/, 'ws') + '/agent';
-  let stopped = false;
-  let retry = 1000;
-  process.on('SIGINT', () => { stopped = true; process.exit(0); });
-  async function connect() {
-    if (stopped) return;
-    const ws = new WebSocket(endpoint, { headers: { Authorization: 'Bearer ' + cfg.token }, handshakeTimeout: 12000 });
-    ws.on('open', () => { retry = 1000; console.log('Connected to', server); });
-    ws.on('message', async raw => {
-      let task;
-      try { task = JSON.parse(raw.toString()); } catch { return; }
-      if (typeof task.id !== 'string') return;
-      let reply;
-      try {
-        if (task.action === 'system_info') {
-          reply = { hostname: os.hostname(), platform: process.platform, arch: process.arch,
-            release: os.release(), cpus: os.cpus().length, memoryBytes: os.totalmem(), allowedRoots: roots };
-        } else if (task.action === 'list_directory') {
-          reply = await directoryListing(task.args?.path, roots);
-        } else {
-          throw new Error('Unsupported action');
-        }
-        ws.send(JSON.stringify({ id: task.id, ok: true, result: reply }));
-      } catch (error) {
-        ws.send(JSON.stringify({ id: task.id, ok: false, error: String(error.message).slice(0, 150) }));
-      }
-    });
-    ws.on('error', error => console.error('Connection:', error.message));
-    ws.on('close', (code) => {
-      if (code === 4001) { console.error('Device revoked. Exiting.'); stopped = true; return; }
-      if (stopped) return;
-      const delay = retry;
-      retry = Math.min(retry * 2, 30000);
-      console.log('Disconnected. Retrying in', delay / 1000, 'seconds.');
-      setTimeout(connect, delay);
-    });
-  }
-  await connect();
-}
-const command = process.argv[2];
-if (command === 'enroll') enroll().catch(e => { console.error(e.message); process.exitCode = 1; });
-else if (command === 'remote') remote().catch(e => { console.error(e.message); process.exitCode = 1; });
-else console.log('Usage: vo1d-agent enroll [--server https://mcp.thelinuxserver.cloud] [--name MY-PC]\n       vo1d-agent remote [--allow-root PATH]\nPass VO1D_ALLOWED_ROOTS for multiple roots or VO1D_CONFIG_DIR for separate profiles.');
+#!/usr/bin/env node
+import WebSocket from 'ws';
+import os from 'node:os';
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import readline from 'node:readline/promises';
+import { spawn } from 'node:child_process';
+import { setTimeout as sleep } from 'node:timers/promises';
+import { banner, heading, info, success, note, divider, help, ready, version } from './cli-ux.mjs';
+import { showStatus, logOut, openDashboard } from './management.mjs';
+
+const folder = process.env.VO1D_CONFIG_DIR
+  ? path.resolve(process.env.VO1D_CONFIG_DIR)
+  : path.join(os.homedir(), '.vo1d-remote-mcp');
+const configFile = path.join(folder, 'device.json');
+const arg = name => {
+  const i = process.argv.indexOf(name);
+  return i < 0 ? undefined : process.argv[i + 1];
+};
+function normalizedServer(raw) {
+  const url = new URL(raw);
+  if (url.protocol !== 'https:' &&
+    !(url.protocol === 'http:' && ['127.0.0.1','localhost'].includes(url.hostname))) {
+    throw new Error('HTTPS is required outside localhost');
+  }
+  if (url.username || url.password || url.pathname !== '/' || url.search || url.hash) {
+    throw new Error('Expected a server origin, not a URL with a path or credentials');
+  }
+  return url.origin;
+}
+function defaultServer() {
+  return normalizedServer(arg('--server') || process.env.VO1D_SERVER || 'https://mcp.thelinuxserver.cloud');
+}
+async function saveDevice(cfg) {
+  await fs.mkdir(folder, {recursive:true, mode:0o700});
+  try {
+    await fs.writeFile(configFile, JSON.stringify(cfg,null,2), {mode:0o600,flag:'wx'});
+  } catch(error) {
+    if(error.code==='EEXIST')throw new Error('Device already enrolled in this profile; use remote to reconnect');
+    throw error;
+  }
+}
+async function legacyEnroll() {
+  const server=defaultServer();
+  const rl=readline.createInterface({input:process.stdin,output:process.stdout});
+  let code;
+  try {code=(await rl.question('Paste the one-time pairing code: ')).trim();}
+  finally {rl.close();}
+  const reply=await fetch(server+'/api/agent/enroll',{
+    method:'POST',headers:{'content-type':'application/json'},
+    body:JSON.stringify({code,name:arg('--name')||os.hostname(),platform:process.platform})
+  });
+  if(!reply.ok)throw new Error('Device pairing failed (HTTP '+reply.status+')');
+  const {id,token}=await reply.json();
+  await saveDevice({server,id,token});
+  console.log('Paired successfully. Device ID:',id);
+  console.log('To connect, run: vo1d-agent remote');
+}
+function openBrowser(address) {
+  if (process.argv.includes('--no-browser') || process.env.VO1D_NO_BROWSER==='true') return false;
+  const program=process.platform==='win32'?'explorer.exe':process.platform==='darwin'?'open':'xdg-open';
+  try {
+    const child=spawn(program,[address],{stdio:'ignore',detached:true,windowsHide:true});
+    child.on('error',()=>{}); // Link is always printed for environments without a browser.
+    child.unref();
+    return true;
+  } catch {return false;}
+}
+async function browserEnroll(server) {
+  const response=await fetch(server+'/api/agent/authorization/start',{
+    method:'POST',headers:{'content-type':'application/json'},
+    body:JSON.stringify({name:arg('--name')||os.hostname(),platform:process.platform})
+  });
+  if(!response.ok)throw new Error('Could not start browser authorization (HTTP '+response.status+')');
+  const data=await response.json();
+  if(typeof data.requestId!=='string' || typeof data.pollToken!=='string')throw new Error('Unexpected authorization response');
+  const link=new URL(data.verificationUrl);
+  if(link.origin!==server || link.pathname!=='/device/authorize')throw new Error('Unexpected authorization destination');
+  console.log('\nFirst-time connection: approve this device in your web browser.');
+  console.log('Verification code:',data.userCode);
+  console.log('Open:',link.href);
+  openBrowser(link.href);
+  console.log('Waiting for approval (expires in 10 minutes). Press Ctrl+C to cancel.\n');
+  const deadline=Math.min(Number(data.expiresAt),Date.now()+10*60_000);
+  let failure=0;
+  while(Date.now()<deadline) {
+    await sleep(Math.max(2000,Number(data.intervalSeconds||3)*1000));
+    let poll;
+    try {
+      poll=await fetch(server+'/api/agent/authorization/poll',{
+        method:'POST',headers:{'content-type':'application/json'},
+        body:JSON.stringify({requestId:data.requestId,pollToken:data.pollToken}),
+        signal:AbortSignal.timeout(12000)
+      });
+    } catch(error) {
+      failure++;
+      if(failure>=5)throw new Error('Unable to reach the authorization server: '+error.message);
+      continue;
+    }
+    failure=0;
+    const info=await poll.json().catch(()=>({}));
+    if(info.status==='pending')continue;
+    if(info.status==='approved' && typeof info.id==='string' && typeof info.token==='string') {
+      const cfg={server,id:info.id,token:info.token};
+      await saveDevice(cfg);
+      console.log('Device approved and credentials stored securely for future runs.');
+      return cfg;
+    }
+    if(info.status==='denied')throw new Error('This device authorization was denied');
+    if(info.status==='expired' || poll.status===410)throw new Error('Authorization expired; rerun the command');
+    throw new Error('Authorization failed (HTTP '+poll.status+'). Rerun the command.');
+  }
+  throw new Error('Device authorization expired; rerun the command');
+}
+async function loadOrEnroll() {
+  try {
+    const cfg=JSON.parse(await fs.readFile(configFile,'utf8'));
+    if(typeof cfg.id!=='string' || typeof cfg.token!=='string' || cfg.token.length<30) {
+      throw new Error('Stored device credentials appear corrupted');
+    }
+    return cfg;
+  } catch(error) {
+    if(error.code!=='ENOENT')throw error;
+    return browserEnroll(defaultServer());
+  }
+}
+async function allowedRoots() {
+  const provided=process.env.VO1D_ALLOWED_ROOTS || arg('--allow-root') || '';
+  const paths=provided.split(path.delimiter).map(x=>x.trim()).filter(Boolean);
+  const roots=[];
+  for(const p of paths)roots.push(await fs.realpath(path.resolve(p)));
+  return roots;
+}
+function includesRoot(p,root) {
+  const value=process.platform==='win32'?p.toLowerCase():p;
+  const base=process.platform==='win32'?root.toLowerCase():root;
+  return value===base || value.startsWith(base.endsWith(path.sep)?base:base+path.sep);
+}
+async function directoryListing(requestPath,roots) {
+  if(!roots.length)throw new Error('No allowed roots configured; set VO1D_ALLOWED_ROOTS');
+  if(typeof requestPath!=='string' || requestPath.length>2000)throw new Error('Invalid directory path');
+  const resolved=await fs.realpath(path.resolve(requestPath));
+  if(!roots.some(root=>includesRoot(resolved,root)))throw new Error('Path outside allowed directories');
+  const entries=await fs.readdir(resolved,{withFileTypes:true});
+  return {path:resolved,truncated:entries.length>100,items:entries.slice(0,100).map(entry=>({
+    name:entry.name,type:entry.isDirectory()?'directory':entry.isFile()?'file':'other'
+  }))};
+}
+async function remote() {
+  banner();
+  heading('Remote connection');
+  const roots=await allowedRoots();
+  const cfg=await loadOrEnroll();
+  const server=normalizedServer(cfg.server);
+  console.log('Device:',cfg.id,'| Allowed filesystem roots:',roots.length?roots.join(' ; '):'(none)');
+  const endpoint=server.replace(/^http/,'ws')+'/agent';
+  let stopped=false,retry=1000;
+  process.on('SIGINT',()=>{stopped=true;process.exit(0);});
+  async function connect() {
+    if(stopped)return;
+    const ws=new WebSocket(endpoint,{headers:{Authorization:'Bearer '+cfg.token},handshakeTimeout:12000});
+    ws.on('open',async()=>{
+      retry=1000;
+      console.log('Connected to',server);
+      let details={id:cfg.id,name:os.hostname(),account:null,server,roots};
+      try {
+        const response=await fetch(server+'/api/agent/me',{
+          headers:{Authorization:'Bearer '+cfg.token},
+          signal:AbortSignal.timeout(9000)
+        });
+        if(response.ok){
+          const remote=await response.json();
+          details={...details,name:remote.name||details.name,account:remote.account};
+        }
+      }catch{note('Account details unavailable; relay connection is still active.');}
+      if(ws.readyState===WebSocket.OPEN)ready(details);
+    });
+    ws.on('message',async raw=>{
+      let task;
+      try{task=JSON.parse(raw.toString());}catch{return;}
+      if(typeof task.id!=='string')return;
+      try {
+        let result;
+        if(task.action==='system_info'){
+          result={hostname:os.hostname(),platform:process.platform,arch:process.arch,
+            release:os.release(),cpus:os.cpus().length,memoryBytes:os.totalmem(),allowedRoots:roots};
+        }else if(task.action==='list_directory'){
+          result=await directoryListing(task.args?.path,roots);
+        }else throw new Error('Unsupported action');
+        if(ws.readyState===WebSocket.OPEN)ws.send(JSON.stringify({id:task.id,ok:true,result}));
+      }catch(error){
+        if(ws.readyState===WebSocket.OPEN)ws.send(JSON.stringify({
+          id:task.id,ok:false,error:String(error.message).slice(0,150)
+        }));
+      }
+    });
+    ws.on('error',error=>console.error('Connection:',error.message));
+    ws.on('close',code=>{
+      if(code===4000){console.log('Another session for this device has taken over. Exiting this agent.');stopped=true;return;}
+      if(code===4001){console.error('Device revoked. Stop this process and request a new authorization.');stopped=true;return;}
+      if(stopped)return;
+      const delay=retry;retry=Math.min(retry*2,30000);
+      console.log('Disconnected. Retrying in',delay/1000,'seconds.');
+      setTimeout(connect,delay);
+    });
+  }
+  await connect();
+}
+const command=process.argv[2];
+const run = fn => fn().catch(error=>{console.error('Error:',error.message);process.exitCode=1;});
+if(command==='--version' || command==='-v' || command==='version') console.log('vo1d-agent v'+version);
+else if(command==='--help' || command==='-h' || command==='help' || command==='remote' && process.argv.includes('--help')) help();
+else if(command==='logout' || command==='remote' && process.argv.includes('--logout')) run(logOut);
+else if(command==='status' || command==='whoami') run(showStatus);
+else if(command==='open' || command==='dashboard') run(openDashboard);
+else if(command==='enroll') run(legacyEnroll);
+else if(!command || command==='remote') run(remote);
+else {console.error('Unknown command:',command);help();process.exitCode=1;}

package/package.json

@@ -1,32 +1,32 @@
-{
-  "name": "@vo1d7bin/remote-mcp-agent",
-  "version": "0.1.0",
-  "description": "Independent vo1d Remote MCP device agent for Windows, Linux and macOS",
-  "type": "module",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/THE-L1NUX-USER/vo1d-remote-mcp.git",
-    "directory": "packages/agent"
-  },
-  "homepage": "https://mcp.thelinuxserver.cloud",
-  "bin": {
-    "vo1d-agent": "bin/vo1d-agent.mjs"
-  },
-  "files": [
-    "bin/",
-    "README.md"
-  ],
-  "engines": {
-    "node": ">=22.14.0"
-  },
-  "dependencies": {
-    "ws": "8.18.3"
-  },
-  "scripts": {
-    "prepack": "node ../../scripts/sync-agent.mjs"
-  },
-  "publishConfig": {
-    "access": "public"
-  }
-}
+{
+  "name": "@vo1d7bin/remote-mcp-agent",
+  "version": "0.3.0",
+  "description": "Independent vo1d Remote MCP device agent for Windows, Linux and macOS",
+  "type": "module",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/THE-L1NUX-USER/vo1d-remote-mcp.git",
+    "directory": "packages/agent"
+  },
+  "homepage": "https://mcp.thelinuxserver.cloud",
+  "bin": {
+    "vo1d-agent": "bin/vo1d-agent.mjs"
+  },
+  "files": [
+    "bin/",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=22.14.0"
+  },
+  "dependencies": {
+    "ws": "8.18.3"
+  },
+  "scripts": {
+    "prepack": "node ../../scripts/sync-agent.mjs"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}