@coworker-jp/aidr 0.1.10 → 0.1.18

package/src/cli.mjs

@@ -12,7 +12,7 @@ import { AGENT_ORDER, AGENT_REGISTRY, loadAgent } from "./agents/index.mjs";
 import { verifyKey, maskKey } from "./verify.mjs";
 import { fetchBinary, fetchOpengrep } from "./binary-fetcher.mjs";
 import { detectInstalled } from "./detect.mjs";
-import { installBrowserExtension } from "./browser-extension.mjs";
+import { evaluateInstallGate, formatLocalPcGuidance } from "./env-gate.mjs";
 import { resolveCallerHome, isRunningUnderSudo, chownToCaller } from "./sudo-user.mjs";
 
 // Package identity — read at module load from the bundled package.json.
@@ -84,47 +84,37 @@ async function cmdInstall(opts) {
     });
   }
 
+  // Install-environment gate (issue #243): an interactive terminal with zero
+  // cloud/CI/remote indicators is almost certainly someone's own PC — the
+  // machine that should run coworker-sentinel, not the ai-scanner hooks.
+  // Stop and point at the sentinel installer unless --local overrides.
+  // Non-interactive runs (CI, cloud sandboxes, agent-executed shells) pass
+  // silently: they are ai-scanner's intended environments.
+  if (!opts.local) {
+    const gate = evaluateInstallGate();
+    if (gate.block) {
+      console.error(formatLocalPcGuidance({
+        sentinelPlatform: gate.sentinelPlatform,
+        env: opts.env || DEFAULT_ENV,
+      }));
+      process.exit(1);
+    }
+  }
+
   const home = resolveCallerHome();
   const scope = opts.scope || "user";
   const base = scope === "user" ? home : process.cwd();
   validateKey(opts.key);
 
-  let verifyInfo = null;
   if (opts.verify !== false) {
     try {
-      verifyInfo = await verifyKey(opts.key, opts.env || DEFAULT_ENV);
+      await verifyKey(opts.key, opts.env || DEFAULT_ENV);
     } catch (e) {
       console.error(`verify failed: ${e.message}`);
       process.exit(1);
     }
   }
 
-  // --with-sentinel requires pro or trial plan
-  if (opts.withSentinel && verifyInfo && !verifyInfo.edr_enabled) {
-    console.error("Error: --with-sentinel requires a Pro or Trial plan.");
-    console.error(`Current plan: ${verifyInfo.plan}`);
-    process.exit(1);
-  }
-
-  // --with-sentinel requires root (same as --scheduled)
-  if (opts.withSentinel && !opts.dryRun
-      && process.getuid && process.getuid() !== 0
-      && process.env.AI_SCANNER_FAKE_ROOT !== "1") {
-    const interactive = process.stdin.isTTY && process.stdout.isTTY && process.platform !== "win32";
-    if (interactive) {
-      console.error("--with-sentinel requires root. Re-running via sudo (you may be prompted for your password)...");
-      const result = spawnSync(
-        "sudo",
-        ["-E", process.execPath, ...process.argv.slice(1)],
-        { stdio: "inherit" }
-      );
-      process.exit(result.status ?? 1);
-    }
-    console.error("Error: --with-sentinel requires root privileges.");
-    console.error(`  sudo -E npx @coworker-jp/aidr install --with-sentinel --key <ak_xxx>`);
-    process.exit(2);
-  }
-
   let agents;
   if (opts.all) {
     agents = detectInstalled(home);
@@ -146,53 +136,6 @@ async function cmdInstall(opts) {
     }
   }
 
-  // Standalone has no hook scripts and no settings.json — scheduled
-  // endpoint-info collection is the whole reason to pick it, so turn
-  // --scheduled on by default when standalone is selected. --binary-only
-  // still short-circuits later.
-  if (agents.includes("standalone")) {
-    opts.scheduled = true;
-  }
-
-  // --scheduled installs a system-wide cron / systemd / launchd entry that
-  // runs `ai-scanner scan endpoint-info` periodically as root, against an
-  // agent-independent binary at /opt/coworker/aidr/bin/ai-scanner. Auto-add
-  // the standalone install so the binary fetch loop drops a copy there
-  // even when the user only listed AI agents (claude / cursor / ...) on
-  // the command line.
-  if (opts.scheduled && !agents.includes("standalone")) {
-    agents.push("standalone");
-  }
-
-  const intervalHours = parseInt(opts.interval ?? "4", 10);
-  if (opts.scheduled && (isNaN(intervalHours) || intervalHours < 1)) {
-    console.error("--interval must be an integer >= 1");
-    process.exit(1);
-  }
-
-  // --scheduled の system path 書き込みは root 必須。
-  // - TTY あり (対話 shell): `sudo -E` で自分自身を re-exec、password prompt が出る
-  // - TTY なし (CI / pipe): sudo は対話的に password を聞けないので fail-fast 案内
-  // smoke / unit test では `AI_SCANNER_FAKE_ROOT=1` を設定してこのチェックを skip 可能。
-  if (opts.scheduled && !opts.dryRun
-      && process.getuid && process.getuid() !== 0
-      && process.env.AI_SCANNER_FAKE_ROOT !== "1") {
-    const interactive = process.stdin.isTTY && process.stdout.isTTY && process.platform !== "win32";
-    if (interactive) {
-      console.error("--scheduled requires root. Re-running via sudo (you may be prompted for your password)...");
-      const result = spawnSync(
-        "sudo",
-        ["-E", process.execPath, ...process.argv.slice(1)],
-        { stdio: "inherit" }
-      );
-      process.exit(result.status ?? 1);
-    }
-    console.error("Error: --scheduled requires root privileges (writes /opt/coworker/aidr, /etc/systemd/system, /etc/aidr).");
-    console.error("Re-run with sudo (non-interactive shells cannot prompt for password):");
-    console.error(`  sudo -E npx @coworker-jp/aidr install --scheduled --key <ak_xxx>`);
-    process.exit(2);
-  }
-
   // Confirmation for existing shared settings.json (claude / gemini).
   // --yes bypasses; --dry-run doesn't write so skip; otherwise prompt on TTY,
   // error if non-interactive (safer than silently merging in CI).
@@ -222,16 +165,9 @@ async function cmdInstall(opts) {
   }
 
   if (!opts.skipBinary && !opts.dryRun) {
-    const { SYSTEM_BIN_DIR } = await import("./scheduled.mjs");
     const agentBinDirs = [];
     for (const name of agents) {
       const mod = await loadAgent(name);
-      // --scheduled 時の standalone は system path (/opt/coworker/aidr/bin)
-      // に置く。それ以外は従来通り per-user の ~/.<agent>/bin。
-      if (name === "standalone" && opts.scheduled) {
-        agentBinDirs.push(SYSTEM_BIN_DIR);
-        continue;
-      }
       const agentDir = mod.meta.agentDir;
       if (!agentDir) continue;
       agentBinDirs.push(path.join(home, agentDir, "bin"));
@@ -263,10 +199,27 @@ async function cmdInstall(opts) {
             const src = path.join(primaryDir, file);
             const dest = path.join(restDir, file);
             await fs.mkdir(restDir, { recursive: true });
-            await fs.copyFile(src, dest);
-            await fs.chmod(dest, 0o755);
-            if (process.platform === "darwin") {
-              try { await execFileP("xattr", ["-d", "com.apple.quarantine", dest]); } catch {}
+            // Temp + atomic rename, NEVER copyFile onto the live path — same
+            // rule (and same reason) as binary-fetcher.mjs::fetchAsset. On a
+            // re-install this path already holds a binary the user's agent has
+            // exec'd, and on macOS rewriting an exec'd file in place makes the
+            // kernel mark THAT VNODE's code signature invalid: every later exec
+            // of the inode is SIGKILLed until reboot, even though the bytes on
+            // disk are valid and re-running the installer cannot repair it
+            // (the inode never changes). See issue #171 / ADR-0005 §52.
+            // The temp file is in the destination dir, so the rename is on one
+            // filesystem = atomic, and mode/xattr are set BEFORE it goes live.
+            const tmp = `${dest}.tmp-${process.pid}`;
+            try {
+              await fs.copyFile(src, tmp);
+              await fs.chmod(tmp, 0o755);
+              if (process.platform === "darwin") {
+                try { await execFileP("xattr", ["-d", "com.apple.quarantine", tmp]); } catch {}
+              }
+              await fs.rename(tmp, dest);
+            } catch (e) {
+              await fs.rm(tmp, { force: true }).catch(() => {});
+              throw e;
             }
             console.log(`binary: ${dest} (copied)`);
           })
@@ -306,54 +259,29 @@ async function cmdInstall(opts) {
     .filter((r) => r.name !== "standalone")
     .map((r) => r.displayName);
 
-  if (opts.scheduled && !opts.dryRun) {
-    const { installScheduled } = await import("./scheduled.mjs");
-    // Schedule entries always point at /opt/coworker/aidr/bin/ai-scanner
-    // (system-wide, root-owned). The path is hard-coded inside scheduled.mjs.
-    try {
-      await installScheduled({
-        accessKey: opts.key,
-        dryRun: opts.dryRun,
-        interval: intervalHours,
-      });
-    } catch (e) {
-      console.error(`scheduled install failed: ${e.message}`);
-      process.exit(1);
-    }
-  }
-
-  if (opts.withSentinel) {
-    const { installSentinel } = await import("./sentinel.mjs");
-    try {
-      const platform = (await import("./binary-fetcher.mjs")).detectPlatform();
-      const presignedUrl = verifyInfo?.sentinel_download_urls?.[platform] || undefined;
-      // Windows additionally needs the sibling WinDivert.dll presigned URL.
-      const dllPresignedUrl =
-        verifyInfo?.sentinel_download_urls?.[`${platform}-windivert-dll`] || undefined;
-      await installSentinel({
-        accessKey: opts.key,
-        dryRun: opts.dryRun,
-        skipBinary: opts.skipBinary,
-        presignedUrl,
-        dllPresignedUrl,
-        env: opts.env || DEFAULT_ENV,
-        noActivate: process.env.AI_SCANNER_NO_SCHEDULED_ACTIVATE === "1",
-      });
-    } catch (e) {
-      console.error(`sentinel install failed: ${e.message}`);
-      process.exit(1);
-    }
-  }
-
-  if (opts.browserExtension && !opts.dryRun) {
-    const firstAgentName = agents[0];
-    const firstAgent = await loadAgent(firstAgentName);
-    const binaryPath = path.join(home, firstAgent.meta.agentDir, "bin", "ai-scanner");
-    try {
-      await installBrowserExtension(home, binaryPath);
-    } catch (e) {
-      console.error(`browser extension install warning: ${e.message}`);
+  // Legacy `--scheduled` artifacts (cron.d / launchd plist / wrapper /
+  // scheduled.log) are retired — endpoint-info collection now runs from the
+  // coworker-sentinel daemon's internal timer. Remove leftovers from older
+  // installs when we have root; otherwise just point the user at sudo.
+  // /etc/aidr/aidr.env is intentionally preserved (sentinel reads it).
+  try {
+    const { isScheduledInstalled, cleanupLegacyScheduled } = await import("./scheduled.mjs");
+    if (await isScheduledInstalled()) {
+      const isRoot = process.env.AI_SCANNER_FAKE_ROOT === "1"
+        || (process.getuid && process.getuid() === 0);
+      if (opts.dryRun) {
+        console.error("[dry-run] legacy scheduled endpoint-info entries detected; a real install would remove them (root required).");
+      } else if (isRoot) {
+        await cleanupLegacyScheduled();
+        console.error("Removed legacy scheduled endpoint-info entries (cron/launchd) — collection is now handled by the coworker-sentinel daemon.");
+      } else {
+        console.error("Note: legacy scheduled endpoint-info entries detected (cron/launchd). They are obsolete —");
+        console.error("collection is now handled by the coworker-sentinel daemon. Re-run with sudo to remove them:");
+        console.error("  sudo -E npx @coworker-jp/aidr install ...");
+      }
     }
+  } catch (e) {
+    console.error(`legacy scheduled cleanup warning: ${e.message}`);
   }
 
   // Auto-sudo re-exec wrote per-agent files as root into the original user's
@@ -496,18 +424,20 @@ async function cmdUninstall(opts) {
     }
   }));
 
-  // Schedule entries live in system paths (/etc, /opt, /Library/LaunchDaemons)
-  // and need root to remove. Mirror cmdInstall's auto-sudo: TTY なら sudo に
-  // re-exec、non-TTY は guidance を出して per-user 部分だけ撤去で完了。
+  // Legacy `--scheduled` entries live in system paths (/etc/cron.d,
+  // /Library/LaunchDaemons) and need root to remove. Mirror cmdInstall's
+  // auto-sudo: TTY なら sudo に re-exec、non-TTY は guidance を出して
+  // per-user 部分だけ撤去で完了。/etc/aidr/aidr.env は sentinel が読むので
+  // 残す (cleanupLegacyScheduled は触らない)。
   try {
-    const { uninstallScheduled, isScheduledInstalled } = await import("./scheduled.mjs");
+    const { cleanupLegacyScheduled, isScheduledInstalled } = await import("./scheduled.mjs");
     if (await isScheduledInstalled()) {
       const isRoot = process.env.AI_SCANNER_FAKE_ROOT === "1"
         || (process.getuid && process.getuid() === 0);
       if (!isRoot) {
         const interactive = process.stdin.isTTY && process.stdout.isTTY && process.platform !== "win32";
         if (interactive) {
-          console.error("Scheduled entry detected. Re-running via sudo to remove (you may be prompted for your password)...");
+          console.error("Legacy scheduled entry detected. Re-running via sudo to remove (you may be prompted for your password)...");
           const result = spawnSync(
             "sudo",
             ["-E", process.execPath, ...process.argv.slice(1)],
@@ -515,19 +445,23 @@ async function cmdUninstall(opts) {
           );
           process.exit(result.status ?? 0);
         }
-        console.error("Note: scheduled entry detected but uninstall needs root. Re-run:");
+        console.error("Note: legacy scheduled entry detected but uninstall needs root. Re-run:");
         console.error(`  sudo -E npx @coworker-jp/aidr uninstall`);
       } else {
-        await uninstallScheduled({ dryRun: opts.dryRun });
+        await cleanupLegacyScheduled({ dryRun: opts.dryRun });
       }
     }
   } catch (e) {
-    console.error(`scheduled uninstall warning: ${e.message}`);
+    console.error(`scheduled cleanup warning: ${e.message}`);
   }
 
-  // Sentinel daemon (LaunchDaemon / systemd service) — same auto-sudo
-  // pattern. Independent try-block so a scheduled-uninstall hiccup doesn't
-  // skip sentinel cleanup (and vice-versa).
+  // LEGACY npx-installed sentinel daemon (Linux systemd unit under
+  // /etc/systemd/system + /opt binaries) — same auto-sudo pattern.
+  // isSentinelInstalled matches only that legacy layout: deb installs
+  // (unit under /lib/systemd/system), the Windows setup.exe, and the macOS
+  // DMG are owned by their own uninstallers and never touched here.
+  // Independent try-block so a scheduled-uninstall hiccup doesn't skip
+  // sentinel cleanup (and vice-versa).
   try {
     const { uninstallSentinel, isSentinelInstalled } = await import("./sentinel.mjs");
     if (await isSentinelInstalled()) {
@@ -536,7 +470,7 @@ async function cmdUninstall(opts) {
       if (!isRoot) {
         const interactive = process.stdin.isTTY && process.stdout.isTTY && process.platform !== "win32";
         if (interactive) {
-          console.error("Sentinel daemon detected. Re-running via sudo to remove (you may be prompted for your password)...");
+          console.error("Legacy npx-installed sentinel daemon detected. Re-running via sudo to remove (you may be prompted for your password)...");
           const result = spawnSync(
             "sudo",
             ["-E", process.execPath, ...process.argv.slice(1)],
@@ -544,7 +478,7 @@ async function cmdUninstall(opts) {
           );
           process.exit(result.status ?? 0);
         }
-        console.error("Note: sentinel daemon detected but uninstall needs root. Re-run:");
+        console.error("Note: legacy npx-installed sentinel daemon detected but uninstall needs root. Re-run:");
         console.error(`  sudo -E npx @coworker-jp/aidr uninstall`);
       } else {
         await uninstallSentinel({ dryRun: opts.dryRun });
@@ -588,7 +522,101 @@ async function cmdListAgents() {
   }
 }
 
+// `--scheduled` / `--interval` were retired when endpoint-info collection
+// moved into the coworker-sentinel daemon (internal 6h timer), and
+// `--with-sentinel` was retired when sentinel distribution moved to the
+// OS-native installers (setup.exe / DMG / deb). Commander no longer knows
+// the flags, so scan argv ourselves to fail with a migration message
+// instead of a generic "unknown option" error.
+const SENTINEL_OS_INSTALLERS_HINT = `coworker-sentinel is installed with the OS-native installer (get it from the user portal's Download page):
+  Windows: coworker-sentinel-setup.exe
+  macOS:   CoworkerSentinel.dmg (drag to Applications, launch, enter your access key)
+  Linux:   sudo apt install ./coworker-sentinel.deb && sudo coworker-sentinel activate --key <ak_xxx>`;
+
+const REMOVED_SCHEDULED_FLAGS_MESSAGE = `Error: --scheduled / --interval are no longer supported.
+Endpoint-info collection is now scheduled by the coworker-sentinel daemon (every 6 hours).
+${SENTINEL_OS_INSTALLERS_HINT}
+Toggle collection from the macOS menu-bar app, or edit /etc/aidr/sentinel-settings.json
+(Windows: %ProgramData%\\coworker\\sentinel-settings.json).`;
+
+const REMOVED_WITH_SENTINEL_MESSAGE = `Error: --with-sentinel is no longer supported.
+${SENTINEL_OS_INSTALLERS_HINT}
+aidr now installs agent hooks only:
+  npx @coworker-jp/aidr install --agent <list> --key <ak_xxx>`;
+
+// Red Team は hook 方式のエージェント統合とは別物 — hook を撒くのではなく、
+// ネットワーク脆弱性スキャナを MCP サーバーとして 1 つ登録するだけ。そのため
+// install/uninstall の --agent 複数指定・--all の枠組みには乗せず、独立した
+// サブコマンドにしている。実装は red-team.mjs に分離 (scheduled/sentinel と
+// 同じ遅延 import パターン)。
+async function cmdRedTeamInstall(opts) {
+  const agent = opts.agent || "claude";
+  if (agent !== "claude") {
+    console.error(`red-team install: unsupported agent '${agent}' (only 'claude' is supported)`);
+    process.exit(1);
+  }
+
+  const home = resolveCallerHome();
+  const scope = opts.scope || "user";
+  validateKey(opts.key);
+
+  const env = opts.env || DEFAULT_ENV;
+  if (opts.verify !== false && !opts.dryRun) {
+    try {
+      await verifyKey(opts.key, env);
+    } catch (e) {
+      console.error(`verify failed: ${e.message}`);
+      process.exit(1);
+    }
+  }
+
+  const { installRedTeam } = await import("./red-team.mjs");
+  try {
+    const res = await installRedTeam({
+      accessKey: opts.key,
+      env,
+      scope,
+      home: scope === "user" ? home : process.cwd(),
+      dryRun: opts.dryRun,
+    });
+    if (res.installed) {
+      console.log("");
+      console.log("Next: restart Claude Code so the MCP server is picked up.");
+    }
+  } catch (e) {
+    // 403 red_team_requires_10_seats は「Pro/Trial かつ契約シート 10 以上」の
+    // エンタイトルメント不足。サーバー側が唯一の判断者なので、ここでは
+    // メッセージをそのまま見せる。
+    console.error(`red-team install failed: ${e.message}`);
+    process.exit(1);
+  }
+}
+
+async function cmdRedTeamUninstall(opts) {
+  const home = resolveCallerHome();
+  const scope = opts.scope || "user";
+  const { uninstallRedTeam } = await import("./red-team.mjs");
+  await uninstallRedTeam({
+    scope,
+    home: scope === "user" ? home : process.cwd(),
+    dryRun: opts.dryRun,
+  });
+}
+
+function rejectRemovedFlags(argv) {
+  const args = argv.slice(2);
+  if (args.some((a) => a === "--scheduled" || a === "--interval" || a.startsWith("--interval="))) {
+    console.error(REMOVED_SCHEDULED_FLAGS_MESSAGE);
+    process.exit(1);
+  }
+  if (args.includes("--with-sentinel")) {
+    console.error(REMOVED_WITH_SENTINEL_MESSAGE);
+    process.exit(1);
+  }
+}
+
 export async function run(argv) {
+  rejectRemovedFlags(argv);
   const program = new Command();
   program
     .name("aidr")
@@ -608,12 +636,9 @@ export async function run(argv) {
     .option("--no-verify", "skip /verify call")
     .option("--skip-binary", "skip binary download", false)
     .option("--scope <project|user>", "installation scope: user ($HOME) or project (cwd)", "user")
+    .option("--local", "install on this local PC anyway (ai-scanner targets cloud/CI agent environments; a personal PC should run coworker-sentinel)", false)
     .option("-y, --yes", "proceed without confirmation when existing settings.json is detected", false)
     .option("--uninstall", "remove all ai-scanner hooks/scripts/binaries for the selected agents (see 'uninstall' command)", false)
-    .option("--scheduled", "enable scheduled endpoint-info collection (creates a cron/systemd/launchd entry; without this flag endpoint-info is never collected)", false)
-    .option("--interval <hours>", "scheduled scan interval in hours (min 1, default 4; requires --scheduled)", "4")
-    .option("--with-sentinel", "install coworker-sentinel host-level EDR daemon (Pro/Trial plan; requires sudo)", false)
-    .option("--browser-extension", "install browser extension native messaging host for Shadow IT network monitoring (default: disabled)", false)
     .action(cmdInstall);
 
   program
@@ -626,6 +651,28 @@ export async function run(argv) {
     .option("--dry-run", "print what would be removed without touching disk", false)
     .action(cmdUninstall);
 
+  const redTeam = program
+    .command("red-team")
+    .description("Red Team network vulnerability scanner (MCP server for Claude Code)");
+
+  redTeam
+    .command("install")
+    .description("Download the scanner and register it as an MCP server")
+    .option("--agent <name>", "target agent (only 'claude' is supported)", "claude")
+    .requiredOption("--key <ak_xxx>", "access key (ak_<43-char>)")
+    .option("--env <env>", "target environment: dev|prod (default: auto-detected from package name)")
+    .option("--scope <project|user>", "installation scope: user ($HOME) or project (cwd)", "user")
+    .option("--no-verify", "skip /verify call")
+    .option("--dry-run", "print planned actions, do not touch disk", false)
+    .action(cmdRedTeamInstall);
+
+  redTeam
+    .command("uninstall")
+    .description("Remove the MCP server registration and the downloaded scanner")
+    .option("--scope <project|user>", "scope: user ($HOME) or project (cwd)", "user")
+    .option("--dry-run", "print what would be removed without touching disk", false)
+    .action(cmdRedTeamUninstall);
+
   program.command("doctor").action(cmdDoctor);
   program.command("list-agents").action(cmdListAgents);