@coworker-jp/aidr 0.1.298 → 0.1.301

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coworker-jp/aidr",
-  "version": "0.1.298",
+  "version": "0.1.301",
   "description": "AIDR setup CLI - installs ai-scanner hooks for 19+ AI coding agents",
   "type": "module",
   "bin": {

package/src/cli.mjs

@@ -80,6 +80,11 @@ async function cmdInstall(opts) {
   // the relevant options (agent, all, scope, yes, dry-run) to the uninstall
   // flow. --key isn't needed but commander requires it via requiredOption,
   // so we accept and ignore it.
+  //
+  // `--purge` is deliberately NOT reachable through this alias (issue #1958):
+  // it is the one option that deletes the quarantined package archives, and a
+  // convenience alias is the wrong place to be able to destroy evidence from.
+  // `aidr uninstall --purge` is the only spelling.
   if (opts.uninstall) {
     return cmdUninstall({
       agent: opts.agent,
@@ -468,6 +473,18 @@ async function cmdUninstall(opts) {
     }
   }
 
+  // ai-scanner's own state (issue #1958). Resolved BEFORE phase 3: on an
+  // endpoint that only ever ran `aidr install`, the per-agent copies are the
+  // only ai-scanner binaries on the machine, and phase 3 deletes them.
+  const { scannerBinaryCandidates, findScannerBinary, cleanScannerState, describeScannerState } =
+    await import("./scanner-state.mjs");
+  const scannerBinary = await findScannerBinary(
+    scannerBinaryCandidates(home, plans.map(({ mod }) => mod?.meta?.agentDir))
+  );
+  for (const line of describeScannerState({ outcome: scannerBinary ? "dry-run" : "no-binary", binary: scannerBinary }, { purge: opts.purge })) {
+    console.error(line);
+  }
+
   if (opts.dryRun) return;
 
   // Phase 2: confirm
@@ -484,7 +501,15 @@ async function cmdUninstall(opts) {
     }
   }
 
-  // Phase 3: execute
+  // Phase 3a: the scanner's own state, while its binaries still exist.
+  for (const line of describeScannerState(
+    cleanScannerState({ binary: scannerBinary, purge: opts.purge }),
+    { purge: opts.purge }
+  )) {
+    console.log(line);
+  }
+
+  // Phase 3b: execute
   await Promise.all(plans.map(async ({ name, mod }) => {
     try {
       const res = await mod.uninstall(base, { dryRun: false });
@@ -834,6 +859,7 @@ export async function run(argv) {
     .option("--scope <project|user>", "scope: user ($HOME) or project (cwd)", "user")
     .option("-y, --yes", "proceed without confirmation prompt", false)
     .option("--dry-run", "print what would be removed without touching disk", false)
+    .option("--purge", "also delete the quarantined package archives (they are evidence, so an ordinary uninstall keeps them)", false)
     .action(cmdUninstall);
 
   const redTeam = program

package/src/merge.mjs

@@ -150,6 +150,73 @@ export function buildCursorHooksJson(scope = "project", absHome = "") {
 }
 
 // Windsurf hooks.json — flat entries, one command per event (no matcher).
+//
+// NO `timeout` HERE, AND THAT IS DELIBERATE (#1896). Windsurf's hook entry
+// schema has no such field: the documented entry keys are `command`,
+// `powershell`, `show_output` and `working_directory`, and the page says
+// nothing about any time limit at all (docs.windsurf.com/windsurf/cascade/hooks
+// → docs.devin.ai/desktop/cascade/hooks, read 2026-08-25). The other four
+// agents each declare one because their schemas accept it; Windsurf cannot,
+// so this is a DECLARED inequality rather than an oversight — which is the
+// whole reason this comment exists. Emitting an unknown key would not buy a
+// cap and could be rejected by a future schema validation.
+//
+// What bounds a Windsurf hook instead: the in-script `run_scanner` cap
+// (`AI_SCANNER_HOOK_TIMEOUT`, default 30s) plus `ensure_scanner.sh`'s
+// `flock -w 120`. Those are OUR caps, so they hold on every editor — but
+// there is no second, editor-side net here the way there is elsewhere.
+// `tests/merge-hooks-json.test.mjs` pins both directions of that statement.
+//
+// NO `powershell` HERE EITHER, AND THAT IS A DECLARED INEQUALITY (#1907) —
+// it is NOT a claim that Windows is covered.
+//
+// What the vendor actually documents (docs.windsurf.com/windsurf/cascade/hooks
+// → docs.devin.ai/desktop/cascade/hooks, read 2026-08-25, quoted verbatim):
+//
+//   command     "The shell command to execute on **macOS/Linux** (run via
+//                `bash -c`). At least one of `command` or `powershell` must
+//                be specified."
+//   powershell  "Optional. The command to execute on **Windows** (run via
+//                `powershell -Command`). If omitted on Windows, `command` is
+//                used as a fallback."
+//
+//   and its cross-platform table, for the row we are actually in:
+//   | Windows | `command` ✓ | `powershell` ✗ | Falls back to `command` via `powershell -Command` |
+//
+// So on Windows the entry is NOT skipped. #1907 was filed on the assumption
+// that it would be; the primary source says otherwise, and this comment is
+// the corrected record. The real question is narrower and still open: what
+// gets handed to `powershell -Command` is THE PATH OF A POSIX SHELL SCRIPT
+// (`.windsurf/coworker-ai/pre_command.sh`), and every hook adapter this
+// product ships — all five agents, 42 files — is a `.sh`. There is no
+// Windows-native adapter anywhere in this tree to point a `powershell` key at.
+//
+// Why the outcome is invisible either way: the same page's exit-code table
+// says `0` proceeds, `2` blocks, and "Any other | Error | Action proceeds
+// normally". A fallback that fires and cannot run therefore produces the same
+// user-visible result as a scan that ran and found nothing. Fail-open is
+// deliberate, and it is exactly what hides this.
+//
+// UNMEASURED: whether that fallback reaches ai-scanner on a real Windows
+// machine. This development host has no Windows machine with Windsurf on it.
+//
+// Two wrong moves, spelled out so nobody makes them from this comment alone:
+//   * emit `powershell: "bash <path>.sh"` — plausible, and unverified. If Git
+//     Bash is not on PATH it exits non-zero, which the table above turns into
+//     "proceeds normally" — the same silent gap, now with a tree that CLAIMS
+//     Windows is handled. A bare `bash` on Windows can also resolve to WSL's
+//     `C:\Windows\System32\bash.exe`, which sees a different filesystem than
+//     the path we wrote.
+//   * delete this comment because "the docs say it falls back" — the fallback
+//     is documented; the fallback WORKING is not.
+//
+// HOW THIS INEQUALITY RETIRES (so it cannot sit here forever): install
+// Windsurf on a Windows machine, install these hooks, and drive a pre_* hook
+// with an input the scanner MUST block. Judge on the block (exit 2), not on a
+// log line or a telemetry field — fail-open makes "ran and allowed" and
+// "never ran" byte-identical. Then either delete this block (it reaches the
+// scanner) or add the `powershell` value the measurement showed to be right.
+// `tests/merge-hooks-json.test.mjs` pins both directions until that day.
 export function buildWindsurfHooksJson(scope = "project", absHome = "") {
   const p = scope === "user" ? `${absHome}/.windsurf/coworker-ai` : ".windsurf/coworker-ai";
   return {

package/src/scanner-state.mjs

@@ -0,0 +1,152 @@
+/**
+ * ai-scanner's own on-disk state, at uninstall time (issue #1958).
+ *
+ * `aidr uninstall` used to remove hooks, adapter scripts and the per-agent
+ * binaries, and nothing else. The scanner's state directory
+ * (`~/.coworker/aidr/{ai-scanner,quarantine}`) survived every uninstall, which
+ * is wrong in both directions:
+ *
+ *   - **Reinstalling did not reset anything.** The 7-day-rule verdict cache
+ *     came back with the endpoint, so "uninstall it and install it again" —
+ *     the support step a customer is told to take — did not do what it says.
+ *   - **The quarantined package archives were left with no owner.** They are
+ *     specimens of the packages this endpoint blocked, i.e. evidence, sitting
+ *     in a directory of a product that is no longer installed and that nothing
+ *     tells the user about.
+ *
+ * ## What decides what goes
+ *
+ * Nothing here. The rule — caches go, archives stay unless a purge was asked
+ * for — lives in `ScannerPaths::uninstall_state` (docker/scanner/src/paths.rs)
+ * and is reached by running the binary's own `uninstall-state` subcommand. The
+ * debian `postrm`, the Windows uninstaller and the macOS teardown call the same
+ * subcommand for the same reason: a policy transcribed into four languages
+ * drifts in three of them, and the direction it drifts in is "somebody deleted
+ * the evidence".
+ *
+ * ## Why the binary must be run BEFORE the agent directories are removed
+ *
+ * On an endpoint that only ever ran `aidr install`, the per-agent copies are
+ * the only ai-scanner binaries on the machine. Remove them first and there is
+ * nothing left to ask.
+ */
+import path from "path";
+import fs from "fs/promises";
+import { spawnSync } from "child_process";
+
+/** Executable name, per platform. */
+export const SCANNER_EXE =
+  process.platform === "win32" ? "ai-scanner.exe" : "ai-scanner";
+
+/**
+ * Locations an OS-native installer or the sentinel daemon provisions, in
+ * preference order. Mirrors `scheduler::default_scanner_paths()` on the Rust
+ * side; kept as its own function so a test can assert both platforms without
+ * being run on both.
+ */
+export function systemScannerPaths(platform = process.platform, env = process.env) {
+  if (platform === "win32") {
+    const pf = env.ProgramFiles || "C:\\Program Files";
+    return [path.join(pf, "coworker", "aidr", "bin", "ai-scanner.exe")];
+  }
+  return ["/opt/coworker/aidr/bin/ai-scanner", "/usr/local/bin/ai-scanner"];
+}
+
+/**
+ * Every place this uninstall could find a scanner binary: the agents being
+ * uninstalled first (they are the copies `aidr install` put there, and the
+ * only ones on an agent-only endpoint), then the OS-native locations.
+ */
+export function scannerBinaryCandidates(home, agentDirs, platform = process.platform, env = process.env) {
+  const exe = platform === "win32" ? "ai-scanner.exe" : "ai-scanner";
+  const perAgent = (agentDirs || [])
+    .filter(Boolean)
+    .map((d) => path.join(home, d, "bin", exe));
+  return [...perAgent, ...systemScannerPaths(platform, env)];
+}
+
+/** First candidate that exists, or `null`. */
+export async function findScannerBinary(candidates, { access } = {}) {
+  const probe = access || ((p) => fs.access(p, fs.constants.X_OK));
+  for (const candidate of candidates) {
+    try {
+      await probe(candidate);
+      return candidate;
+    } catch {
+      // Try the next one. A candidate that is missing, or present but not
+      // executable, is equally unusable here.
+    }
+  }
+  return null;
+}
+
+/**
+ * Ask the scanner to remove its own state.
+ *
+ * Returns `{ outcome, binary, status, stdout, stderr }` where `outcome` is one
+ * of `"cleaned"`, `"unresolved"` (the binary ran and reported something is
+ * still on the machine), `"failed"` (it could not be run) or `"no-binary"`.
+ *
+ * **`"no-binary"` is not success.** It is the case where we do not know what
+ * is on this machine, and the caller has to say so rather than print the same
+ * reassuring line it prints for a clean sweep.
+ */
+export function cleanScannerState({ binary, purge = false, dryRun = false, run = spawnSync }) {
+  if (!binary) return { outcome: "no-binary", binary: null };
+  if (dryRun) return { outcome: "dry-run", binary };
+  const args = purge ? ["uninstall-state", "--purge"] : ["uninstall-state"];
+  const res = run(binary, args, { encoding: "utf8" });
+  if (res.error) {
+    return { outcome: "failed", binary, error: res.error.message };
+  }
+  return {
+    outcome: res.status === 0 ? "cleaned" : "unresolved",
+    binary,
+    status: res.status,
+    stdout: res.stdout || "",
+    stderr: res.stderr || "",
+  };
+}
+
+/**
+ * The lines a user sees. Split out from `cleanScannerState` so the wording can
+ * be asserted without spawning anything.
+ *
+ * Every branch ends on what to do next. A line that stops at "could not" reads,
+ * to someone who has just uninstalled a security product, as "so there is
+ * nothing to worry about" — and in the `"no-binary"` branch we specifically do
+ * not know that.
+ */
+export function describeScannerState(result, { purge = false } = {}) {
+  switch (result.outcome) {
+    case "dry-run":
+      return [
+        `  [scanner] ${purge ? "remove" : "clear"}  this endpoint's scanner state via ${result.binary} uninstall-state${purge ? " --purge" : ""}`,
+        purge
+          ? "            (cached verdicts AND the quarantined package archives)"
+          : "            (cached verdicts; quarantined package archives are kept and their location is printed)",
+      ];
+    case "cleaned":
+      return (result.stdout || "").split("\n").filter(Boolean).map((l) => `[scanner] ${l}`);
+    case "unresolved":
+      return [
+        ...(result.stdout || "").split("\n").filter(Boolean).map((l) => `[scanner] ${l}`),
+        ...(result.stderr || "").split("\n").filter(Boolean).map((l) => `[scanner] ${l}`),
+        "[scanner] Some of this endpoint's scanner state is still on the machine (listed above).",
+        "[scanner] Next: delete those paths yourself, or ask your IT administrator to.",
+      ];
+    case "failed":
+      return [
+        `[scanner] ${result.binary} could not be run (${result.error}), so this endpoint's scanner state was left where it is.`,
+        "[scanner] It is under ~/.coworker/aidr/ unless AI_SCANNER_DATA_DIR / AI_SCANNER_QUARANTINE_DIR name another location.",
+        "[scanner] Next: delete that directory yourself, or ask your IT administrator to.",
+      ];
+    case "no-binary":
+    default:
+      return [
+        "[scanner] No ai-scanner binary was found on this endpoint, so its state was left where it is.",
+        "[scanner] It is under ~/.coworker/aidr/ unless AI_SCANNER_DATA_DIR / AI_SCANNER_QUARANTINE_DIR name another location, and it holds the quarantined package archives this endpoint kept as evidence.",
+        "[scanner] Next: delete that directory yourself once you no longer need it, or ask your IT administrator to.",
+      ];
+  }
+}

package/src/templates.mjs

@@ -55,6 +55,14 @@ mkdir -p "$BIN_DIR"
 
 # macOS has no base \`timeout\` (it's in GNU coreutils). Shim it so hooks work
 # on fresh Macs without brew install coreutils.
+#
+# NOTE (issue #1879): the last branch — a bare macOS with neither \`timeout\` nor
+# \`gtimeout\` — DROPS the duration and execs directly. On such a machine every
+# \`timeout N "$BIN" ...\` below is unbounded, and the only remaining safety net
+# is the editor's own hook timeout (Claude Code / Codex: 60s, written by
+# merge.mjs; Cursor / Windsurf / Kiro: unverified). Installing coreutils is the
+# documented remedy. The shim is deliberately kept — a hook that refused to run
+# without coreutils would be worse than one that runs unbounded.
 if ! command -v timeout >/dev/null 2>&1; then
     if command -v gtimeout >/dev/null 2>&1; then
         timeout() { gtimeout "$@"; }
@@ -63,6 +71,23 @@ if ! command -v timeout >/dev/null 2>&1; then
     fi
 fi
 
+# Bounds for the two ai-scanner invocations this script makes. Both sit
+# STRICTLY ABOVE the binary's own internal network bound for that subcommand,
+# so the wrapper only ever fires on a genuinely hung binary and never pre-empts
+# a slow-but-working one. (A bound that fires on healthy-but-slow would print
+# the "we did NOT check" message spuriously — a false positive, which is how
+# guards stop being read.)
+#
+#   version: load_plan -> /verify, reqwest timeout 10s
+#            (docker/scanner/src/main.rs). 20s leaves 10s for process start.
+#   update:  /verify (10s) THEN the binary download (30s), sequential
+#            (docker/scanner/src/main.rs cmd_update) = 40s internal worst case.
+#            60s leaves 20s for hashing and the rename. Killing an update
+#            mid-flight is safe: it writes to a temp file in the same directory
+#            and only renames over \$BIN once the advertised hash matches.
+VERSION_TIMEOUT=20
+UPDATE_TIMEOUT=60
+
 # Generic throttle: true (0) if stamp missing or older than PULL_INTERVAL
 should_check_update() {
     [ ! -f "$PULL_STAMP" ] && return 0
@@ -248,7 +273,7 @@ rm -f "$UNSCANNED_STAMP"
 #      operator can act on; "|| true" turned it into silence.
 if should_check_update; then
     want_host=$(printf '%s' "$DOWNLOAD_BASE" | sed -E 's#^[a-z]+://([^/]+).*#\\1#')
-    have_host=$("$BIN" version 2>/dev/null | sed -n 's#^server: [a-z]*://\\([^/]*\\).*#\\1#p' | head -1)
+    have_host=$(timeout "$VERSION_TIMEOUT" "$BIN" version 2>/dev/null | sed -n 's#^server: [a-z]*://\\([^/]*\\).*#\\1#p' | head -1)
     if [ -n "$have_host" ] && [ -n "$want_host" ] && [ "$have_host" != "$want_host" ]; then
         echo "ai-scanner: the installed binary talks to $have_host, but this installation provisions from $want_host, so its access key can never be accepted (detection logs are refused and discarded). Re-downloading the matching binary." >&2
         download_binary "\${DOWNLOAD_BASE}/\${PLATFORM_SLUG}" || \\
@@ -256,7 +281,7 @@ if should_check_update; then
     elif [ -z "$have_host" ]; then
         echo "ai-scanner: could not read which license server the installed binary uses, so the environment match was NOT checked. If detection logs are being refused, re-run the installer." >&2
     fi
-    "$BIN" update 2>/dev/null || \\
+    timeout "$UPDATE_TIMEOUT" "$BIN" update 2>/dev/null || \\
         echo "ai-scanner: the scanner could not update itself just now. It keeps scanning with the rules it already has; if this repeats, re-run the installer or contact your IT administrator." >&2
     date +%s > "$PULL_STAMP"
 fi