@coworker-jp/aidr 0.1.299 → 0.1.302

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coworker-jp/aidr",
-  "version": "0.1.299",
+  "version": "0.1.302",
   "description": "AIDR setup CLI - installs ai-scanner hooks for 19+ AI coding agents",
   "type": "module",
   "bin": {

package/src/cli.mjs

@@ -80,6 +80,11 @@ async function cmdInstall(opts) {
   // the relevant options (agent, all, scope, yes, dry-run) to the uninstall
   // flow. --key isn't needed but commander requires it via requiredOption,
   // so we accept and ignore it.
+  //
+  // `--purge` is deliberately NOT reachable through this alias (issue #1958):
+  // it is the one option that deletes the quarantined package archives, and a
+  // convenience alias is the wrong place to be able to destroy evidence from.
+  // `aidr uninstall --purge` is the only spelling.
   if (opts.uninstall) {
     return cmdUninstall({
       agent: opts.agent,
@@ -468,6 +473,18 @@ async function cmdUninstall(opts) {
     }
   }
 
+  // ai-scanner's own state (issue #1958). Resolved BEFORE phase 3: on an
+  // endpoint that only ever ran `aidr install`, the per-agent copies are the
+  // only ai-scanner binaries on the machine, and phase 3 deletes them.
+  const { scannerBinaryCandidates, findScannerBinary, cleanScannerState, describeScannerState } =
+    await import("./scanner-state.mjs");
+  const scannerBinary = await findScannerBinary(
+    scannerBinaryCandidates(home, plans.map(({ mod }) => mod?.meta?.agentDir))
+  );
+  for (const line of describeScannerState({ outcome: scannerBinary ? "dry-run" : "no-binary", binary: scannerBinary }, { purge: opts.purge })) {
+    console.error(line);
+  }
+
   if (opts.dryRun) return;
 
   // Phase 2: confirm
@@ -484,7 +501,15 @@ async function cmdUninstall(opts) {
     }
   }
 
-  // Phase 3: execute
+  // Phase 3a: the scanner's own state, while its binaries still exist.
+  for (const line of describeScannerState(
+    cleanScannerState({ binary: scannerBinary, purge: opts.purge }),
+    { purge: opts.purge }
+  )) {
+    console.log(line);
+  }
+
+  // Phase 3b: execute
   await Promise.all(plans.map(async ({ name, mod }) => {
     try {
       const res = await mod.uninstall(base, { dryRun: false });
@@ -834,6 +859,7 @@ export async function run(argv) {
     .option("--scope <project|user>", "scope: user ($HOME) or project (cwd)", "user")
     .option("-y, --yes", "proceed without confirmation prompt", false)
     .option("--dry-run", "print what would be removed without touching disk", false)
+    .option("--purge", "also delete the quarantined package archives (they are evidence, so an ordinary uninstall keeps them)", false)
     .action(cmdUninstall);
 
   const redTeam = program

package/src/scanner-state.mjs

@@ -0,0 +1,152 @@
+/**
+ * ai-scanner's own on-disk state, at uninstall time (issue #1958).
+ *
+ * `aidr uninstall` used to remove hooks, adapter scripts and the per-agent
+ * binaries, and nothing else. The scanner's state directory
+ * (`~/.coworker/aidr/{ai-scanner,quarantine}`) survived every uninstall, which
+ * is wrong in both directions:
+ *
+ *   - **Reinstalling did not reset anything.** The 7-day-rule verdict cache
+ *     came back with the endpoint, so "uninstall it and install it again" —
+ *     the support step a customer is told to take — did not do what it says.
+ *   - **The quarantined package archives were left with no owner.** They are
+ *     specimens of the packages this endpoint blocked, i.e. evidence, sitting
+ *     in a directory of a product that is no longer installed and that nothing
+ *     tells the user about.
+ *
+ * ## What decides what goes
+ *
+ * Nothing here. The rule — caches go, archives stay unless a purge was asked
+ * for — lives in `ScannerPaths::uninstall_state` (docker/scanner/src/paths.rs)
+ * and is reached by running the binary's own `uninstall-state` subcommand. The
+ * debian `postrm`, the Windows uninstaller and the macOS teardown call the same
+ * subcommand for the same reason: a policy transcribed into four languages
+ * drifts in three of them, and the direction it drifts in is "somebody deleted
+ * the evidence".
+ *
+ * ## Why the binary must be run BEFORE the agent directories are removed
+ *
+ * On an endpoint that only ever ran `aidr install`, the per-agent copies are
+ * the only ai-scanner binaries on the machine. Remove them first and there is
+ * nothing left to ask.
+ */
+import path from "path";
+import fs from "fs/promises";
+import { spawnSync } from "child_process";
+
+/** Executable name, per platform. */
+export const SCANNER_EXE =
+  process.platform === "win32" ? "ai-scanner.exe" : "ai-scanner";
+
+/**
+ * Locations an OS-native installer or the sentinel daemon provisions, in
+ * preference order. Mirrors `scheduler::default_scanner_paths()` on the Rust
+ * side; kept as its own function so a test can assert both platforms without
+ * being run on both.
+ */
+export function systemScannerPaths(platform = process.platform, env = process.env) {
+  if (platform === "win32") {
+    const pf = env.ProgramFiles || "C:\\Program Files";
+    return [path.join(pf, "coworker", "aidr", "bin", "ai-scanner.exe")];
+  }
+  return ["/opt/coworker/aidr/bin/ai-scanner", "/usr/local/bin/ai-scanner"];
+}
+
+/**
+ * Every place this uninstall could find a scanner binary: the agents being
+ * uninstalled first (they are the copies `aidr install` put there, and the
+ * only ones on an agent-only endpoint), then the OS-native locations.
+ */
+export function scannerBinaryCandidates(home, agentDirs, platform = process.platform, env = process.env) {
+  const exe = platform === "win32" ? "ai-scanner.exe" : "ai-scanner";
+  const perAgent = (agentDirs || [])
+    .filter(Boolean)
+    .map((d) => path.join(home, d, "bin", exe));
+  return [...perAgent, ...systemScannerPaths(platform, env)];
+}
+
+/** First candidate that exists, or `null`. */
+export async function findScannerBinary(candidates, { access } = {}) {
+  const probe = access || ((p) => fs.access(p, fs.constants.X_OK));
+  for (const candidate of candidates) {
+    try {
+      await probe(candidate);
+      return candidate;
+    } catch {
+      // Try the next one. A candidate that is missing, or present but not
+      // executable, is equally unusable here.
+    }
+  }
+  return null;
+}
+
+/**
+ * Ask the scanner to remove its own state.
+ *
+ * Returns `{ outcome, binary, status, stdout, stderr }` where `outcome` is one
+ * of `"cleaned"`, `"unresolved"` (the binary ran and reported something is
+ * still on the machine), `"failed"` (it could not be run) or `"no-binary"`.
+ *
+ * **`"no-binary"` is not success.** It is the case where we do not know what
+ * is on this machine, and the caller has to say so rather than print the same
+ * reassuring line it prints for a clean sweep.
+ */
+export function cleanScannerState({ binary, purge = false, dryRun = false, run = spawnSync }) {
+  if (!binary) return { outcome: "no-binary", binary: null };
+  if (dryRun) return { outcome: "dry-run", binary };
+  const args = purge ? ["uninstall-state", "--purge"] : ["uninstall-state"];
+  const res = run(binary, args, { encoding: "utf8" });
+  if (res.error) {
+    return { outcome: "failed", binary, error: res.error.message };
+  }
+  return {
+    outcome: res.status === 0 ? "cleaned" : "unresolved",
+    binary,
+    status: res.status,
+    stdout: res.stdout || "",
+    stderr: res.stderr || "",
+  };
+}
+
+/**
+ * The lines a user sees. Split out from `cleanScannerState` so the wording can
+ * be asserted without spawning anything.
+ *
+ * Every branch ends on what to do next. A line that stops at "could not" reads,
+ * to someone who has just uninstalled a security product, as "so there is
+ * nothing to worry about" — and in the `"no-binary"` branch we specifically do
+ * not know that.
+ */
+export function describeScannerState(result, { purge = false } = {}) {
+  switch (result.outcome) {
+    case "dry-run":
+      return [
+        `  [scanner] ${purge ? "remove" : "clear"}  this endpoint's scanner state via ${result.binary} uninstall-state${purge ? " --purge" : ""}`,
+        purge
+          ? "            (cached verdicts AND the quarantined package archives)"
+          : "            (cached verdicts; quarantined package archives are kept and their location is printed)",
+      ];
+    case "cleaned":
+      return (result.stdout || "").split("\n").filter(Boolean).map((l) => `[scanner] ${l}`);
+    case "unresolved":
+      return [
+        ...(result.stdout || "").split("\n").filter(Boolean).map((l) => `[scanner] ${l}`),
+        ...(result.stderr || "").split("\n").filter(Boolean).map((l) => `[scanner] ${l}`),
+        "[scanner] Some of this endpoint's scanner state is still on the machine (listed above).",
+        "[scanner] Next: delete those paths yourself, or ask your IT administrator to.",
+      ];
+    case "failed":
+      return [
+        `[scanner] ${result.binary} could not be run (${result.error}), so this endpoint's scanner state was left where it is.`,
+        "[scanner] It is under ~/.coworker/aidr/ unless AI_SCANNER_DATA_DIR / AI_SCANNER_QUARANTINE_DIR name another location.",
+        "[scanner] Next: delete that directory yourself, or ask your IT administrator to.",
+      ];
+    case "no-binary":
+    default:
+      return [
+        "[scanner] No ai-scanner binary was found on this endpoint, so its state was left where it is.",
+        "[scanner] It is under ~/.coworker/aidr/ unless AI_SCANNER_DATA_DIR / AI_SCANNER_QUARANTINE_DIR name another location, and it holds the quarantined package archives this endpoint kept as evidence.",
+        "[scanner] Next: delete that directory yourself once you no longer need it, or ask your IT administrator to.",
+      ];
+  }
+}