agenshield 0.11.4 → 0.11.5-beta.542

package/bin/agenshield

@@ -87,6 +87,16 @@ find_installed() {
     return 0
   done
   IFS="$OLDIFS"
+  # The macOS .pkg installs the real CLI at /Library/AgenShield/bin and only
+  # symlinks it onto PATH as /usr/local/bin/agenshield. A half-finished uninstall
+  # can delete that symlink while the binary itself survives — the PATH scan
+  # above then misses a perfectly runnable uninstaller. Check the canonical .pkg
+  # location directly so `uninstall` (and every other command) delegates to the
+  # real CLI instead of falling back to residue cleanup / bootstrap.
+  if [ -x "/Library/AgenShield/bin/agenshield" ]; then
+    echo "/Library/AgenShield/bin/agenshield"
+    return 0
+  fi
   return 1
 }
 
@@ -122,11 +132,143 @@ print_manual_cleanup_hint() {
   echo "    sudo rm -rf /Library/AgenShield /opt/agenshield /Applications/AgenShield.app" >&2
   echo "    rm -rf \"\$HOME/.agenshield\"" >&2
   echo "    rm -f \"\$HOME/Library/LaunchAgents/com.frontegg.AgenShield.\"*.plist" >&2
+  echo "    sudo security delete-certificate -c \"AgenShield CA\" /Library/Keychains/System.keychain" >&2
   echo "    launchctl unsetenv NODE_EXTRA_CA_CERTS; unset NODE_EXTRA_CA_CERTS" >&2
   echo "  Then fully quit & reopen your terminal and GUI apps (Cursor, Claude Desktop, VS Code)" >&2
   echo "  so they drop the stale NODE_EXTRA_CA_CERTS value." >&2
 }
 
+# ── macOS: remove AgenShield residue in-process (no reinstall) ──────────────
+# Reached by `uninstall` when no runnable CLI binary remains but artifacts do.
+# The thorough uninstaller lives in the CLI binary, but on macOS the only
+# published artifact is the full signed .pkg — there is no CLI-only download to
+# bootstrap, and installing the .pkg would REINSTALL the whole product (daemon +
+# ES/NE system extensions + LaunchDaemons) just to tear it down, via a GUI
+# installer that lays nothing down synchronously. So we reproduce the residue
+# cleanup the CLI uninstaller performs, in-process. This mirrors
+# tools/build/test-uninstall.sh and ADDS the System-keychain CA removal a plain
+# `rm` skips (a leftover trusted root is a MITM risk). Best-effort throughout:
+# every step is guarded so one failure never aborts the rest. It mutates
+# privileged system state, so we confirm first (skip with -f/--force; a
+# non-interactive pipe prints the manual hint instead of destroying silently).
+macos_residue_uninstall() {
+  _force=0
+  for _a in "$@"; do
+    case "$_a" in -f|--force) _force=1 ;; esac
+  done
+
+  echo "agenshield: no runnable binary found, but AgenShield artifacts remain on this Mac." >&2
+  echo "  This removes AgenShield: app, daemon, system extensions, CA trust, config, and data." >&2
+  if [ "$_force" != "1" ]; then
+    if [ -t 0 ] && [ -t 1 ]; then
+      printf "  Continue? [y/N] " >&2
+      read -r _ans || _ans=""
+      case "$_ans" in
+        y | Y | yes | YES) : ;;
+        *)
+          echo "  Cancelled — nothing was removed." >&2
+          return 0
+          ;;
+      esac
+    else
+      # Non-interactive and not --force: never destroy silently.
+      print_manual_cleanup_hint
+      return 0
+    fi
+  fi
+
+  # Privileged paths (/Library, /opt, the /usr/local symlink, the System
+  # keychain, system-domain launchd) need root; user-session paths do not.
+  SUDO=""
+  if [ "$(id -u)" -ne 0 ]; then SUDO="sudo"; fi
+  if [ -n "$SUDO" ] && ! sudo -v 2>/dev/null; then
+    echo "agenshield: administrator access is required to finish removing AgenShield." >&2
+    print_manual_cleanup_hint
+    return 0
+  fi
+
+  # The GUI console user owns the menubar app + the launchd session env vars.
+  _cuser="$(stat -f %Su /dev/console 2>/dev/null || echo '')"
+  _cuid=""
+  if [ -n "$_cuser" ] && [ "$_cuser" != "root" ]; then
+    _cuid="$(id -u "$_cuser" 2>/dev/null || echo '')"
+  fi
+
+  echo "agenshield: removing AgenShield…" >&2
+
+  # 1. Stop the daemon/helper + the menubar and dashboard apps.
+  $SUDO launchctl bootout system/com.frontegg.AgenShield.daemon 2>/dev/null || true
+  $SUDO launchctl bootout system/com.frontegg.AgenShield.privilege-helper 2>/dev/null || true
+  if [ -n "$_cuid" ]; then
+    $SUDO launchctl bootout "gui/$_cuid/com.frontegg.AgenShield.menubar" 2>/dev/null || true
+  fi
+  killall AgenShield 2>/dev/null || true
+  killall "AgenShield Dashboard" 2>/dev/null || true
+
+  # 2. Ask the app (while it still exists) to deactivate the ES + NE system
+  #    extensions — the only non-developer-mode path. Bounded so a pending
+  #    approval prompt can't hang the uninstall (macOS /bin/sh has no `timeout`);
+  #    if it can't finish, deleting the app schedules removal on next reboot.
+  if [ -x "/Applications/AgenShield.app/Contents/MacOS/AgenShield" ] && [ -n "$_cuid" ]; then
+    ($SUDO launchctl asuser "$_cuid" sudo -u "$_cuser" \
+      /Applications/AgenShield.app/Contents/MacOS/AgenShield --uninstall-all >/dev/null 2>&1) &
+    _deact=$!
+    _i=0
+    while [ "$_i" -lt 20 ]; do
+      kill -0 "$_deact" 2>/dev/null || break
+      sleep 1
+      _i=$((_i + 1))
+    done
+    kill -9 "$_deact" 2>/dev/null || true
+  fi
+
+  # 3. Remove the AgenShield CA from the System keychain (sweep by CN, delete by
+  #    SHA-1) — mirrors the CLI's removeInstalledCaTrust.
+  $SUDO /usr/bin/security find-certificate -a -Z -c "AgenShield" /Library/Keychains/System.keychain 2>/dev/null |
+    while IFS= read -r _line; do
+      case "$_line" in
+        "SHA-1 hash: "*)
+          _sha1="${_line#SHA-1 hash: }"
+          $SUDO /usr/bin/security delete-certificate -Z "$_sha1" /Library/Keychains/System.keychain >/dev/null 2>&1 || true
+          ;;
+      esac
+    done
+
+  # 4. Clear the node-ca-trust LaunchAgent + the NODE_EXTRA_CA_CERTS it sets in
+  #    the user's launchd session (it points at the CA we just removed).
+  if [ -n "$_cuid" ]; then
+    $SUDO launchctl bootout "gui/$_cuid/com.frontegg.AgenShield.node-ca-trust" 2>/dev/null || true
+    if [ "$(id -u)" -eq 0 ]; then
+      launchctl asuser "$_cuid" /bin/launchctl unsetenv NODE_EXTRA_CA_CERTS 2>/dev/null || true
+    else
+      /bin/launchctl unsetenv NODE_EXTRA_CA_CERTS 2>/dev/null || true
+    fi
+  fi
+
+  # 5. Remove LaunchDaemon plists + every AgenShield user LaunchAgent.
+  $SUDO rm -f /Library/LaunchDaemons/com.frontegg.AgenShield.daemon.plist \
+    /Library/LaunchDaemons/com.frontegg.AgenShield.privilege-helper.plist 2>/dev/null || true
+  rm -f "$HOME/Library/LaunchAgents/com.frontegg.AgenShield."*.plist 2>/dev/null || true
+
+  # 6. Remove binaries, the app, root config, and per-user data.
+  $SUDO rm -f /usr/local/bin/agenshield 2>/dev/null || true
+  $SUDO rm -rf /Library/AgenShield /opt/agenshield /Applications/AgenShield.app 2>/dev/null || true
+  rm -rf "$HOME/.agenshield" 2>/dev/null || true
+
+  echo "" >&2
+  echo "agenshield: AgenShield removed." >&2
+  # `launchctl unsetenv` only affects future launches; already-running processes
+  # keep the stale value until restarted.
+  if [ -n "${NODE_EXTRA_CA_CERTS:-}" ]; then
+    echo "  This shell still has NODE_EXTRA_CA_CERTS set — run:  unset NODE_EXTRA_CA_CERTS" >&2
+  fi
+  echo "  Fully quit & reopen your terminal and GUI apps (Cursor, Claude Desktop, VS Code)" >&2
+  echo "  so they drop the stale NODE_EXTRA_CA_CERTS value." >&2
+  if /usr/bin/systemextensionsctl list 2>/dev/null | grep -q "com.frontegg.AgenShield"; then
+    echo "  Reboot to finish removing the AgenShield system extensions." >&2
+  fi
+}
+
 # ── `install` → run the full installer with the user's args ─────────────────
 # install.sh handles the macOS .pkg / Linux tarball download + checksum verify
 # + enrollment (--token/--cloud-url/--org) + service setup.
@@ -147,27 +289,43 @@ if [ "${1:-}" = "install" ]; then
   exec env AGENSHIELD_VERSION="$WRAPPER_VERSION" sh "$INSTALLER" "$@"
 fi
 
-# ── `uninstall` → delegate if installed, else bootstrap+run when residue remains ─
+# ── `uninstall` → delegate if installed, else clean up residue ──────────────
 # `npx agenshield uninstall` must remove AgenShield even after the binary itself
-# is gone but system residue remains. Three cases:
+# is gone but system residue remains. Cases:
 #   1. A runnable binary exists → delegate to it (the real, thorough uninstaller).
-#   2. No binary, but residue   → bootstrap the signed binary from GitHub Releases
-#      detected                   (--skip-services) and run the REAL uninstaller —
-#                                 the only thing that removes the keychain CA,
-#                                 sandbox users, ACLs, the node-ca-trust LaunchAgent
-#                                 + its NODE_EXTRA_CA_CERTS env, LaunchDaemons, etc.
-#                                 If the bootstrap download fails (offline / no
-#                                 published release), print manual cleanup steps.
-#   3. No binary, no residue    → genuinely nothing to do; report and exit 0.
-# Bootstrapping ONLY when residue is present avoids the re-download churn the old
-# code guarded against: a successful uninstall removes the residue, so the next
-# run lands in case 3 and exits cleanly.
+#   2. No binary, but residue, on macOS → remove the residue IN-PROCESS
+#      (macos_residue_uninstall). macOS publishes only the full signed .pkg, so
+#      there is no CLI-only artifact to bootstrap, and installing the .pkg would
+#      REINSTALL the entire product (daemon + ES/NE system extensions +
+#      LaunchDaemons) — via a GUI installer that lays nothing down synchronously —
+#      just to tear it down. Bootstrapping was the original design here; it
+#      surfaced the macOS "uninstall opened the installer GUI, then reported
+#      'could not bootstrap the uninstaller'" bug. macos_residue_uninstall covers
+#      the keychain CA, system extensions, the node-ca-trust LaunchAgent + its
+#      NODE_EXTRA_CA_CERTS env, LaunchDaemons, dirs, and the dangling symlink.
+#   3. No binary, but residue, on other platforms → bootstrap the CLI-only
+#      tarball (--skip-services) and run the REAL uninstaller; on a download
+#      failure (offline / no published release), print manual cleanup steps.
+#   4. No binary, no residue → genuinely nothing to do; report and exit 0.
+# Acting only when residue is present means a successful uninstall removes the
+# residue, so a second run lands in case 4 and exits cleanly — no churn.
 if [ "${1:-}" = "uninstall" ]; then
   BIN="$(find_installed || true)"
   if [ -n "$BIN" ]; then
     exec "$BIN" "$@"
   fi
   if agenshield_residue_present; then
+    # No runnable CLI binary, but AgenShield residue remains. macOS cannot
+    # bootstrap the thorough uninstaller — the only published artifact is the
+    # full signed .pkg, and installing it would REINSTALL the whole product (via
+    # an interactive GUI installer that lays nothing down synchronously) just to
+    # remove it. So remove the residue in-process here. Other platforms publish a
+    # CLI-only tarball, so they can lay the binary down and run the real
+    # uninstaller below.
+    if [ "$OS" = "darwin" ]; then
+      macos_residue_uninstall "$@"
+      exit 0
+    fi
     if [ ! -f "$INSTALLER" ]; then
       echo "agenshield: leftover AgenShield artifacts detected, but the bundled installer is missing." >&2
       print_manual_cleanup_hint

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agenshield",
-  "version": "0.11.4",
+  "version": "0.11.5-beta.542",
   "description": "AgenShield — AI Agent Security Platform",
   "bin": {
     "agenshield": "bin/agenshield"