bdy 1.23.6-dev → 1.23.7-dev

package/distTs/src/agent/system.js

@@ -12,6 +12,10 @@ const logger_1 = __importDefault(require("../logger"));
 const manager_1 = __importDefault(require("./manager"));
 const output_1 = __importDefault(require("../output"));
 class AgentSystem {
+    // Set by `agent run`, which is only ever started by the service - see getServiceConfig in
+    // the platform classes. Nothing else needs it: a standalone agent runs in the process that
+    // installed or started it, and that one resolves its own directory from disk.
+    serviceMode = false;
     // extend
     /* eslint-disable @typescript-eslint/no-unused-vars */
     async install(_id, _host, _token, _port, _start, _user, _pass, _debug) {
@@ -36,14 +40,125 @@ class AgentSystem {
     getSystemConfigPath() {
         return '';
     }
+    // Where a standalone install kept its lock before those files moved to the user
+    // directory. Still the path for an install made back then - see isUserOwnedInstall.
     getSystemStandalonePath() {
-        return '';
+        return path_1.default.join(this.getSystemConfigDir(), 'pid.lock');
     }
     // extend
     getSystemConfigDir() {
         return '';
     }
+    // `--app` installs no service and runs the agent as the invoking user, so its files
+    // belong to that user: a system location was the only thing making the mode need root.
+    // They get their own directory rather than sitting next to cfg.json, so nothing here can
+    // collide with the legacy `agent.json` that loadNewAgentConfig migrates out of the home
+    // directory.
+    getStandaloneConfigDir() {
+        return path_1.default.join((0, utils_1.getHomeDirectory)(), 'agent');
+    }
+    getStandaloneConfigPath() {
+        return path_1.default.join(this.getStandaloneConfigDir(), 'agent.json');
+    }
+    getStandalonePidPath() {
+        return path_1.default.join(this.getStandaloneConfigDir(), 'pid.lock');
+    }
+    // True when the install this cli would act on is the user's own, which is the case that
+    // needs no admin rights. A service install never is, and neither is a standalone install
+    // written before the move: that one is still in the system directory and has to keep
+    // being managed from there, root and all.
+    isUserOwnedInstall() {
+        // A service reads and writes the system directory whatever `--user` it was given, and
+        // that user may well have an `--app` install of their own in their home - which is not
+        // the install this process is
+        if (this.serviceMode)
+            return false;
+        // One agent per machine, `--app` or service. So when a system config exists it is the
+        // install: it is machine-wide and every account can read it, while a config sitting in
+        // someone's home next to it is a leftover. Letting that leftover win is what made
+        // `sudo bdy agent update` update nothing and `agent user` answer 'not a service'.
+        if ((0, node_fs_1.existsSync)(this.getSystemConfigPath()))
+            return false;
+        try {
+            return (0, node_fs_1.existsSync)(this.getStandaloneConfigPath());
+        }
+        catch {
+            // A home directory that cannot even be resolved holds no install
+            return false;
+        }
+    }
+    // Every home an `--app` install could be sitting in. The containers are read rather than
+    // resolved out of /etc/passwd or dscl: a home somewhere else is a home this cannot see,
+    // which is the same class of miss as one it cannot read.
+    getHomeDirs() {
+        const containers = (0, utils_1.isWindows)()
+            ? ['C:\\Users']
+            : process.platform === 'darwin'
+                ? ['/Users']
+                : ['/home'];
+        // Root's own, which is not inside any of those
+        const homes = (0, utils_1.isWindows)() ? [] : ['/root', '/var/root'];
+        containers.forEach((root) => {
+            try {
+                (0, node_fs_1.readdirSync)(root).forEach((entry) => homes.push(path_1.default.join(root, entry)));
+            }
+            catch {
+                // a container that is not there, or not this account's to read
+            }
+        });
+        return homes;
+    }
+    getStandaloneConfigPathIn(home) {
+        return path_1.default.join(home, utils_1.HOME_DIR_NAME, 'agent', 'agent.json');
+    }
+    // A standalone install is only visible from the account that made it, so a service install
+    // has to go looking rather than land on top of one. Only ever called with root behind it,
+    // and best-effort by nature - a home this cannot read holds an install this cannot see, which
+    // is why the port check stays as the backstop for whatever is actually running.
+    findAppInstalls() {
+        if ((0, utils_1.isDocker)())
+            return [];
+        return this.getHomeDirs().filter((home) => {
+            try {
+                return (0, node_fs_1.existsSync)(this.getStandaloneConfigPathIn(home));
+            }
+            catch {
+                return false;
+            }
+        }).map((home) => this.getStandaloneConfigPathIn(home));
+    }
+    getActiveConfigPath() {
+        if (this.isUserOwnedInstall())
+            return this.getStandaloneConfigPath();
+        return this.getSystemConfigPath();
+    }
+    getActivePidPath() {
+        if (this.isUserOwnedInstall())
+            return this.getStandalonePidPath();
+        return this.getSystemStandalonePath();
+    }
+    // Where a config with this `standalone` flag belongs. A standalone config already in the
+    // system directory was written before the move and is rewritten in place: a second one in
+    // the user directory would leave two configs for one agent, and the one that lost would
+    // be the one uninstall still has to find.
+    getConfigPathForWrite(standalone) {
+        if (!standalone)
+            return this.getSystemConfigPath();
+        if (!(0, node_fs_1.existsSync)(this.getStandaloneConfigPath()) &&
+            (0, node_fs_1.existsSync)(this.getSystemConfigPath())) {
+            return this.getSystemConfigPath();
+        }
+        return this.getStandaloneConfigPath();
+    }
+    // The lock is read back by the cli command that stops the agent, which for an install in the
+    // system directory can be a different account than the one that wrote it - see
+    // applySystemModes for the rest of the modes in there.
+    getPidFileMode() {
+        return this.isUserOwnedInstall() ? 0o600 : 0o644;
+    }
     getNewAgentConfigDir() {
+        if (this.isUserOwnedInstall())
+            return this.getStandaloneConfigDir();
         return this.getSystemConfigDir();
     }
     getAgentConfigDir() {
@@ -61,9 +176,30 @@ class AgentSystem {
         return Promise.resolve();
     }
     // extend
+    // The account the installed service runs as, read back from the service config - the only
+    // place it is recorded. An update needs it: it is the one path that re-applies the rights
+    // without being told a user, and handing the directory to root there would stop a service
+    // that was moved to someone else from writing in it.
+    //
+    // `''` is root, and `null` means this could not be established - a service config that is
+    // missing, unreadable or not in the shape this cli writes. The two must stay apart: treating
+    // 'do not know' as 'root' is what would take the directory off a service user we failed to
+    // recognise, and its agent would then crash-loop unable to write its own log.
+    readServiceUser() {
+        return null;
+    }
+    // extend
     hasAdminRights() {
         return Promise.resolve(false);
     }
+    // What the agent commands ask instead of hasAdminRights: managing an install that lives
+    // in the user's own directory takes no rights at all - there is no service to control and
+    // no system file to rewrite. Everything else still needs them.
+    async hasRightsToManage() {
+        if (this.isUserOwnedInstall())
+            return true;
+        return this.hasAdminRights();
+    }
     // extend
     isSupported() {
         return Promise.resolve(false);
@@ -101,7 +237,7 @@ class AgentSystem {
     }
     fixBinaryRights() {
         return new Promise((resolve, reject) => {
-            (0, node_fs_1.chmod)(this.getSystemBinaryPath(), 0o777, (err) => {
+            (0, node_fs_1.chmod)(this.getSystemBinaryPath(), 0o755, (err) => {
                 if (err)
                     reject(err);
                 else
@@ -110,11 +246,11 @@ class AgentSystem {
         });
     }
     loadSystemConfig() {
-        const str = (0, node_fs_1.readFileSync)(this.getSystemConfigPath(), 'utf-8');
+        const str = (0, node_fs_1.readFileSync)(this.getActiveConfigPath(), 'utf-8');
         return JSON.parse(str);
     }
     loadStandaloneProcConfig() {
-        return (0, node_fs_1.readFileSync)(this.getSystemStandalonePath(), 'utf-8');
+        return (0, node_fs_1.readFileSync)(this.getActivePidPath(), 'utf-8');
     }
     loadNewAgentConfig() {
         const exists = (0, node_fs_1.existsSync)(this.getAgentConfigPath());
@@ -122,7 +258,7 @@ class AgentSystem {
             (0, node_fs_1.cpSync)(this.getAgentConfigPath(), this.getNewAgentConfigPath(), {
                 force: true,
             });
-            (0, node_fs_1.chmodSync)(this.getNewAgentConfigPath(), 0o666);
+            (0, node_fs_1.chmodSync)(this.getNewAgentConfigPath(), 0o600);
             this.clearAgentFiles();
         }
         const str = (0, node_fs_1.readFileSync)(this.getNewAgentConfigPath(), 'utf-8');
@@ -136,21 +272,253 @@ class AgentSystem {
         (0, node_fs_1.rmSync)(this.getSystemBinaryBackupPath(), { force: true });
         (0, node_fs_1.rmSync)(this.getUpdateTempDir(), { recursive: true, force: true });
     }
-    clearSystemFiles() {
-        (0, node_fs_1.rmSync)(this.getSystemBinaryPath(), { force: true });
-        (0, node_fs_1.rmSync)(this.getSystemConfigPath(), { force: true });
+    // `force` only silences ENOENT, so one path this process may not delete would otherwise take
+    // the rest of the list with it - and these lists span two directories with different owners.
+    tryRemove(p, recursive = false) {
+        try {
+            (0, node_fs_1.rmSync)(p, { force: true, recursive });
+        }
+        catch (err) {
+            // An uninstall reports what it managed to do; a file it cannot delete is not a reason to
+            // leave the ones it can
+            logger_1.default.error(err);
+        }
+    }
+    // The two locations can hold two different agents - a service one in the system directory, an
+    // `--app` one in the home directory of whoever is running this - and root, or an elevated
+    // shell on windows, is able to delete either. So each of these clears only its own, host key
+    // included: nothing may go looking for that through getNewAgentConfigDir afterwards, because
+    // the config that resolution keys on is exactly what these have just removed.
+    clearStandaloneFiles() {
+        const dir = this.getStandaloneConfigDir();
+        this.tryRemove(this.getStandaloneConfigPath());
+        this.tryRemove(this.getStandalonePidPath());
+        this.tryRemove(path_1.default.join(dir, 'srv.json'));
+    }
+    // extend
+    clearServiceFiles() {
+        const dir = this.getSystemConfigDir();
+        this.tryRemove(this.getSystemBinaryPath());
+        this.tryRemove(this.getSystemConfigPath());
+        // The lock of a standalone install made before those files moved out of here
+        this.tryRemove(this.getSystemStandalonePath());
+        this.tryRemove(path_1.default.join(dir, 'srv.json'));
+        // Only a service install ever swaps its own binary - see isStandaloneInstall - so whatever
+        // is left of an update in here is always that install's
         this.clearUpdateFiles();
     }
+    // The install this cli resolved to, and only that one. Callers that already know which kind
+    // they are unmaking - an install rolling its own service back - say so directly instead.
+    clearSystemFiles() {
+        if (this.isUserOwnedInstall())
+            this.clearStandaloneFiles();
+        else
+            this.clearServiceFiles();
+    }
     clearAgentFiles() {
         (0, node_fs_1.rmSync)(this.getAgentConfigPath(), { force: true });
     }
     clearNewAgentFiles() {
         (0, node_fs_1.rmSync)(this.getNewAgentConfigPath(), { force: true });
     }
+    // Only ever sets the mode on a directory it creates. An install made before the modes were
+    // tightened has this at 0777 and its service may be running as a user who can only write in
+    // here *because* of that - taking it to 0755 from a command like `agent debug`, which knows
+    // nothing about that user, would break the running agent. Tightening an existing directory
+    // is applySystemModes' job, and that only runs where the owner is set in the same breath.
     ensureSystemConfigDir() {
         const p = this.getSystemConfigDir();
+        if ((0, node_fs_1.existsSync)(p))
+            return;
         (0, node_fs_1.mkdirSync)(p, { recursive: true });
-        (0, node_fs_1.chmodSync)(p, 0o777);
+        try {
+            (0, node_fs_1.chmodSync)(p, 0o755);
+        }
+        catch {
+            // do nothing, the dir may be owned by the service user rather than by this process
+        }
+    }
+    // fs.chown takes a numeric uid and node has no getpwnam, so the name has to be looked up.
+    // Not a shell call: `user` comes off the command line.
+    resolveUserIds(user) {
+        const { execFile } = require('node:child_process');
+        const read = (flag) => new Promise((resolve, reject) => {
+            execFile('id', [flag, user], (err, stdout) => {
+                const id = Number.parseInt(String(stdout).trim(), 10);
+                if (err || Number.isNaN(id)) {
+                    // `id` failing is how the answer arrives, not something to show: what the caller
+                    // needs to read is which user could not be found, not the command that looked
+                    if (err)
+                        logger_1.default.error(err);
+                    reject(new Error((0, texts_1.ERR_AGENT_USER_UNKNOWN)(user)));
+                }
+                else
+                    resolve(id);
+            });
+        });
+        return Promise.all([read('-u'), read('-g')]).then(([uid, gid]) => ({
+            uid,
+            gid,
+        }));
+    }
+    // Opens a path without ever following a symlink at the end of it, so the descriptor is bound
+    // to the inode this call meant: whatever the name is pointed at afterwards, an fchmod or
+    // fchown through this still lands on the file that was checked. O_NONBLOCK because a fifo
+    // left here would otherwise hold the open until someone writes to it, and an install that
+    // hangs is a worse answer than one that skips a file. Windows has neither flag, and no
+    // caller reaches it there.
+    openNoFollow(p, directory = false) {
+        let flags = node_fs_1.constants.O_RDONLY;
+        if (!(0, utils_1.isWindows)())
+            flags |= node_fs_1.constants.O_NOFOLLOW | node_fs_1.constants.O_NONBLOCK;
+        if (directory && node_fs_1.constants.O_DIRECTORY)
+            flags |= node_fs_1.constants.O_DIRECTORY;
+        return (0, node_fs_1.openSync)(p, flags);
+    }
+    // Hands the system directory to the account the service runs as, which is the other half of
+    // dropping 0777: everything in here is created by the root process that installs the agent,
+    // and the service still has to be able to write its host key, its log and a self-update.
+    // Re-run by changeUser, so moving the service to another user keeps working - and the
+    // default target is root, so moving it back takes the rights back off the old one.
+    //
+    // Always runs *before* applySystemModes, never after. Only one of the two can fail first, and
+    // the orders are not equally bad: ownership handed over and the mode left at the old 0777
+    // leaves everyone able to work, while a tightened mode over the wrong owner locks the service
+    // user out of a directory that was serving them a moment earlier.
+    async chownSystemDir(user) {
+        // Windows has no ownership to hand over this way: the service user is granted access to
+        // the same directory with icacls instead, see AgentWindows.grantAccess
+        if ((0, utils_1.isWindows)())
+            return;
+        const dir = this.getSystemConfigDir();
+        // Before anything is opened, because this can reject: an update takes the user out of the
+        // service config and that account may have been deleted since. A descriptor opened first
+        // would be left open on the way out.
+        const { uid, gid } = await this.resolveUserIds(user || 'root');
+        // Runs as root over a directory the service user writes to, so a symlink in here is
+        // something they could have put there: following one would hand root's ownership of any
+        // path on the machine to that account, /etc/passwd included. The open refusing is how that
+        // is found out - a check followed by a chown on the same name is two different lookups.
+        let fd;
+        try {
+            fd = this.openNoFollow(dir, true);
+        }
+        catch {
+            throw new Error((0, texts_1.ERR_AGENT_DIR_REPLACED)(dir));
+        }
+        try {
+            // The directory itself is the one that has to land, so this is allowed to throw: without
+            // it the service cannot write, which is the failure the caller has to hear about
+            (0, node_fs_1.fchownSync)(fd, uid, gid);
+        }
+        finally {
+            (0, node_fs_1.closeSync)(fd);
+        }
+        // Direct children only. The one path component resolved here is the directory itself, and
+        // replacing that takes write access to /etc, which is root's alone - so lchown, which does
+        // not follow the last component, cannot be steered anywhere. A path below a subdirectory
+        // would resolve a component the service user does control: swapped for a symlink between
+        // this readdir and the call, it hands them root's ownership of whatever it points at. Node
+        // has no openat to walk down safely, and nothing under here needs one.
+        (0, node_fs_1.readdirSync)(dir, { withFileTypes: true }).forEach((entry) => {
+            const p = path_1.default.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                // `update/` is the only one that ever turns up here, and swapBinaryToVersion removes
+                // and re-creates it as the service user before it writes anything into it
+                logger_1.default.error((0, texts_1.LOG_AGENT_RIGHTS_DIR_SKIPPED)(p));
+                return;
+            }
+            try {
+                (0, node_fs_1.lchownSync)(p, uid, gid);
+            }
+            catch (err) {
+                // Leaving one file behind is not worth undoing the handover for
+                logger_1.default.error(err);
+            }
+        });
+    }
+    // The modes below are applied where each file is written, so that only covers what this
+    // version wrote. This re-applies them to a whole directory, which is how an install made by
+    // an older version gets off 0777/0666. Only ever called directly after chownSystemDir, and
+    // never before it: on their own the tighter modes would lock out a service user who does not
+    // own these yet.
+    applySystemModes() {
+        const modes = [
+            [this.getSystemConfigDir(), 0o755],
+            // Ordinary users still read this one: it is how `agent status` and the tunnel commands
+            // find the install without sudo. They just cannot write it any more.
+            [this.getSystemConfigPath(), 0o644],
+            [this.getSystemStandalonePath(), 0o644],
+            // The agent's ssh host key - nothing but the agent process ever reads it
+            [path_1.default.join(this.getSystemConfigDir(), 'srv.json'), 0o600],
+            [this.getUpdateStatePath(), 0o600],
+            [this.getSystemBinaryPath(), 0o755],
+            [this.getSystemBinaryBackupPath(), 0o755],
+            [path_1.default.join(this.getSystemConfigDir(), 'cli.log'), 0o640],
+            [path_1.default.join(this.getSystemConfigDir(), 'cli.1.log'), 0o640],
+        ];
+        modes.forEach(([p, mode]) => {
+            if (!(0, node_fs_1.existsSync)(p))
+                return;
+            // Windows has no symlink to worry about here and no flag to refuse one with. It also has
+            // no caller: only the two posix classes apply the modes.
+            if ((0, utils_1.isWindows)()) {
+                try {
+                    (0, node_fs_1.chmodSync)(p, mode);
+                }
+                catch (err) {
+                    logger_1.default.error(err);
+                }
+                return;
+            }
+            // chmod follows symlinks and there is no portable lchmod, so a link left here by the
+            // service user - or by anyone, on a directory still at the old 0777 - would take this
+            // root process to a file of their choosing. Checking the name first does not help: the
+            // chmod is a second lookup, and the name can be a link by then. So the mode goes on the
+            // descriptor, and the open is what refuses a link in the first place.
+            let fd;
+            try {
+                fd = this.openNoFollow(p);
+            }
+            catch (err) {
+                logger_1.default.error((0, texts_1.ERR_AGENT_DIR_REPLACED)(p));
+                logger_1.default.error(err);
+                return;
+            }
+            try {
+                // Anything that is not a file or a directory was not put here by this cli, and its mode
+                // is not ours to set - a device node or a socket, on a directory still open to everyone
+                const st = (0, node_fs_1.fstatSync)(fd);
+                if (st.isFile() || st.isDirectory())
+                    (0, node_fs_1.fchmodSync)(fd, mode);
+            }
+            catch (err) {
+                // A mode we cannot set is not worth failing an install over
+                logger_1.default.error(err);
+            }
+            finally {
+                (0, node_fs_1.closeSync)(fd);
+            }
+        });
+    }
+    ensureStandaloneConfigDir() {
+        const p = this.getStandaloneConfigDir();
+        (0, node_fs_1.mkdirSync)(p, { recursive: true });
+        try {
+            (0, node_fs_1.chmodSync)(p, 0o700);
+        }
+        catch {
+            // do nothing, a dir left by another user is still theirs to keep
+        }
+    }
+    // The directory the install this cli acts on writes to. Called where the old code called
+    // ensureSystemConfigDir: for a standalone install in the user directory that one would
+    // both fail without root and be the wrong place.
+    ensureActiveConfigDir() {
+        if (this.isUserOwnedInstall())
+            this.ensureStandaloneConfigDir();
+        else
+            this.ensureSystemConfigDir();
     }
     saveFile(p, c) {
         return new Promise((resolve, reject) => {
@@ -158,6 +526,10 @@ class AgentSystem {
                 if (err)
                     reject(err);
                 else {
+                    // The service config, and it carries the token in its arguments. Left at 0644
+                    // deliberately: launchd and systemd have their own expectations of these files, and
+                    // the token is readable off `ps` by every local user anyway - the fix for that is
+                    // getting it out of the command line, not tightening this mode.
                     (0, node_fs_1.chmod)(p, 0o644, (err) => {
                         if (err)
                             reject(err);
@@ -190,7 +562,7 @@ class AgentSystem {
                         if (err)
                             reject(err);
                         else {
-                            (0, node_fs_1.chmod)(dest, 0o666, (err) => {
+                            (0, node_fs_1.chmod)(dest, 0o600, (err) => {
                                 if (err)
                                     reject(err);
                                 else
@@ -284,7 +656,7 @@ class AgentSystem {
             encoding: 'utf-8',
         });
         try {
-            (0, node_fs_1.chmodSync)(this.getUpdateStatePath(), 0o666);
+            (0, node_fs_1.chmodSync)(this.getUpdateStatePath(), 0o600);
         }
         catch {
             // do nothing
@@ -400,7 +772,7 @@ class AgentSystem {
             if (!(0, node_fs_1.existsSync)(staged)) {
                 throw new Error(`Archive did not contain '${path_1.default.basename(target)}'`);
             }
-            (0, node_fs_1.chmodSync)(staged, 0o777);
+            (0, node_fs_1.chmodSync)(staged, 0o755);
             const runs = await this.verifyBinary(staged, version);
             if (!runs)
                 return false;
@@ -505,8 +877,8 @@ class AgentSystem {
     clearStandaloneProcConfig() {
         try {
             logger_1.default.info(texts_1.LOG_REMOVING_AGENT_PROC_ID);
-            this.ensureSystemConfigDir();
-            (0, node_fs_1.rmSync)(this.getSystemStandalonePath(), {
+            this.ensureActiveConfigDir();
+            (0, node_fs_1.rmSync)(this.getActivePidPath(), {
                 force: true,
             });
             return true;
@@ -520,12 +892,12 @@ class AgentSystem {
     saveStandaloneProcConfig() {
         try {
             logger_1.default.info(texts_1.LOG_SAVING_AGENT_PROC_ID);
-            this.ensureSystemConfigDir();
-            const p = this.getSystemStandalonePath();
+            this.ensureActiveConfigDir();
+            const p = this.getActivePidPath();
             (0, node_fs_1.writeFileSync)(p, String(process.pid), {
                 encoding: 'utf-8',
             });
-            (0, node_fs_1.chmodSync)(p, 0o666);
+            (0, node_fs_1.chmodSync)(p, this.getPidFileMode());
             return true;
         }
         catch (err) {
@@ -546,8 +918,13 @@ class AgentSystem {
     saveSystemConfig(id, host, token, port, standalone, debug) {
         try {
             logger_1.default.info(texts_1.LOG_SAVING_AGENT_SYSTEM_CONFIG);
-            this.ensureSystemConfigDir();
-            (0, node_fs_1.writeFileSync)(this.getSystemConfigPath(), JSON.stringify({
+            const p = this.getConfigPathForWrite(standalone);
+            const inUserDir = p === this.getStandaloneConfigPath();
+            if (inUserDir)
+                this.ensureStandaloneConfigDir();
+            else
+                this.ensureSystemConfigDir();
+            (0, node_fs_1.writeFileSync)(p, JSON.stringify({
                 id,
                 host,
                 token,
@@ -557,7 +934,9 @@ class AgentSystem {
             }), {
                 encoding: 'utf-8',
             });
-            (0, node_fs_1.chmodSync)(this.getSystemConfigPath(), 0o666);
+            // Taken from where the file actually landed rather than from getActiveFileMode: this
+            // is the one write that can create the file the resolution keys on
+            (0, node_fs_1.chmodSync)(p, inUserDir ? 0o600 : 0o644);
             return true;
         }
         catch (err) {
@@ -581,7 +960,7 @@ class AgentSystem {
                 encoding: 'utf-8',
             });
             try {
-                (0, node_fs_1.chmodSync)(this.getNewAgentConfigPath(), 0o666);
+                (0, node_fs_1.chmodSync)(this.getNewAgentConfigPath(), 0o600);
             }
             catch {
                 // do nothing, file can already have proper mode

package/distTs/src/agent/windows.js

@@ -29,9 +29,6 @@ class AgentWindows extends system_1.default {
     getSystemConfigPath() {
         return path_1.default.join(this.getSystemConfigDir(), 'agent.json');
     }
-    getSystemStandalonePath() {
-        return path_1.default.join(this.getSystemConfigDir(), 'pid.lock');
-    }
     getNssmArchivePath() {
         return path_1.default.join(this.getSystemConfigDir(), 'nssm.zip');
     }
@@ -53,10 +50,10 @@ class AgentWindows extends system_1.default {
     getSystemBinaryPath() {
         return path_1.default.join(this.getSystemConfigDir(), 'bdy.exe');
     }
-    clearSystemFiles() {
-        (0, fs_1.rmSync)(this.getSystemBinaryPath(), { force: true });
-        (0, fs_1.rmSync)(this.getSystemConfigPath(), { force: true });
-        this.clearUpdateFiles();
+    // The service half only: nssm is what runs the service, so an `--app` uninstall has no
+    // business removing it
+    clearServiceFiles() {
+        super.clearServiceFiles();
         (0, fs_1.rmSync)(path_1.default.join(this.getSystemConfigDir(), 'nssm'), {
             force: true,
             recursive: true,

package/distTs/src/command/agent/debug.js

@@ -11,8 +11,8 @@ commandAgentDebug.argument('<on/off>');
 commandAgentDebug.action(async (debug) => {
     const AgentManager = require('../../agent/manager').default;
     const ApiAgent = require('../../tunnel/api/agent').default;
-    const hasAdminRights = await AgentManager.system.hasAdminRights();
-    if (!hasAdminRights) {
+    const hasRights = await AgentManager.system.hasRightsToManage();
+    if (!hasRights) {
         output_1.default.exitError(texts_1.ERR_AGENT_ADMIN_RIGHTS);
     }
     if (!commandAgentDebug.agentInstalled) {

package/distTs/src/command/agent/install.js

@@ -9,6 +9,7 @@ const texts_1 = require("../../texts");
 const cfg_1 = __importDefault(require("../../tunnel/cfg"));
 const utils_1 = require("../../utils");
 const logger_1 = __importDefault(require("../../logger"));
+const node_net_1 = require("node:net");
 const removeAllAndExit = async (txt, id, host, token) => {
     const AgentManager = require('../../agent/manager').default;
     const ApiBuddy = require('../../tunnel/api/buddy').default;
@@ -25,7 +26,9 @@ const removeAllAndExit = async (txt, id, host, token) => {
         // do nothing
     }
     try {
-        AgentManager.system.clearSystemFiles();
+        // Named rather than resolved: this only ever unmakes the service install started above, and
+        // the account running it can have an `--app` install of its own that a resolver would pick
+        AgentManager.system.clearServiceFiles();
     }
     catch {
         // do nothing
@@ -36,14 +39,19 @@ const removeAllAndExit = async (txt, id, host, token) => {
     catch {
         // do nothing
     }
-    try {
-        AgentManager.system.clearNewAgentFiles();
-    }
-    catch {
-        // do nothing
-    }
     output_1.default.exitError(txt);
 };
+// A standalone install in another user's directory cannot be seen from here, so the config
+// check below no longer proves the machine is free - see agent/system.ts isUserOwnedInstall.
+// The port is what two agents actually compete for, and this binds it the way the agent does
+// (manager.ts listens without a host), so the answer is the one that will matter on start.
+const isPortFree = (port) => new Promise((resolve) => {
+    const srv = (0, node_net_1.createServer)();
+    srv.once('error', () => resolve(false));
+    srv.listen(port, () => {
+        srv.close(() => resolve(true));
+    });
+});
 const prepareTags = (tags) => {
     const validTags = [];
     if (tags) {
@@ -235,14 +243,33 @@ commandAgentInstall.option('--agent-note <note>', texts_1.OPT_COMMAND_AGENT_NOTE
 commandAgentInstall.action(async (options) => {
     const AgentManager = require('../../agent/manager').default;
     options.start = options.start === 'true' || options.start === true;
-    const hasAdminRights = await AgentManager.system.hasAdminRights();
-    if (!hasAdminRights) {
-        output_1.default.exitError(texts_1.ERR_AGENT_ADMIN_RIGHTS);
+    // `--app` installs no service: the config goes to this user's own directory and the agent
+    // runs as this user, so there is nothing left in the mode that needs root. A service
+    // install writes to LaunchDaemons/systemd/ProgramData and still does.
+    if (!options.app) {
+        const hasAdminRights = await AgentManager.system.hasAdminRights();
+        if (!hasAdminRights) {
+            output_1.default.exitError(texts_1.ERR_AGENT_ADMIN_RIGHTS);
+        }
     }
     const hasSystemConfig = AgentManager.system.hasSystemConfig();
     if (hasSystemConfig) {
         output_1.default.exitError(texts_1.TXT_AGENT_ALREADY_INSTALLED);
     }
+    // One agent per machine. The check above only sees the system config and this account's own
+    // standalone one - an `--app` install in another home is invisible from there, and a service
+    // installed on top of it would fight it for the port and the agent id.
+    if (!options.app) {
+        const apps = AgentManager.system.findAppInstalls();
+        if (apps.length) {
+            output_1.default.exitError((0, texts_1.ERR_AGENT_APP_INSTALL_PRESENT)(apps[0]));
+        }
+    }
+    const port = input_1.default.port(options.port);
+    const free = await isPortFree(port);
+    if (!free) {
+        output_1.default.exitError((0, texts_1.ERR_AGENT_PORT_TAKEN)(port));
+    }
     if (options.app) {
         await installApp(options);
     }