node-command 2.0.14 → 2.0.15

package/lib/setup.mjs

@@ -711,6 +711,9 @@ const INCOMPLETE_HELPER_BOOTSTRAP = '/opt/nc/libexec/protected-helper-bootstrap'
 const INCOMPLETE_HELPER_BOOTSTRAP_ENTRIES = new Map([
   ['archive.tar.gz', 'file'],
   ['install-request.json', 'file'],
+  // Written by the provisioner from the signed archive before the helper tree
+  // is published; installations that failed earlier may not have it yet.
+  ['control-plane-public-key.pem', 'optional-file'],
   ['modules', 'directory'],
   ['release', 'directory']
 ]);
@@ -831,21 +834,21 @@ function systemValidateHelperArtifacts(io, runtime) {
 }
 
 /**
- * `libexec` is removable only while empty or holding the exact staging tree a
- * protected helper bootstrap writes before provisioning: root-owned regular
- * files/directories, no symlinks, no group/other write bits, and no unknown
- * entry. A provisioned helper, peercred shim or any other content fails closed.
+ * The exact staging tree a protected helper bootstrap writes before
+ * provisioning: root-owned regular files/directories, no symlinks, no
+ * group/other write bits, and no unknown entry. An absent stage is not a
+ * failure by itself; callers that require it check separately.
  */
-function systemValidateStagedHelperBootstrap(io, libexec) {
-  const entries = systemReaddir(io)(libexec);
-  if (entries.length === 0) return true;
-  if (entries.length !== 1 || entries[0] !== 'protected-helper-bootstrap') return false;
+function systemValidateStagedHelperBootstrapTree(io) {
   const stage = systemLstatOrNull(io, INCOMPLETE_HELPER_BOOTSTRAP);
-  if (!stage || stage.isSymbolicLink() || !stage.isDirectory() || stage.uid !== 0 || (stage.mode & 0o022)) return false;
+  if (!stage) return true;
+  if (stage.isSymbolicLink() || !stage.isDirectory() || stage.uid !== 0 || (stage.mode & 0o022)) return false;
+  const required = [...INCOMPLETE_HELPER_BOOTSTRAP_ENTRIES].filter(([, type]) => type !== 'optional-file');
   const staged = systemReaddir(io)(INCOMPLETE_HELPER_BOOTSTRAP);
-  if (staged.length !== INCOMPLETE_HELPER_BOOTSTRAP_ENTRIES.size) return false;
+  if (staged.some((name) => !INCOMPLETE_HELPER_BOOTSTRAP_ENTRIES.has(name)) ||
+      required.some(([name]) => !staged.includes(name))) return false;
   for (const [name, type] of INCOMPLETE_HELPER_BOOTSTRAP_ENTRIES) {
-    if (!staged.includes(name)) return false;
+    if (!staged.includes(name)) continue;
     const info = systemLstatOrNull(io, path.join(INCOMPLETE_HELPER_BOOTSTRAP, name));
     if (!info || info.isSymbolicLink() || info.uid !== 0 || (info.mode & 0o022)) return false;
     if (type === 'directory' ? !info.isDirectory() : (!info.isFile() || info.nlink !== 1)) return false;
@@ -853,6 +856,17 @@ function systemValidateStagedHelperBootstrap(io, libexec) {
   return true;
 }
 
+/**
+ * `libexec` is removable only while empty or holding that exact staging tree.
+ * A provisioned helper, peercred shim or any other content fails closed.
+ */
+function systemValidateStagedHelperBootstrap(io, libexec) {
+  const entries = systemReaddir(io)(libexec);
+  if (entries.length === 0) return true;
+  if (entries.length !== 1 || entries[0] !== 'protected-helper-bootstrap') return false;
+  return systemValidateStagedHelperBootstrapTree(io);
+}
+
 /**
  * Recognize the two root-recoverable system-install leftovers this CLI may
  * remove without the packaged maintenance entry: a helper provisioned but
@@ -893,6 +907,11 @@ export function incompleteSystemInstallationShape(root, { platform = os.platform
       // ordinary root all require their own trusted maintenance.
       if (systemLstatOrNull(io, INCOMPLETE_HELPER_PROFILE) || systemLstatOrNull(io, INCOMPLETE_SYSTEM_LIFECYCLE) ||
           systemLstatOrNull(io, INCOMPLETE_SYSTEM_PAIRED_ROOT)) return null;
+      // libexec may hold only the helper tree, its peercred shim and the exact
+      // pre-provision protected bootstrap stage. Any other entry fails closed.
+      const libexecEntries = systemReaddir(io)(path.join(root, 'libexec'));
+      if (!libexecEntries.every((name) => ['nc-linux-peercred', 'privileged-helper', 'protected-helper-bootstrap'].includes(name)) ||
+          !systemValidateStagedHelperBootstrapTree(io)) return null;
       const bootstrap = JSON.parse(readSystemFile(io, INCOMPLETE_HELPER_APP + '/helper-bootstrap.json', { mode: 0o600 }));
       const controlPlaneId = (value) => typeof value === 'string' && value.length > 0 && value.length <= 256 &&
         value.trim() === value && !/[\x00-\x1f\x7f]/.test(value);
@@ -907,20 +926,37 @@ export function incompleteSystemInstallationShape(root, { platform = os.platform
           bootstrap.ordinary_service_scope !== 'system' ||
           bootstrap.ack_private_key_file !== INCOMPLETE_HELPER_APP + '/privileged-helper-ack-key.pem' ||
           !systemCanonical(bootstrap.node_bin)) return null;
-      readSystemFile(io, INCOMPLETE_HELPER_APP + '/privileged-helper.json', { mode: 0o600 });
-      readSystemFile(io, INCOMPLETE_HELPER_APP + '/privileged-helper-ack-key.pem', { mode: 0o600 });
-      readSystemFile(io, INCOMPLETE_HELPER_APP + '/privileged-helper-public.pem', { mode: 0o644 });
-      const peercred = systemLstatOrNull(io, '/opt/nc/libexec/nc-linux-peercred');
-      if (!peercred || peercred.isSymbolicLink() || !peercred.isFile() || peercred.uid !== 0 || peercred.nlink !== 1) return null;
-      const daemon = systemLstatOrNull(io, INCOMPLETE_HELPER_DAEMON);
-      if (!daemon || daemon.isSymbolicLink() || !daemon.isFile() || daemon.uid !== 0 || !(daemon.mode & 0o111)) return null;
+      // The helper tree is either fully prepared but unbound, or only a
+      // bootstrap record whose provisioning never completed. The latter is
+      // removable only while the exact protected staging tree still exists.
+      const helperEntries = systemReaddir(io)(INCOMPLETE_HELPER_APP);
+      const bootstrapOnly = helperEntries.length === 1 && helperEntries[0] === 'helper-bootstrap.json';
+      let helperArtifacts;
+      if (bootstrapOnly) {
+        if (!systemLstatOrNull(io, INCOMPLETE_HELPER_BOOTSTRAP) ||
+            systemLstatOrNull(io, '/opt/nc/libexec/nc-linux-peercred') ||
+            systemLstatOrNull(io, INCOMPLETE_HELPER_UNIT) || systemLstatOrNull(io, INCOMPLETE_HELPER_SOCKET) ||
+            systemLstatOrNull(io, INCOMPLETE_HELPER_TMPFILES) || systemLstatOrNull(io, INCOMPLETE_HELPER_UNIT_DROPIN) ||
+            systemLstatOrNull(io, INCOMPLETE_HELPER_SOCKET_DROPIN)) return null;
+        helperArtifacts = Object.freeze({ service: false, tmpfiles: false });
+      } else {
+        readSystemFile(io, INCOMPLETE_HELPER_APP + '/privileged-helper.json', { mode: 0o600 });
+        readSystemFile(io, INCOMPLETE_HELPER_APP + '/privileged-helper-ack-key.pem', { mode: 0o600 });
+        readSystemFile(io, INCOMPLETE_HELPER_APP + '/privileged-helper-public.pem', { mode: 0o644 });
+        const peercred = systemLstatOrNull(io, '/opt/nc/libexec/nc-linux-peercred');
+        if (!peercred || peercred.isSymbolicLink() || !peercred.isFile() || peercred.uid !== 0 || peercred.nlink !== 1) return null;
+        // Node executes the .mjs daemon regardless of its executable bit; the
+        // released module is 0644. Require the protected root-owned metadata.
+        const daemon = systemLstatOrNull(io, INCOMPLETE_HELPER_DAEMON);
+        if (!daemon || daemon.isSymbolicLink() || !daemon.isFile() || daemon.uid !== 0 || (daemon.mode & 0o022)) return null;
+        helperArtifacts = systemValidateHelperArtifacts(io, bootstrap.node_bin);
+      }
       readSystemFile(io, INCOMPLETE_SYSTEM_LAUNCHER, { uids: new Set([0, payloadUid]) });
       const hostEnv = readSystemFile(io, INCOMPLETE_SYSTEM_HOST_ENV, { uids: new Set([0, payloadUid]) });
       const ids = hostEnv.split(/\r?\n/).filter((line) => /^\s*NC_CLIENT_ID\s*=/.test(line));
       const clientId = ids[0]?.match(/^\s*NC_CLIENT_ID\s*=\s*(?:"(nc_[0-9a-f]{64})"|'(nc_[0-9a-f]{64})'|(nc_[0-9a-f]{64}))\s*$/);
       if (ids.length !== 1 || !clientId || (clientId[1] || clientId[2] || clientId[3]) !== bootstrap.client_id) return null;
       systemValidateClientUnit(io, bootstrap.node_bin);
-      const helperArtifacts = systemValidateHelperArtifacts(io, bootstrap.node_bin);
       return Object.freeze({ kind: 'pending-helper', runtime: bootstrap.node_bin, payloadUid, helperArtifacts });
     }
     // Failed-install shape: no helper payload, no packaged uninstaller, and an
@@ -1098,19 +1134,24 @@ export function findRemovalTargets({ io = {}, ...rest } = {}) {
   let pair = null;
   let incompleteRoot = null;
   if ((rest.platform || os.platform()) === 'linux') {
-    let pairedError = null;
-    try {
-      pair = linuxPairedInstallation(io);
-    } catch (err) {
-      // Protected metadata this account cannot stat or read is not a local
-      // removal target. Any other validation failure remains a hard stop
-      // unless the tree is the exact recoverable pending/failed shape.
-      if (err?.code !== 'TRUSTED_ROOT_MAINTENANCE_REQUIRED') throw err;
-      pairedError = err;
-    }
-    if (!pair) {
-      if (incompleteSystemInstallationShape(PARTIAL_SYSTEM_ROOT, { platform: 'linux', io })) incompleteRoot = PARTIAL_SYSTEM_ROOT;
-      if (pairedError && !incompleteRoot && !pairedMetadataUnreadable(io)) throw pairedError;
+    // A validated recoverable pending/failed shape takes precedence over the
+    // paired classification: the unprovisioned staging tree makes the paired
+    // metadata unverifiable, but the tree is not a paired installation. A
+    // genuinely prepared or bound pair never matches this shape (it requires
+    // lifecycle custody and a profile), so it keeps using the packaged path.
+    if (incompleteSystemInstallationShape(PARTIAL_SYSTEM_ROOT, { platform: 'linux', io })) {
+      incompleteRoot = PARTIAL_SYSTEM_ROOT;
+    } else {
+      let pairedError = null;
+      try {
+        pair = linuxPairedInstallation(io);
+      } catch (err) {
+        // Protected metadata this account cannot stat or read is not a local
+        // removal target. Any other validation failure remains a hard stop.
+        if (err?.code !== 'TRUSTED_ROOT_MAINTENANCE_REQUIRED') throw err;
+        pairedError = err;
+      }
+      if (!pair && pairedError && !pairedMetadataUnreadable(io)) throw pairedError;
     }
   }
   const env = rest.env || process.env;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "node-command",
-  "version": "2.0.14",
+  "version": "2.0.15",
   "type": "module",
   "license": "Apache-2.0",
   "engines": {