node-command 2.0.2 → 2.0.4

package/lib/diagnostics-bundle.mjs

@@ -17,7 +17,7 @@ import os from 'node:os';
 import path from 'node:path';
 import zlib from 'node:zlib';
 import child_process from 'node:child_process';
-import { candidateInstallRoots, decideInstallMode, getNcRootForMode, probeInstallRoot } from './setup.mjs';
+import { candidateInstallRoots, decideInstallMode, getNcRootForMode, probeInstallRoot, resolveExecutable } from './setup.mjs';
 
 export const CLI_DIAGNOSTICS_VERSION = '1.0.0';
 export const CLI_DIAGNOSTICS_MAX_LOG_BYTES = 65536;
@@ -121,13 +121,22 @@ export function parseCliDiagnosticsArgs(argv = []) {
 
 /**
  * Best-effort service status for the platform agent units. Never throws.
+ * Executables resolve from the same absolute allowlist used by privileged
+ * paths, so the caller's PATH cannot redirect a diagnostic probe.
  * @param {string} [platform]
+ * @param {{ run?: (cmd: string, args: string[], options: object) => any, resolve?: typeof resolveExecutable }} [options]
  */
-export function probeCliServiceStatus(platform = os.platform()) {
+export function probeCliServiceStatus(platform = os.platform(), { run = child_process.execFileSync, resolve = resolveExecutable } = {}) {
   const checks = [];
-  const tryRun = (cmd, args) => {
+  const tryRun = (name, args) => {
+    let cmd;
     try {
-      const out = child_process.execFileSync(cmd, args, {
+      cmd = resolve(name, { platform });
+    } catch {
+      return { ok: false, stdout: '' };
+    }
+    try {
+      const out = run(cmd, args, {
         timeout: 8000,
         stdio: ['ignore', 'pipe', 'pipe']
       });
@@ -549,17 +558,36 @@ export function runCliDiagnostics(argv = [], { ncRoot = null, env = process.env,
       writeFile ||
       ((f, d) => {
         fs.mkdirSync(path.dirname(f), { recursive: true });
-        fs.writeFileSync(f, d, { mode: 0o600 });
+        // Never follow an existing file or symlink at the predictable output
+        // name: O_EXCL makes a pre-created path fail closed instead of
+        // truncating its target.
+        const fd = fs.openSync(
+          f,
+          fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | (fs.constants.O_NOFOLLOW || 0),
+          0o600
+        );
+        try {
+          fs.writeFileSync(fd, d);
+        } catch (err) {
+          try {
+            fs.unlinkSync(f);
+          } catch {}
+          throw err;
+        } finally {
+          fs.closeSync(fd);
+        }
       });
     try {
       writer(outPath, archive);
     } catch (err) {
       const hint =
-        err?.code === 'EACCES'
-          ? 'Suggested action: choose a writable --output path or re-run with permission to write there.'
-          : err?.code === 'ENOSPC'
-            ? 'Suggested action: free disk space and re-run.'
-            : 'Suggested action: choose a different --output path and re-run.';
+        err?.code === 'EEXIST'
+          ? 'Suggested action: the output file already exists and is never overwritten; choose a different --output path and re-run.'
+          : err?.code === 'EACCES'
+            ? 'Suggested action: choose a writable --output path or re-run with permission to write there.'
+            : err?.code === 'ENOSPC'
+              ? 'Suggested action: free disk space and re-run.'
+              : 'Suggested action: choose a different --output path and re-run.';
       return {
         handled: true,
         ok: false,