node-command 2.0.3 → 2.0.4

package/lib/diagnostics-bundle.mjs

@@ -17,7 +17,7 @@ import os from 'node:os';
 import path from 'node:path';
 import zlib from 'node:zlib';
 import child_process from 'node:child_process';
-import { candidateInstallRoots, decideInstallMode, getNcRootForMode, probeInstallRoot } from './setup.mjs';
+import { candidateInstallRoots, decideInstallMode, getNcRootForMode, probeInstallRoot, resolveExecutable } from './setup.mjs';
 
 export const CLI_DIAGNOSTICS_VERSION = '1.0.0';
 export const CLI_DIAGNOSTICS_MAX_LOG_BYTES = 65536;
@@ -121,13 +121,22 @@ export function parseCliDiagnosticsArgs(argv = []) {
 
 /**
  * Best-effort service status for the platform agent units. Never throws.
+ * Executables resolve from the same absolute allowlist used by privileged
+ * paths, so the caller's PATH cannot redirect a diagnostic probe.
  * @param {string} [platform]
+ * @param {{ run?: (cmd: string, args: string[], options: object) => any, resolve?: typeof resolveExecutable }} [options]
  */
-export function probeCliServiceStatus(platform = os.platform()) {
+export function probeCliServiceStatus(platform = os.platform(), { run = child_process.execFileSync, resolve = resolveExecutable } = {}) {
   const checks = [];
-  const tryRun = (cmd, args) => {
+  const tryRun = (name, args) => {
+    let cmd;
     try {
-      const out = child_process.execFileSync(cmd, args, {
+      cmd = resolve(name, { platform });
+    } catch {
+      return { ok: false, stdout: '' };
+    }
+    try {
+      const out = run(cmd, args, {
         timeout: 8000,
         stdio: ['ignore', 'pipe', 'pipe']
       });
@@ -549,17 +558,36 @@ export function runCliDiagnostics(argv = [], { ncRoot = null, env = process.env,
       writeFile ||
       ((f, d) => {
         fs.mkdirSync(path.dirname(f), { recursive: true });
-        fs.writeFileSync(f, d, { mode: 0o600 });
+        // Never follow an existing file or symlink at the predictable output
+        // name: O_EXCL makes a pre-created path fail closed instead of
+        // truncating its target.
+        const fd = fs.openSync(
+          f,
+          fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | (fs.constants.O_NOFOLLOW || 0),
+          0o600
+        );
+        try {
+          fs.writeFileSync(fd, d);
+        } catch (err) {
+          try {
+            fs.unlinkSync(f);
+          } catch {}
+          throw err;
+        } finally {
+          fs.closeSync(fd);
+        }
       });
     try {
       writer(outPath, archive);
     } catch (err) {
       const hint =
-        err?.code === 'EACCES'
-          ? 'Suggested action: choose a writable --output path or re-run with permission to write there.'
-          : err?.code === 'ENOSPC'
-            ? 'Suggested action: free disk space and re-run.'
-            : 'Suggested action: choose a different --output path and re-run.';
+        err?.code === 'EEXIST'
+          ? 'Suggested action: the output file already exists and is never overwritten; choose a different --output path and re-run.'
+          : err?.code === 'EACCES'
+            ? 'Suggested action: choose a writable --output path or re-run with permission to write there.'
+            : err?.code === 'ENOSPC'
+              ? 'Suggested action: free disk space and re-run.'
+              : 'Suggested action: choose a different --output path and re-run.';
       return {
         handled: true,
         ok: false,

package/lib/setup.mjs

@@ -45,17 +45,69 @@ export function browserBrandReexecArgs(args, brand) {
   return ['--input-type=module', '--eval', script];
 }
 
+/**
+ * Canonical absolute Windows executable path derived only from the trusted
+ * SystemRoot (never from the caller's PATH).
+ * @param {'powershell'|'tar'|'sc'|'sc.exe'|'net'|'net.exe'} name
+ * @param {NodeJS.ProcessEnv} [env]
+ */
+export function windowsExecutablePath(name, env = process.env) {
+  const systemRoot = env.SystemRoot || env.windir || 'C:\\Windows';
+  if (name === 'powershell') return path.join(systemRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
+  if (name === 'tar') return path.join(systemRoot, 'System32', 'tar.exe');
+  if (name === 'sc' || name === 'sc.exe') return path.join(systemRoot, 'System32', 'sc.exe');
+  if (name === 'net' || name === 'net.exe') return path.join(systemRoot, 'System32', 'net.exe');
+  throw new Error(`No canonical Windows executable mapping for ${name}.`);
+}
+
+/**
+ * Resolves a required helper executable only from an absolute allowlist, so a
+ * caller-controlled PATH cannot redirect an elevation or install flow.
+ * @param {'bash'|'tar'|'sudo'|'id'|'powershell'|'systemctl'|'launchctl'|'sc'|'sc.exe'|'net'|'net.exe'} name
+ * @param {{ platform?: string, env?: NodeJS.ProcessEnv, existsSync?: (p: string) => boolean }} [options]
+ */
+export function resolveExecutable(name, { platform = os.platform(), env = process.env, existsSync = fs.existsSync } = {}) {
+  const unavailable = (expected) => Object.assign(
+    new Error(`Required executable ${name} was not found at ${expected}; refusing to resolve it through PATH.`),
+    { code: 'CLI_EXECUTABLE_UNAVAILABLE' }
+  );
+  if (platform === 'win32') {
+    const candidate = windowsExecutablePath(name, env);
+    if (existsSync(candidate)) return candidate;
+    throw unavailable(candidate);
+  }
+  /** @type {Record<string, string[]>} */
+  const allowlist = {
+    bash: ['/bin/bash', '/usr/bin/bash'],
+    tar: ['/bin/tar', '/usr/bin/tar'],
+    sudo: ['/usr/bin/sudo', '/bin/sudo'],
+    id: ['/usr/bin/id', '/bin/id'],
+    systemctl: ['/usr/bin/systemctl', '/bin/systemctl', '/usr/sbin/systemctl', '/sbin/systemctl'],
+    launchctl: ['/bin/launchctl', '/usr/bin/launchctl']
+  };
+  const candidates = allowlist[name];
+  if (!candidates) throw new Error(`No POSIX executable allowlist for ${name}.`);
+  for (const candidate of candidates) {
+    if (existsSync(candidate)) return candidate;
+  }
+  throw unavailable(candidates.join(' or '));
+}
+
 /** Single-line notice printed when setup falls back to user mode. */
 export const LIMITED_CAPS_WARNING =
   'limited: privileged_shell_exec and container tools are off (re-run as administrator for full capabilities)';
 
 /**
  * Detects Windows administrator rights via `net session` (exit 0 ⇔ admin).
- * Never throws: any failure means "not admin".
+ * The production path resolves the absolute `net.exe`; an injected runner
+ * keeps the stable `net` command name for existing fixtures. Never throws:
+ * any failure means "not admin".
  * @param {(cmd: string, args: string[]) => { status: number|null }} [run]
  */
 export function detectWindowsAdmin(run = null) {
   try {
+    if (!run && os.platform() !== 'win32') return false;
+    const command = run ? 'net' : windowsExecutablePath('net');
     const runner =
       run ||
       ((cmd, args) => {
@@ -66,7 +118,7 @@ export function detectWindowsAdmin(run = null) {
           return { status: 1 };
         }
       });
-    return runner('net', ['session']).status === 0;
+    return runner(command, ['session']).status === 0;
   } catch {
     return false;
   }
@@ -108,6 +160,16 @@ export function decideInstallMode(options = {}) {
   return isElevated(options) ? 'system' : 'user';
 }
 
+/**
+ * A partial per-user application (valid config + device key, missing or empty
+ * app/launcher.mjs) may be repaired in place from the stored host identity.
+ * Protected or root-managed system trees always require explicit maintenance.
+ * @param {{ mode?: 'system'|'user', protectedContext?: unknown, rootManagedPair?: boolean }} [options]
+ */
+export function canRepairUserApplication({ mode, protectedContext = null, rootManagedPair = false } = {}) {
+  return mode === 'user' && !protectedContext && rootManagedPair !== true;
+}
+
 /**
  * True when the current user CAN elevate to a machine-wide install even when
  * the process is not root yet: an already-elevated process, a Windows
@@ -124,7 +186,7 @@ export function canElevate(options = {}) {
   // UAC prompt, so elevation is available even when not administrator.
   if (platform === 'win32') return true;
   try {
-    const r = child_process.spawnSync('id', ['-nG'], { encoding: 'utf8' });
+    const r = child_process.spawnSync(resolveExecutable('id', { platform }), ['-nG'], { encoding: 'utf8' });
     const groups = r && typeof r.stdout === 'string' ? r.stdout : '';
     return /\b(sudo|admin|wheel)\b/.test(groups);
   } catch {
@@ -329,6 +391,22 @@ export function probeInstallRoot(root, io = {}) {
   return 'foreign';
 }
 
+/**
+ * Canonical machine-wide roots that exist but cannot be inspected by the
+ * current unprivileged caller. Setup must escalate before deciding anything
+ * about them: treating an unreadable system tree as absent would create a
+ * competing per-user agent beside a real system installation.
+ * @param {{ platform?: string, env?: NodeJS.ProcessEnv, homedir?: string, io?: object }} [options]
+ * @returns {string[]}
+ */
+export function unreadableSystemInstallations({ platform = os.platform(), env = process.env, homedir = os.homedir(), io = {} } = {}) {
+  if (platform !== 'linux') return [];
+  const envWithoutRoot = { ...env };
+  delete envWithoutRoot.NC_ROOT;
+  const root = getNcRootForMode('system', { platform, env: envWithoutRoot, homedir });
+  return probeInstallRoot(root, io) === 'unreadable' ? [root] : [];
+}
+
 /**
  * Removal targets split by accessibility. `install` roots are removed by the
  * local flow; `unreadable` roots (system installs seen from a non-root shell)
@@ -500,7 +578,7 @@ export function setupTarget({ platform = os.platform(), mode = decideInstallMode
     const script = "$ErrorActionPreference='Stop'; $s=@(Get-CimInstance Win32_Service -Filter \"Name='NCClient'\" | Select-Object PathName); $t=@(Get-ScheduledTask -TaskPath '\\' | Where-Object { $_.TaskName -eq 'NC Client' } | ForEach-Object { $_.Actions | Select-Object WorkingDirectory }); ConvertTo-Json -Compress -Depth 4 @{services=$s;tasks=$t}";
     let state;
     try {
-      const result = run('powershell.exe', ['-NoLogo', '-NoProfile', '-NonInteractive', '-Command', script], { encoding: 'utf8', timeout: 10000, maxBuffer: 65536, windowsHide: true });
+      const result = run(windowsExecutablePath('powershell'), ['-NoLogo', '-NoProfile', '-NonInteractive', '-Command', script], { encoding: 'utf8', timeout: 10000, maxBuffer: 65536, windowsHide: true });
       if (result.status !== 0) stop('Windows service/task state is unreadable; inspect NCClient and the NC Client task through administrator maintenance.');
       state = JSON.parse(String(result.stdout));
       if (!Array.isArray(state.services) || !Array.isArray(state.tasks)) throw new Error('invalid service state');
@@ -624,7 +702,16 @@ export async function maintainLinuxIdentity({ ncRoot, hostId, operatorUser, auth
     } finally { if (fd !== undefined) io.closeSync(fd); io.closeSync(parent); }
   };
   const envPath = path.join(ncRoot, 'config/nc-client.env');
-  const envText = read(envPath), env = parseMaintenanceEnv(envText);
+  let envText;
+  try { envText = read(envPath); } catch (error) {
+    if (error?.code !== 'ENOENT') throw error;
+    // A completed login-user migration retires the source configuration; a
+    // second run must not surface a raw filesystem error or repeat OS work.
+    if (exists(envPath + '.identity-backup'))
+      fail('this tree was already migrated to the restricted nodecommand identity; no account or service was changed');
+    fail('the selected root has no readable installation configuration; preserve it and repair explicitly');
+  }
+  const env = parseMaintenanceEnv(envText);
   if (env.NC_CLIENT_ID !== hostId) fail('host ID mismatch; no token was consumed');
   const identity = root => {
     const data = parseMaintenanceEnv(read(path.join(root, 'config/nc-client.env')));
@@ -643,6 +730,10 @@ export async function maintainLinuxIdentity({ ncRoot, hostId, operatorUser, auth
   if (!rootInfo.isDirectory() || rootInfo.isSymbolicLink()) fail('source root is not a directory');
   const loginMove = env.NC_SERVICE_MODE === 'user';
   const oldUser = loginMove ? operatorUser : '_nc';
+  // Re-selecting the already-migrated restricted installation is a no-op that
+  // must fail closed with its own reason instead of an account message.
+  if (loginMove && operatorUser === 'nodecommand')
+    fail('this installation already runs as the restricted nodecommand identity; no account or service was changed');
   if (!/^[a-z_][a-z0-9_-]*[$]?$/.test(oldUser || '') || oldUser === 'root' || oldUser === 'nodecommand') fail('select the existing ordinary account explicitly');
   const account = command('/usr/bin/getent', ['passwd', oldUser]).trim().split(':');
   if (account.length !== 7 || account[0] !== oldUser || !/^\d+$/.test(account[2]) || !/^\d+$/.test(account[3])) fail('account inventory is ambiguous');
@@ -798,6 +889,12 @@ export async function maintainLinuxIdentity({ ncRoot, hostId, operatorUser, auth
       const created = command('/usr/bin/getent', ['passwd', 'nodecommand']).trim().split(':');
       newUid = Number(created[2]); newGid = Number(created[3]);
       if (!Number.isSafeInteger(newUid) || newUid <= 0 || !Number.isSafeInteger(newGid) || newGid <= 0 || created[5] !== home) fail('new account inventory mismatch');
+      // The created identity must itself be restricted: non-login shell and no
+      // supplementary groups (never a reused login or elevated account).
+      const createdGroups = command('/usr/bin/id', ['-nG', 'nodecommand']).trim().split(/\s+/).filter(Boolean);
+      if (createdGroups.length !== 1 || createdGroups[0] !== 'nodecommand' ||
+          !['/usr/sbin/nologin', '/sbin/nologin', '/bin/false', '/usr/bin/false'].includes(created[6]))
+        fail('new restricted account is not a dedicated non-login identity; repair explicitly');
       const rewritten = { ...parseMaintenanceEnv(read(path.join(destination, 'config/nc-client.env'))), NC_SERVICE_MODE: 'user',
         NC_ROOT: destination, NC_SERVICE_UNIT: 'nc-client.service', NC_OPERATOR_USER: 'nodecommand', NC_SERVICE_USER: 'nodecommand', NC_SERVICE_GROUP: 'nodecommand' };
       for (const name of ['NC_ENV_FILE', 'NC_LOG_FILE', 'NC_DEVICE_KEY_FILE', 'NC_NODE_BIN']) {
@@ -945,7 +1042,7 @@ export const LINUX_PAIRED_UNINSTALL_ENTRY = '/opt/nc/libexec/privileged-helper/i
  * Never forward startup hooks or loader/environment authority to that shell.
  * @param {string} scriptPath
  * @param {string|{ platform?: string, execFile?: (cmd: string, args: string[], opts?: object) => unknown, getuid?: (() => number)|null }} [platform]
-  * @param {{ execFile?: (cmd: string, args: string[], opts?: object) => unknown, getuid?: (() => number)|null, geteuid?: (() => number)|null, io?: typeof fs }} [options]
+ * @param {{ execFile?: (cmd: string, args: string[], opts?: object) => unknown, getuid?: (() => number)|null, geteuid?: (() => number)|null, io?: typeof fs, env?: NodeJS.ProcessEnv, homedir?: string }} [options]
  */
 export function runUninstallerScript(scriptPath, platform = os.platform(), options = {}) {
   let opts = options || {};
@@ -955,8 +1052,40 @@ export function runUninstallerScript(scriptPath, platform = os.platform(), optio
   }
   const execFile = opts.execFile || child_process.execFileSync;
   if (platform === 'win32') {
+    // NC-SRC-02: only the packaged uninstaller of a known installation root (or
+    // the Administrators/SYSTEM-only copy the installer registers for the SYSTEM
+    // task) may execute — never an arbitrary path from the caller.
+    const winpath = path.win32;
+    const denied = () => Object.assign(new Error('TRUSTED_ROOT_MAINTENANCE_REQUIRED: refusing untrusted uninstall execution; preserve the selected tree and use explicitly trusted maintenance.'), { code: 'TRUSTED_ROOT_MAINTENANCE_REQUIRED' });
+    const env = opts.env || process.env;
+    const homedir = opts.homedir || os.homedir();
+    const programData = env.ProgramData || 'C:\\ProgramData';
+    const expected = new Set([
+      ...candidateInstallRoots({ platform: 'win32', env, homedir }).map(root => winpath.join(root, 'uninstall.ps1')),
+      winpath.join(programData, 'NC Protected', 'uninstall.ps1')
+    ].map(file => file.toLowerCase()));
+    if (typeof scriptPath !== 'string' || !winpath.isAbsolute(scriptPath) ||
+        winpath.normalize(scriptPath) !== scriptPath || /["`\x00-\x1F\x7F]/.test(scriptPath) ||
+        winpath.basename(scriptPath).toLowerCase() !== 'uninstall.ps1' || !expected.has(scriptPath.toLowerCase())) throw denied();
+    // Discovery is not execution trust: the packaged file itself must be the
+    // regular (non-reparse) file at that path, with no redirected ancestry.
+    const io = opts.io || fs;
+    let st;
+    try {
+      st = io.lstatSync(scriptPath);
+    } catch {
+      throw denied();
+    }
+    if (st.isSymbolicLink() || !st.isFile()) throw denied();
+    let real;
+    try {
+      real = io.realpathSync(scriptPath);
+    } catch {
+      throw denied();
+    }
+    if (winpath.normalize(real).toLowerCase() !== scriptPath.toLowerCase()) throw denied();
     execFile(
-      'powershell.exe',
+      windowsExecutablePath('powershell', env),
       ['-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', scriptPath],
       { stdio: 'inherit' }
     );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "node-command",
-  "version": "2.0.3",
+  "version": "2.0.4",
   "type": "module",
   "license": "Apache-2.0",
   "bin": {