node-command 2.0.5 → 2.0.7

package/bin/nc.mjs

@@ -2867,31 +2867,37 @@ async function runRemoval(args, { command, emptyMessage, elevateOnWindows = fals
     const pair = paired.find(selected => selected.ncRoot === root);
     return pair ? pair.helperRoot === root ? `${root} (co-located protected helper)` : `${root} (paired protected helper: ${pair.helperRoot})` : root;
   }).join(', ')}`);
-  if (paired.length && (os.platform() !== 'linux' || process.getuid?.() !== 0 || process.geteuid?.() !== 0)) {
-    console.error('error: [TRUSTED_ROOT_MAINTENANCE_REQUIRED] Paired Linux removal requires explicitly invoked real/effective Root maintenance. No elevation or ordinary-script fallback was attempted; both roots and lifecycle records are preserved.');
-    console.error(uninstallFailureSuggestion());
-    process.exit(1);
-    return;
+  const pairedRoots = new Set(paired.map(selected => selected.ncRoot));
+  const canRemovePaired = os.platform() === 'linux' && process.getuid?.() === 0 && process.geteuid?.() === 0;
+  let failed = 0;
+  // A non-root caller can never execute the paired protected root. Report it
+  // for explicit root maintenance, but keep going so the caller's own readable
+  // tree is still removed in this invocation. No implicit sudo is attempted.
+  const skippedPaired = canRemovePaired ? [] : [...pairedRoots];
+  for (const root of skippedPaired) {
+    console.error(`error: [TRUSTED_ROOT_MAINTENANCE_REQUIRED] The paired system installation at ${root} requires explicitly invoked real/effective Root maintenance; it was not modified.`);
+    console.error('suggested_action: Run `sudo npx --yes node-command@latest uninstall --yes` to remove this trusted root installation explicitly.');
+    failed += 1;
   }
+  const removable = install.filter(root => !skippedPaired.includes(root));
   if (unreadable.length > 0) {
     console.log(
       `Explicit root maintenance required for system install(s): ${unreadable.join(', ')} (not readable as the current user).`
     );
   }
-  if (!yes) {
+  if (removable.length > 0 && !yes) {
     if (!process.stdin.isTTY) {
       console.error(`error: [CONFIRMATION_REQUIRED] ${command} needs confirmation in non-interactive shells.`);
       console.error(`suggested_action: Re-run as \`nodecommand ${command} --yes\`.`);
       process.exit(1);
     }
-    const confirmed = await confirmPrompt(`${command === 'uninstall' ? 'Uninstall' : 'Remove'} ${targets.length === 1 ? 'this installation' : 'these installations'}? [y/N] `);
+    const confirmed = await confirmPrompt(`${command === 'uninstall' ? 'Uninstall' : 'Remove'} ${removable.length === 1 ? 'this installation' : 'these installations'}? [y/N] `);
     if (!confirmed) {
       console.log('Aborted (nothing removed).');
       return;
     }
   }
-  let failed = 0;
-  for (const root of install) {
+  for (const root of removable) {
     const pair = paired.find(selected => selected.ncRoot === root);
     const script = pair ? LINUX_PAIRED_UNINSTALL_ENTRY : uninstallerForRoot(root);
     if (!pair && !fs.existsSync(script)) {

package/lib/setup.mjs

@@ -445,32 +445,92 @@ export function unreadableSystemInstallations({ platform = os.platform(), env =
   return probeInstallRoot(root, io) === 'unreadable' ? [root] : [];
 }
 
+/**
+ * Every fixed path `linuxPairedInstallation()` must stat/read. A root-owned
+ * 0600 metadata file is lstat-able for an ordinary user but unreadable, so
+ * both the stat and the read permission are probed.
+ */
+const PAIRED_PROTECTED_PATHS = [
+  '/opt/nc',
+  '/opt/nc/libexec',
+  '/opt/nc/libexec/privileged-helper',
+  '/opt/nc/libexec/privileged-helper/helper-bootstrap.json',
+  '/opt/nc/libexec/nc-linux-peercred',
+  '/opt/nc/app',
+  '/opt/nc/app/launcher.mjs',
+  '/opt/nc/config',
+  '/opt/nc/config/nc-client.env',
+  '/var/lib/nodecommand',
+  '/var/lib/nodecommand/nc',
+  '/var/lib/nodecommand/nc/config',
+  '/var/lib/nodecommand/nc/config/nc-client.env',
+  '/var/lib/nodecommand/nc/app/launcher.mjs',
+  '/var/lib/nc-lifecycle',
+  '/var/lib/nc-lifecycle/selected.json',
+  '/etc/systemd/system/nc-client.service',
+  '/etc/systemd/user/nc-client.service',
+  '/etc/systemd/system/nc-privileged-helper.service',
+  '/etc/systemd/system/nc-privileged-helper.socket',
+  '/etc/tmpfiles.d/nc-privileged-helper.conf'
+];
+
+/** True when the fixed protected helper paths deny this account access. */
+function pairedMetadataUnreadable(io) {
+  const lstat = io.lstatSync || fs.lstatSync;
+  const access = io.accessSync || fs.accessSync;
+  for (const file of PAIRED_PROTECTED_PATHS) {
+    try {
+      lstat(file);
+    } catch (err) {
+      if (err?.code === 'EACCES' || err?.code === 'EPERM') return true;
+      continue;
+    }
+    try {
+      access(file, fs.constants.R_OK);
+    } catch (err) {
+      if (err?.code === 'EACCES' || err?.code === 'EPERM') return true;
+    }
+  }
+  return false;
+}
+
 /**
  * Removal targets split by accessibility. `install` roots are removed by the
  * local flow; `unreadable` roots (system installs seen from a non-root shell)
  * report explicit trusted-maintenance requirements instead of being
  * silently reported as "nothing to remove".
  * @param {{ platform?: string, env?: NodeJS.ProcessEnv, homedir?: string, io?: object }} [options]
- * @returns {{ install: string[], unreadable: string[], paired?: { ncRoot: string, helperRoot: string, clientId: string }[] }}
+ * @returns {{ install: string[], unreadable: string[], paired: { ncRoot: string, helperRoot: string, clientId: string }[] }}
  */
 export function findRemovalTargets({ io = {}, ...rest } = {}) {
   const install = [];
   const unreadable = [];
-  const pair = (rest.platform || os.platform()) === 'linux' ? linuxPairedInstallation(io) : null;
+  let pair = null;
+  if ((rest.platform || os.platform()) === 'linux') {
+    try {
+      pair = linuxPairedInstallation(io);
+    } catch (err) {
+      // Protected metadata this account cannot stat or read is not a local
+      // removal target. Inventory discovery continues so an ordinary user can
+      // still remove their own readable tree; nothing here executes a root.
+      // Any other validation failure remains a hard stop.
+      if (err?.code !== 'TRUSTED_ROOT_MAINTENANCE_REQUIRED' || !pairedMetadataUnreadable(io)) throw err;
+      pair = null;
+    }
+  }
   const env = rest.env || process.env;
   if (pair && env.NC_ROOT && ![pair.ncRoot, pair.helperRoot].includes(env.NC_ROOT)) throw new Error('TRUSTED_ROOT_MAINTENANCE_REQUIRED: NC_ROOT conflicts with the protected paired installation.');
   const roots = candidateInstallRoots(pair ? { ...rest, env: { ...env, NC_ROOT: undefined } } : rest);
   for (const root of pair ? [...new Set([...roots, pair.ncRoot])] : roots) {
     if (root === pair?.helperRoot && root !== pair.ncRoot) continue;
     const status = probeRemovalRoot(root, io);
-    if (status === 'install') install.push(root);
-    else if (status === 'unreadable') unreadable.push(root);
-  }
-  if (pair) {
-    if (install.length !== 1 || install[0] !== pair.ncRoot || unreadable.length) throw new Error('TRUSTED_ROOT_MAINTENANCE_REQUIRED: conflicting paired installation inventory; preserve all roots.');
-    return { install, unreadable, paired: [pair] };
+    if (status === 'install' && !install.includes(root)) install.push(root);
+    else if (status === 'unreadable' && !unreadable.includes(root)) unreadable.push(root);
   }
-  return { install, unreadable };
+  // The paired relation is only actionable when its root is itself readable.
+  // An unverifiable/foreign paired root is reported through `unreadable`.
+  const paired = pair && install.includes(pair.ncRoot) ? [pair] : [];
+  return { install, unreadable, paired };
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "node-command",
-  "version": "2.0.5",
+  "version": "2.0.7",
   "type": "module",
   "license": "Apache-2.0",
   "engines": {