node-command 2.0.6 → 2.0.8

package/bin/nc.mjs

@@ -21,8 +21,10 @@ import {
   getNcRootForMode,
   installerEnvForMode,
   isElevated,
+  isPartialUserRemovalCandidate,
   isUserInstallRoot,
   probeInstallRoot,
+  removePartialUserRoot,
   resolveExecutable,
   setupTarget,
   unreadableSystemInstallations,
@@ -708,6 +710,37 @@ export function runInstallerScript(scriptPath, ncRoot, extraEnv = {}) {
   });
 }
 
+/**
+ * Best-effort evidence when the agent installer reports a Node.js runtime
+ * failure. The Linux installer suppresses the portable runtime's loader error
+ * and prints only "Node.js 24+ required (portable runtime failed to run)";
+ * replay the binary to surface the real reason (e.g. a missing `libatomic`
+ * dependency of Node.js 25+ official Linux builds). Diagnostic only: it never
+ * changes the installer's runtime requirement or substitutes a downgrade.
+ * @param {string} ncRoot
+ * @returns {string|null}
+ */
+function portableRuntimeFailureDetail(ncRoot) {
+  const bin = path.join(ncRoot, 'tools', 'node', 'bin', 'node');
+  try {
+    const info = fs.lstatSync(bin);
+    if (!info.isFile() || info.isSymbolicLink()) return null;
+    // Probe only a runtime this account owns: never execute a planted binary
+    // from an arbitrary/attacker-writable install tree.
+    if (typeof process.getuid === 'function' && info.uid !== process.getuid()) return null;
+  } catch {
+    return null;
+  }
+  const probe = child_process.spawnSync(bin, ['-p', 'process.versions.node'], {
+    encoding: 'utf8',
+    timeout: 5000,
+    env: { PATH: '/usr/bin:/bin', LANG: 'C', LC_ALL: 'C' }
+  });
+  const detail = String(probe.stderr || '').trim() || (probe.error?.message || '');
+  if (!detail) return null;
+  return sanitizeForDisplay(detail.split(/\r?\n/).filter(Boolean).slice(-3).join(' '), 300);
+}
+
 /**
  * Zero-touch device pairing library.
  *
@@ -1740,7 +1773,11 @@ export async function downloadAndInstallAgent({ ncRoot = undefined, updatesUrl =
       invokeInstaller(scriptPath, root);
     } catch (err) {
       if (err instanceof PairingError) throw err;
-      throw new PairingError('INSTALL_FAILED', `Agent installer failed: ${sanitizeForDisplay(err.message, 300)}. Re-running resumes from the stored host credentials.`);
+      const runtimeDetail = installMode === 'user' ? portableRuntimeFailureDetail(root) : null;
+      const hint = runtimeDetail
+        ? ` The bundled Node.js runtime at ${path.join(root, 'tools', 'node', 'bin', 'node')} also fails to run here: ${runtimeDetail}. Install the distribution runtime dependency (Node.js 25+ official Linux builds require libatomic) or a working Node.js 24+ system runtime, then re-run.`
+        : '';
+      throw new PairingError('INSTALL_FAILED', `Agent installer failed: ${sanitizeForDisplay(err.message, 300)}.${hint} Re-running resumes from the stored host credentials.`);
     }
   } finally {
     console.log('🧹 Cleaning up temporary directory...');
@@ -2440,7 +2477,12 @@ export async function runSetup(args = [], { allowHostIdOnly = false, promptToken
     // existing device identity. The normal verified resume flow is kept.
     const keyPath = getDeviceKeyPath(root);
     if (!protectedContext) {
-      const keyInfo = fs.lstatSync(keyPath);
+      let keyInfo;
+      try {
+        keyInfo = fs.lstatSync(keyPath);
+      } catch (err) {
+        throw new Error(`Existing device key at ${root} is missing or cannot be verified; preserve it for selected-installation maintenance.`, { cause: err });
+      }
       if (!keyInfo.isFile() || keyInfo.isSymbolicLink() || keyInfo.size > 65536 ||
           (os.platform() !== 'win32' && installMode === 'user' && keyInfo.uid !== process.getuid())) {
         throw new Error(`Existing device key at ${root} has an unverifiable type/owner; refusing identity replacement.`);
@@ -2452,8 +2494,23 @@ export async function runSetup(args = [], { allowHostIdOnly = false, promptToken
       throw new Error(`Existing device key at ${root} cannot be verified; preserve it for selected-installation maintenance.`);
     }
     existingEnv = localEnv;
-    const appInfo = fs.lstatSync(path.join(root, 'app'));
-    if (!appInfo.isDirectory() || appInfo.isSymbolicLink()) throw new Error(`Existing application at ${root} is incomplete; use selected-installation maintenance.`);
+    // A failed per-user install can leave config + device key while the
+    // application directory was never staged. That is repairable from the
+    // stored identity exactly like a missing launcher; it must not surface as
+    // a raw ENOENT and block every retry.
+    let appInfo = null;
+    try {
+      appInfo = fs.lstatSync(path.join(root, 'app'));
+    } catch (err) {
+      if (err?.code !== 'ENOENT') throw new Error(`Existing application at ${root} cannot be verified; use selected-installation maintenance.`, { cause: err });
+    }
+    if (!appInfo || !appInfo.isDirectory() || appInfo.isSymbolicLink()) {
+      if (repairUserApplication && canRepairUserApplication({ mode: installMode, protectedContext })) {
+        needsUserAppRepair = true;
+        return;
+      }
+      throw new Error(`Existing application at ${root} is incomplete: the app/ directory is missing or unverifiable. Repair or reinstall the application from the existing root (config/nc-client.env and config/nc-device-key.pem are preserved); no new enrollment was attempted.`);
+    }
     const launcherPath = path.join(root, 'app', 'launcher.mjs');
     let launcherInfo;
     try {
@@ -2900,7 +2957,14 @@ async function runRemoval(args, { command, emptyMessage, elevateOnWindows = fals
   for (const root of removable) {
     const pair = paired.find(selected => selected.ncRoot === root);
     const script = pair ? LINUX_PAIRED_UNINSTALL_ENTRY : uninstallerForRoot(root);
-    if (!pair && !fs.existsSync(script)) {
+    // A failed per-user install can leave its own tree (config plus partial
+    // payload) without the packaged uninstaller. Only the canonical user root
+    // is eligible, and the bounded removal revalidates ancestry, ownership and
+    // every top-level entry. System/protected roots never use this fallback.
+    const scriptExists = pair || fs.existsSync(script);
+    const boundedUserTree = !scriptExists &&
+      (command === 'uninstall' || command === 'remove') && isPartialUserRemovalCandidate(root);
+    if (!scriptExists && !boundedUserTree) {
       console.error(`error: [UNINSTALLER_MISSING] uninstaller not found at ${script}; skipping ${root}.`);
       console.error(uninstallFailureSuggestion());
       failed += 1;
@@ -2915,6 +2979,17 @@ async function runRemoval(args, { command, emptyMessage, elevateOnWindows = fals
       continue;
     }
     try {
+      if (boundedUserTree) {
+        try {
+          removePartialUserRoot(root);
+          console.log(`Removed partial per-user Node Command installation at ${root} (no packaged uninstaller was present).`);
+        } catch (err) {
+          console.error(`error: [USER_TREE_REMOVAL_REFUSED] ${sanitizeForDisplay(err instanceof Error ? err.message : String(err), 300)}`);
+          console.error('suggested_action: The tree was left untouched. Repair it with `nodecommand --user`, or remove it yourself after confirming it is your own Node Command directory.');
+          failed += 1;
+        }
+        continue;
+      }
       runUninstallerScript(script);
       console.log(`Removed ${root}${pair && pair.helperRoot !== root ? ` and paired protected helper ${pair.helperRoot}` : ''} (exit 0).`);
     } catch (err) {

package/lib/setup.mjs

@@ -429,6 +429,102 @@ export function probeRemovalRoot(root, io = {}) {
   }
 }
 
+/** Top-level entries a per-user Node Command tree may contain. A removal never
+ * touches anything else, so a user-owned foreign directory cannot be wiped by
+ * a misdetected install. */
+const USER_INSTALL_ENTRIES = new Set([
+  'app',
+  'backups',
+  'bin',
+  'config',
+  'data',
+  'install-darwin.sh',
+  'install-linux.sh',
+  'install-macos.sh',
+  'lib',
+  'libexec',
+  'logs',
+  'releases',
+  'tmp',
+  'tools',
+  'uninstall.sh'
+]);
+
+/**
+ * True when `root` is the canonical per-user tree for the current account and
+ * is not a protected system root. This is the cheap path/ownership gate; the
+ * tree itself is validated again inside `removePartialUserRoot`.
+ * @param {string} root
+ * @param {{ platform?: string, env?: NodeJS.ProcessEnv, homedir?: string, uid?: number }} [options]
+ */
+export function isPartialUserRemovalCandidate(root, { platform = os.platform(), env = process.env, homedir = os.homedir(), uid = process.getuid?.() } = {}) {
+  // `uninstall.sh` is a POSIX entry; Windows keeps its own uninstaller contract.
+  if (platform === 'win32') return false;
+  if (!Number.isSafeInteger(uid) || uid <= 0) return false;
+  const canonical = { ...env };
+  delete canonical.NC_ROOT;
+  const resolved = path.resolve(root);
+  const userRoot = path.resolve(getNcRootForMode('user', { platform, env: canonical, homedir }));
+  if (resolved !== userRoot) return false;
+  const systemRoots = [
+    getNcRootForMode('system', { platform, env: canonical, homedir }),
+    ...(platform === 'linux' ? ['/opt/nc', '/var/lib/nodecommand/nc'] : platform === 'darwin' ? ['/opt/nc'] : [])
+  ].map((candidate) => path.resolve(candidate));
+  return !systemRoots.some(
+    (candidate) => resolved === candidate || resolved.startsWith(candidate + path.sep) || candidate.startsWith(resolved + path.sep)
+  );
+}
+
+/**
+ * Bounded removal of a per-user Node Command tree whose packaged `uninstall.sh`
+ * is missing (a partial/failed install). Only the canonical per-user root is
+ * eligible; system/protected roots always require their packaged uninstaller.
+ * Refuses symlinked ancestors or entries, foreign ownership, unexpected
+ * top-level entries, and a missing/unreadable `config/nc-client.env` marker.
+ * The caller must hold the install lock. Credentials are removed only because
+ * this function is reached from an explicit uninstall/remove command.
+ * @param {string} root
+ * @param {{ platform?: string, env?: NodeJS.ProcessEnv, homedir?: string, uid?: number, io?: typeof fs }} [options]
+ */
+export function removePartialUserRoot(root, { platform = os.platform(), env = process.env, homedir = os.homedir(), uid = process.getuid?.(), io = fs } = {}) {
+  const refused = (reason) => Object.assign(
+    new Error(`Refusing bounded removal of ${root}: ${reason}.`),
+    { code: 'USER_TREE_REMOVAL_REFUSED' }
+  );
+  if (!isPartialUserRemovalCandidate(root, { platform, env, homedir, uid })) {
+    throw refused('it is not the canonical per-user Node Command root');
+  }
+  const resolved = path.resolve(root);
+  try {
+    if (io.realpathSync(resolved) !== resolved) throw refused('a symlinked ancestor is not removable');
+    const rootInfo = io.lstatSync(resolved);
+    if (rootInfo.isSymbolicLink() || !rootInfo.isDirectory()) throw refused('the root is not a regular directory');
+    if (rootInfo.uid !== uid) throw refused('the root is not owned by the current user');
+    const entries = io.readdirSync(resolved);
+    for (const name of entries) {
+      if (!USER_INSTALL_ENTRIES.has(name)) throw refused(`unexpected top-level entry "${name}"`);
+      const info = io.lstatSync(path.join(resolved, name));
+      if (info.isSymbolicLink()) throw refused(`top-level entry "${name}" is a symlink`);
+      if (info.uid !== uid) throw refused(`top-level entry "${name}" is not owned by the current user`);
+    }
+    for (const [file, directory] of [['config', true], [path.join('config', 'nc-client.env'), false]]) {
+      const info = io.lstatSync(path.join(resolved, file));
+      if (info.isSymbolicLink() || (directory ? !info.isDirectory() : !info.isFile())) {
+        throw refused(`the ${file} marker is missing or not a regular ${directory ? 'directory' : 'file'}`);
+      }
+      if (info.uid !== uid) throw refused(`the ${file} marker is not owned by the current user`);
+    }
+    io.accessSync(path.join(resolved, 'config', 'nc-client.env'), fs.constants.R_OK);
+    for (const name of entries) {
+      io.rmSync(path.join(resolved, name), { recursive: true, force: true });
+    }
+    io.rmdirSync(resolved);
+  } catch (err) {
+    if (err?.code === 'USER_TREE_REMOVAL_REFUSED') throw err;
+    throw refused(err instanceof Error ? err.message : 'the tree could not be verified');
+  }
+}
+
 /**
  * Canonical machine-wide roots that exist but cannot be inspected by the
  * current unprivileged caller. Setup must escalate before deciding anything

package/package.json

@@ -1,16 +1,16 @@
 {
   "name": "node-command",
-  "version": "2.0.6",
+  "version": "2.0.8",
   "type": "module",
   "license": "Apache-2.0",
   "engines": {
     "node": ">=20"
   },
   "bin": {
-    "nc": "./bin/nc.mjs",
-    "nodecommand": "./bin/nc.mjs",
-    "nc-agent": "./bin/nc.mjs",
-    "node-command": "./bin/nc.mjs"
+    "nc": "bin/nc.mjs",
+    "nodecommand": "bin/nc.mjs",
+    "nc-agent": "bin/nc.mjs",
+    "node-command": "bin/nc.mjs"
   },
   "files": [
     "bin/",