node-command 2.0.7 → 2.0.9

package/bin/nc.mjs

@@ -21,8 +21,12 @@ import {
   getNcRootForMode,
   installerEnvForMode,
   isElevated,
+  isPartialSystemRemovalCandidate,
+  isPartialUserRemovalCandidate,
   isUserInstallRoot,
   probeInstallRoot,
+  removePartialSystemRoot,
+  removePartialUserRoot,
   resolveExecutable,
   setupTarget,
   unreadableSystemInstallations,
@@ -708,6 +712,37 @@ export function runInstallerScript(scriptPath, ncRoot, extraEnv = {}) {
   });
 }
 
+/**
+ * Best-effort evidence when the agent installer reports a Node.js runtime
+ * failure. The Linux installer suppresses the portable runtime's loader error
+ * and prints only "Node.js 24+ required (portable runtime failed to run)";
+ * replay the binary to surface the real reason (e.g. a missing `libatomic`
+ * dependency of Node.js 25+ official Linux builds). Diagnostic only: it never
+ * changes the installer's runtime requirement or substitutes a downgrade.
+ * @param {string} ncRoot
+ * @returns {string|null}
+ */
+function portableRuntimeFailureDetail(ncRoot) {
+  const bin = path.join(ncRoot, 'tools', 'node', 'bin', 'node');
+  try {
+    const info = fs.lstatSync(bin);
+    if (!info.isFile() || info.isSymbolicLink()) return null;
+    // Probe only a runtime this account owns: never execute a planted binary
+    // from an arbitrary/attacker-writable install tree.
+    if (typeof process.getuid === 'function' && info.uid !== process.getuid()) return null;
+  } catch {
+    return null;
+  }
+  const probe = child_process.spawnSync(bin, ['-p', 'process.versions.node'], {
+    encoding: 'utf8',
+    timeout: 5000,
+    env: { PATH: '/usr/bin:/bin', LANG: 'C', LC_ALL: 'C' }
+  });
+  const detail = String(probe.stderr || '').trim() || (probe.error?.message || '');
+  if (!detail) return null;
+  return sanitizeForDisplay(detail.split(/\r?\n/).filter(Boolean).slice(-3).join(' '), 300);
+}
+
 /**
  * Zero-touch device pairing library.
  *
@@ -1740,7 +1775,11 @@ export async function downloadAndInstallAgent({ ncRoot = undefined, updatesUrl =
       invokeInstaller(scriptPath, root);
     } catch (err) {
       if (err instanceof PairingError) throw err;
-      throw new PairingError('INSTALL_FAILED', `Agent installer failed: ${sanitizeForDisplay(err.message, 300)}. Re-running resumes from the stored host credentials.`);
+      const runtimeDetail = installMode === 'user' ? portableRuntimeFailureDetail(root) : null;
+      const hint = runtimeDetail
+        ? ` The bundled Node.js runtime at ${path.join(root, 'tools', 'node', 'bin', 'node')} also fails to run here: ${runtimeDetail}. Install the distribution runtime dependency (Node.js 25+ official Linux builds require libatomic) or a working Node.js 24+ system runtime, then re-run.`
+        : '';
+      throw new PairingError('INSTALL_FAILED', `Agent installer failed: ${sanitizeForDisplay(err.message, 300)}.${hint} Re-running resumes from the stored host credentials.`);
     }
   } finally {
     console.log('🧹 Cleaning up temporary directory...');
@@ -2440,7 +2479,12 @@ export async function runSetup(args = [], { allowHostIdOnly = false, promptToken
     // existing device identity. The normal verified resume flow is kept.
     const keyPath = getDeviceKeyPath(root);
     if (!protectedContext) {
-      const keyInfo = fs.lstatSync(keyPath);
+      let keyInfo;
+      try {
+        keyInfo = fs.lstatSync(keyPath);
+      } catch (err) {
+        throw new Error(`Existing device key at ${root} is missing or cannot be verified; preserve it for selected-installation maintenance.`, { cause: err });
+      }
       if (!keyInfo.isFile() || keyInfo.isSymbolicLink() || keyInfo.size > 65536 ||
           (os.platform() !== 'win32' && installMode === 'user' && keyInfo.uid !== process.getuid())) {
         throw new Error(`Existing device key at ${root} has an unverifiable type/owner; refusing identity replacement.`);
@@ -2452,8 +2496,23 @@ export async function runSetup(args = [], { allowHostIdOnly = false, promptToken
       throw new Error(`Existing device key at ${root} cannot be verified; preserve it for selected-installation maintenance.`);
     }
     existingEnv = localEnv;
-    const appInfo = fs.lstatSync(path.join(root, 'app'));
-    if (!appInfo.isDirectory() || appInfo.isSymbolicLink()) throw new Error(`Existing application at ${root} is incomplete; use selected-installation maintenance.`);
+    // A failed per-user install can leave config + device key while the
+    // application directory was never staged. That is repairable from the
+    // stored identity exactly like a missing launcher; it must not surface as
+    // a raw ENOENT and block every retry.
+    let appInfo = null;
+    try {
+      appInfo = fs.lstatSync(path.join(root, 'app'));
+    } catch (err) {
+      if (err?.code !== 'ENOENT') throw new Error(`Existing application at ${root} cannot be verified; use selected-installation maintenance.`, { cause: err });
+    }
+    if (!appInfo || !appInfo.isDirectory() || appInfo.isSymbolicLink()) {
+      if (repairUserApplication && canRepairUserApplication({ mode: installMode, protectedContext })) {
+        needsUserAppRepair = true;
+        return;
+      }
+      throw new Error(`Existing application at ${root} is incomplete: the app/ directory is missing or unverifiable. Repair or reinstall the application from the existing root (config/nc-client.env and config/nc-device-key.pem are preserved); no new enrollment was attempted.`);
+    }
     const launcherPath = path.join(root, 'app', 'launcher.mjs');
     let launcherInfo;
     try {
@@ -2900,7 +2959,20 @@ async function runRemoval(args, { command, emptyMessage, elevateOnWindows = fals
   for (const root of removable) {
     const pair = paired.find(selected => selected.ncRoot === root);
     const script = pair ? LINUX_PAIRED_UNINSTALL_ENTRY : uninstallerForRoot(root);
-    if (!pair && !fs.existsSync(script)) {
+    // A failed per-user install can leave its own tree (config plus partial
+    // payload) without the packaged uninstaller. Only the canonical user root
+    // is eligible, and the bounded removal revalidates ancestry, ownership and
+    // every top-level entry. Real system installs never use this fallback;
+    // the exact /opt/nc partial tree has its own narrower root-only exception.
+    const scriptExists = pair || fs.existsSync(script);
+    const explicitRemoval = command === 'uninstall' || command === 'remove';
+    const partialUserTree = !scriptExists && explicitRemoval && isPartialUserRemovalCandidate(root);
+    // The narrow system exception is /opt/nc only, requires real+effective
+    // root, and refuses app/, uninstall.sh, units, libexec/ and lifecycle
+    // metadata inside removePartialSystemRoot.
+    const partialSystemTree = !scriptExists && explicitRemoval && isPartialSystemRemovalCandidate(root);
+    const boundedTree = partialUserTree || partialSystemTree;
+    if (!scriptExists && !boundedTree) {
       console.error(`error: [UNINSTALLER_MISSING] uninstaller not found at ${script}; skipping ${root}.`);
       console.error(uninstallFailureSuggestion());
       failed += 1;
@@ -2915,6 +2987,23 @@ async function runRemoval(args, { command, emptyMessage, elevateOnWindows = fals
       continue;
     }
     try {
+      if (boundedTree) {
+        try {
+          if (partialSystemTree) removePartialSystemRoot(root);
+          else removePartialUserRoot(root);
+          console.log(partialSystemTree
+            ? `Removed partial system Node Command installation at ${root} (no packaged uninstaller, unit or application payload).`
+            : `Removed partial per-user Node Command installation at ${root} (no packaged uninstaller was present).`);
+        } catch (err) {
+          const code = typeof err?.code === 'string' && /_REFUSED$/.test(err.code) ? err.code : 'PARTIAL_ROOT_REMOVAL_REFUSED';
+          console.error(`error: [${code}] ${sanitizeForDisplay(err instanceof Error ? err.message : String(err), 300)}`);
+          console.error(partialSystemTree
+            ? 'suggested_action: The system tree was left untouched. Inspect /opt/nc and complete or repair the failed system installation through explicit root maintenance; credentials/config were preserved.'
+            : 'suggested_action: The tree was left untouched. Repair it with `nodecommand --user`, or remove it yourself after confirming it is your own Node Command directory.');
+          failed += 1;
+        }
+        continue;
+      }
       runUninstallerScript(script);
       console.log(`Removed ${root}${pair && pair.helperRoot !== root ? ` and paired protected helper ${pair.helperRoot}` : ''} (exit 0).`);
     } catch (err) {

package/lib/setup.mjs

@@ -429,6 +429,190 @@ export function probeRemovalRoot(root, io = {}) {
   }
 }
 
+/** Top-level entries a per-user Node Command tree may contain. A removal never
+ * touches anything else, so a user-owned foreign directory cannot be wiped by
+ * a misdetected install. */
+const USER_INSTALL_ENTRIES = new Set([
+  'app',
+  'backups',
+  'bin',
+  'config',
+  'data',
+  'install-darwin.sh',
+  'install-linux.sh',
+  'install-macos.sh',
+  'lib',
+  'libexec',
+  'logs',
+  'releases',
+  'tmp',
+  'tools',
+  'uninstall.sh'
+]);
+
+/** Canonical system root eligible only for a narrow, root-only cleanup. */
+export const PARTIAL_SYSTEM_ROOT = '/opt/nc';
+
+/** A failed system install may leave only these payload/config directories. */
+const PARTIAL_SYSTEM_ENTRIES = new Set(['config', 'tools', 'logs', 'tmp', 'releases', 'backups']);
+
+/** Artifacts that prove a real system installation exists; never bypassed. */
+const PARTIAL_SYSTEM_FORBIDDEN_PATHS = [
+  '/etc/systemd/system/nc-client.service',
+  '/etc/systemd/system/nc-client.service.d',
+  '/etc/systemd/user/nc-client.service',
+  '/etc/systemd/user/nc-client.service.d',
+  '/etc/systemd/system/multi-user.target.wants/nc-client.service',
+  '/etc/systemd/system/nc-privileged-helper.service',
+  '/etc/systemd/system/nc-privileged-helper.socket',
+  '/etc/tmpfiles.d/nc-privileged-helper.conf',
+  '/var/lib/nc-lifecycle',
+  '/var/lib/nodecommand/nc'
+];
+
+/**
+ * True when `root` is the canonical per-user tree for the current account and
+ * is not a protected system root. This is the cheap path/ownership gate; the
+ * tree itself is validated again inside `removePartialUserRoot`.
+ * @param {string} root
+ * @param {{ platform?: string, env?: NodeJS.ProcessEnv, homedir?: string, uid?: number }} [options]
+ */
+export function isPartialUserRemovalCandidate(root, { platform = os.platform(), env = process.env, homedir = os.homedir(), uid = process.getuid?.() } = {}) {
+  // `uninstall.sh` is a POSIX entry; Windows keeps its own uninstaller contract.
+  if (platform === 'win32') return false;
+  if (!Number.isSafeInteger(uid) || uid <= 0) return false;
+  const canonical = { ...env };
+  delete canonical.NC_ROOT;
+  const resolved = path.resolve(root);
+  const userRoot = path.resolve(getNcRootForMode('user', { platform, env: canonical, homedir }));
+  if (resolved !== userRoot) return false;
+  const systemRoots = [
+    getNcRootForMode('system', { platform, env: canonical, homedir }),
+    ...(platform === 'linux' ? ['/opt/nc', '/var/lib/nodecommand/nc'] : platform === 'darwin' ? ['/opt/nc'] : [])
+  ].map((candidate) => path.resolve(candidate));
+  return !systemRoots.some(
+    (candidate) => resolved === candidate || resolved.startsWith(candidate + path.sep) || candidate.startsWith(resolved + path.sep)
+  );
+}
+
+/**
+ * True only for the exact Linux system root when the process holds real AND
+ * effective root. The tree contents and every real-install artifact are
+ * checked again inside `removePartialSystemRoot`.
+ * @param {string} root
+ * @param {{ platform?: string, getuid?: (() => number)|null, geteuid?: (() => number)|null }} [options]
+ */
+export function isPartialSystemRemovalCandidate(root, { platform = os.platform(), getuid = process.getuid, geteuid = process.geteuid } = {}) {
+  if (platform !== 'linux') return false;
+  if (typeof getuid !== 'function' || typeof geteuid !== 'function') return false;
+  try {
+    if (getuid() !== 0 || geteuid() !== 0) return false;
+  } catch {
+    return false;
+  }
+  return path.resolve(root) === PARTIAL_SYSTEM_ROOT;
+}
+
+/** Shared bounded removal of an already-authorized root. */
+function removeBoundedRoot(root, { uid, allowedEntries, io, refused, owner }) {
+  const resolved = path.resolve(root);
+  if (io.realpathSync(resolved) !== resolved) throw refused('a symlinked ancestor is not removable');
+  const rootInfo = io.lstatSync(resolved);
+  if (rootInfo.isSymbolicLink() || !rootInfo.isDirectory()) throw refused('the root is not a regular directory');
+  if (rootInfo.uid !== uid) throw refused(`the root is not owned by ${owner}`);
+  const entries = io.readdirSync(resolved);
+  for (const name of entries) {
+    if (!allowedEntries.has(name)) throw refused(`unexpected top-level entry "${name}"`);
+    const info = io.lstatSync(path.join(resolved, name));
+    if (info.isSymbolicLink()) throw refused(`top-level entry "${name}" is a symlink`);
+    if (info.uid !== uid) throw refused(`top-level entry "${name}" is not owned by ${owner}`);
+  }
+  for (const [file, directory] of [['config', true], [path.join('config', 'nc-client.env'), false]]) {
+    const info = io.lstatSync(path.join(resolved, file));
+    if (info.isSymbolicLink() || (directory ? !info.isDirectory() : !info.isFile())) {
+      throw refused(`the ${file} marker is missing or not a regular ${directory ? 'directory' : 'file'}`);
+    }
+    if (info.uid !== uid) throw refused(`the ${file} marker is not owned by ${owner}`);
+  }
+  io.accessSync(path.join(resolved, 'config', 'nc-client.env'), fs.constants.R_OK);
+  for (const name of entries) {
+    io.rmSync(path.join(resolved, name), { recursive: true, force: true });
+  }
+  io.rmdirSync(resolved);
+}
+
+/**
+ * Bounded removal of a per-user Node Command tree whose packaged `uninstall.sh`
+ * is missing (a partial/failed install). Only the canonical per-user root is
+ * eligible; system/protected roots always require their packaged uninstaller.
+ * Refuses symlinked ancestors or entries, foreign ownership, unexpected
+ * top-level entries, and a missing/unreadable `config/nc-client.env` marker.
+ * The caller must hold the install lock. Credentials are removed only because
+ * this function is reached from an explicit uninstall/remove command.
+ * @param {string} root
+ * @param {{ platform?: string, env?: NodeJS.ProcessEnv, homedir?: string, uid?: number, io?: typeof fs }} [options]
+ */
+export function removePartialUserRoot(root, { platform = os.platform(), env = process.env, homedir = os.homedir(), uid = process.getuid?.(), io = fs } = {}) {
+  const refused = (reason) => Object.assign(
+    new Error(`Refusing bounded removal of ${root}: ${reason}.`),
+    { code: 'USER_TREE_REMOVAL_REFUSED' }
+  );
+  if (!isPartialUserRemovalCandidate(root, { platform, env, homedir, uid })) {
+    throw refused('it is not the canonical per-user Node Command root');
+  }
+  try {
+    removeBoundedRoot(root, {
+      uid,
+      allowedEntries: USER_INSTALL_ENTRIES,
+      io,
+      refused,
+      owner: 'the current user'
+    });
+  } catch (err) {
+    if (err?.code === 'USER_TREE_REMOVAL_REFUSED') throw err;
+    throw refused(err instanceof Error ? err.message : 'the tree could not be verified');
+  }
+}
+
+/**
+ * Root-only bounded removal of a failed SYSTEM install at /opt/nc. This is not
+ * a general system-root fallback: it requires real+effective root, the exact
+ * canonical root, no unit/helper/lifecycle artifact, and only the known partial
+ * payload directories. A real or unverifiable installation stays fail-closed.
+ * @param {string} root
+ * @param {{ platform?: string, getuid?: (() => number)|null, geteuid?: (() => number)|null, io?: typeof fs }} [options]
+ */
+export function removePartialSystemRoot(root, { platform = os.platform(), getuid = process.getuid, geteuid = process.geteuid, io = fs } = {}) {
+  const refused = (reason) => Object.assign(
+    new Error(`Refusing bounded removal of ${root}: ${reason}.`),
+    { code: 'PARTIAL_SYSTEM_REMOVAL_REFUSED' }
+  );
+  if (!isPartialSystemRemovalCandidate(root, { platform, getuid, geteuid })) {
+    throw refused('it is not the canonical partial system root');
+  }
+  try {
+    for (const file of PARTIAL_SYSTEM_FORBIDDEN_PATHS) {
+      try {
+        io.lstatSync(file);
+      } catch (err) {
+        if (err?.code === 'ENOENT') continue;
+        throw refused(`existing installation state at ${file} cannot be verified`);
+      }
+      throw refused(`${file} exists; a real installation requires its packaged maintenance`);
+    }
+    removeBoundedRoot(path.resolve(root), {
+      uid: 0,
+      allowedEntries: PARTIAL_SYSTEM_ENTRIES,
+      io,
+      refused,
+      owner: 'root'
+    });
+  } catch (err) {
+    if (err?.code === 'PARTIAL_SYSTEM_REMOVAL_REFUSED') throw err;
+    throw refused(err instanceof Error ? err.message : 'the tree could not be verified');
+  }
+}
+
 /**
  * Canonical machine-wide roots that exist but cannot be inspected by the
  * current unprivileged caller. Setup must escalate before deciding anything

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "node-command",
-  "version": "2.0.7",
+  "version": "2.0.9",
   "type": "module",
   "license": "Apache-2.0",
   "engines": {