node-command 2.0.8 → 2.0.9

package/bin/nc.mjs

@@ -21,9 +21,11 @@ import {
   getNcRootForMode,
   installerEnvForMode,
   isElevated,
+  isPartialSystemRemovalCandidate,
   isPartialUserRemovalCandidate,
   isUserInstallRoot,
   probeInstallRoot,
+  removePartialSystemRoot,
   removePartialUserRoot,
   resolveExecutable,
   setupTarget,
@@ -2960,11 +2962,17 @@ async function runRemoval(args, { command, emptyMessage, elevateOnWindows = fals
     // A failed per-user install can leave its own tree (config plus partial
     // payload) without the packaged uninstaller. Only the canonical user root
     // is eligible, and the bounded removal revalidates ancestry, ownership and
-    // every top-level entry. System/protected roots never use this fallback.
+    // every top-level entry. Real system installs never use this fallback;
+    // the exact /opt/nc partial tree has its own narrower root-only exception.
     const scriptExists = pair || fs.existsSync(script);
-    const boundedUserTree = !scriptExists &&
-      (command === 'uninstall' || command === 'remove') && isPartialUserRemovalCandidate(root);
-    if (!scriptExists && !boundedUserTree) {
+    const explicitRemoval = command === 'uninstall' || command === 'remove';
+    const partialUserTree = !scriptExists && explicitRemoval && isPartialUserRemovalCandidate(root);
+    // The narrow system exception is /opt/nc only, requires real+effective
+    // root, and refuses app/, uninstall.sh, units, libexec/ and lifecycle
+    // metadata inside removePartialSystemRoot.
+    const partialSystemTree = !scriptExists && explicitRemoval && isPartialSystemRemovalCandidate(root);
+    const boundedTree = partialUserTree || partialSystemTree;
+    if (!scriptExists && !boundedTree) {
       console.error(`error: [UNINSTALLER_MISSING] uninstaller not found at ${script}; skipping ${root}.`);
       console.error(uninstallFailureSuggestion());
       failed += 1;
@@ -2979,13 +2987,19 @@ async function runRemoval(args, { command, emptyMessage, elevateOnWindows = fals
       continue;
     }
     try {
-      if (boundedUserTree) {
+      if (boundedTree) {
         try {
-          removePartialUserRoot(root);
-          console.log(`Removed partial per-user Node Command installation at ${root} (no packaged uninstaller was present).`);
+          if (partialSystemTree) removePartialSystemRoot(root);
+          else removePartialUserRoot(root);
+          console.log(partialSystemTree
+            ? `Removed partial system Node Command installation at ${root} (no packaged uninstaller, unit or application payload).`
+            : `Removed partial per-user Node Command installation at ${root} (no packaged uninstaller was present).`);
         } catch (err) {
-          console.error(`error: [USER_TREE_REMOVAL_REFUSED] ${sanitizeForDisplay(err instanceof Error ? err.message : String(err), 300)}`);
-          console.error('suggested_action: The tree was left untouched. Repair it with `nodecommand --user`, or remove it yourself after confirming it is your own Node Command directory.');
+          const code = typeof err?.code === 'string' && /_REFUSED$/.test(err.code) ? err.code : 'PARTIAL_ROOT_REMOVAL_REFUSED';
+          console.error(`error: [${code}] ${sanitizeForDisplay(err instanceof Error ? err.message : String(err), 300)}`);
+          console.error(partialSystemTree
+            ? 'suggested_action: The system tree was left untouched. Inspect /opt/nc and complete or repair the failed system installation through explicit root maintenance; credentials/config were preserved.'
+            : 'suggested_action: The tree was left untouched. Repair it with `nodecommand --user`, or remove it yourself after confirming it is your own Node Command directory.');
           failed += 1;
         }
         continue;

package/lib/setup.mjs

@@ -450,6 +450,26 @@ const USER_INSTALL_ENTRIES = new Set([
   'uninstall.sh'
 ]);
 
+/** Canonical system root eligible only for a narrow, root-only cleanup. */
+export const PARTIAL_SYSTEM_ROOT = '/opt/nc';
+
+/** A failed system install may leave only these payload/config directories. */
+const PARTIAL_SYSTEM_ENTRIES = new Set(['config', 'tools', 'logs', 'tmp', 'releases', 'backups']);
+
+/** Artifacts that prove a real system installation exists; never bypassed. */
+const PARTIAL_SYSTEM_FORBIDDEN_PATHS = [
+  '/etc/systemd/system/nc-client.service',
+  '/etc/systemd/system/nc-client.service.d',
+  '/etc/systemd/user/nc-client.service',
+  '/etc/systemd/user/nc-client.service.d',
+  '/etc/systemd/system/multi-user.target.wants/nc-client.service',
+  '/etc/systemd/system/nc-privileged-helper.service',
+  '/etc/systemd/system/nc-privileged-helper.socket',
+  '/etc/tmpfiles.d/nc-privileged-helper.conf',
+  '/var/lib/nc-lifecycle',
+  '/var/lib/nodecommand/nc'
+];
+
 /**
  * True when `root` is the canonical per-user tree for the current account and
  * is not a protected system root. This is the cheap path/ownership gate; the
@@ -475,6 +495,52 @@ export function isPartialUserRemovalCandidate(root, { platform = os.platform(),
   );
 }
 
+/**
+ * True only for the exact Linux system root when the process holds real AND
+ * effective root. The tree contents and every real-install artifact are
+ * checked again inside `removePartialSystemRoot`.
+ * @param {string} root
+ * @param {{ platform?: string, getuid?: (() => number)|null, geteuid?: (() => number)|null }} [options]
+ */
+export function isPartialSystemRemovalCandidate(root, { platform = os.platform(), getuid = process.getuid, geteuid = process.geteuid } = {}) {
+  if (platform !== 'linux') return false;
+  if (typeof getuid !== 'function' || typeof geteuid !== 'function') return false;
+  try {
+    if (getuid() !== 0 || geteuid() !== 0) return false;
+  } catch {
+    return false;
+  }
+  return path.resolve(root) === PARTIAL_SYSTEM_ROOT;
+}
+
+/** Shared bounded removal of an already-authorized root. */
+function removeBoundedRoot(root, { uid, allowedEntries, io, refused, owner }) {
+  const resolved = path.resolve(root);
+  if (io.realpathSync(resolved) !== resolved) throw refused('a symlinked ancestor is not removable');
+  const rootInfo = io.lstatSync(resolved);
+  if (rootInfo.isSymbolicLink() || !rootInfo.isDirectory()) throw refused('the root is not a regular directory');
+  if (rootInfo.uid !== uid) throw refused(`the root is not owned by ${owner}`);
+  const entries = io.readdirSync(resolved);
+  for (const name of entries) {
+    if (!allowedEntries.has(name)) throw refused(`unexpected top-level entry "${name}"`);
+    const info = io.lstatSync(path.join(resolved, name));
+    if (info.isSymbolicLink()) throw refused(`top-level entry "${name}" is a symlink`);
+    if (info.uid !== uid) throw refused(`top-level entry "${name}" is not owned by ${owner}`);
+  }
+  for (const [file, directory] of [['config', true], [path.join('config', 'nc-client.env'), false]]) {
+    const info = io.lstatSync(path.join(resolved, file));
+    if (info.isSymbolicLink() || (directory ? !info.isDirectory() : !info.isFile())) {
+      throw refused(`the ${file} marker is missing or not a regular ${directory ? 'directory' : 'file'}`);
+    }
+    if (info.uid !== uid) throw refused(`the ${file} marker is not owned by ${owner}`);
+  }
+  io.accessSync(path.join(resolved, 'config', 'nc-client.env'), fs.constants.R_OK);
+  for (const name of entries) {
+    io.rmSync(path.join(resolved, name), { recursive: true, force: true });
+  }
+  io.rmdirSync(resolved);
+}
+
 /**
  * Bounded removal of a per-user Node Command tree whose packaged `uninstall.sh`
  * is missing (a partial/failed install). Only the canonical per-user root is
@@ -494,33 +560,55 @@ export function removePartialUserRoot(root, { platform = os.platform(), env = pr
   if (!isPartialUserRemovalCandidate(root, { platform, env, homedir, uid })) {
     throw refused('it is not the canonical per-user Node Command root');
   }
-  const resolved = path.resolve(root);
   try {
-    if (io.realpathSync(resolved) !== resolved) throw refused('a symlinked ancestor is not removable');
-    const rootInfo = io.lstatSync(resolved);
-    if (rootInfo.isSymbolicLink() || !rootInfo.isDirectory()) throw refused('the root is not a regular directory');
-    if (rootInfo.uid !== uid) throw refused('the root is not owned by the current user');
-    const entries = io.readdirSync(resolved);
-    for (const name of entries) {
-      if (!USER_INSTALL_ENTRIES.has(name)) throw refused(`unexpected top-level entry "${name}"`);
-      const info = io.lstatSync(path.join(resolved, name));
-      if (info.isSymbolicLink()) throw refused(`top-level entry "${name}" is a symlink`);
-      if (info.uid !== uid) throw refused(`top-level entry "${name}" is not owned by the current user`);
-    }
-    for (const [file, directory] of [['config', true], [path.join('config', 'nc-client.env'), false]]) {
-      const info = io.lstatSync(path.join(resolved, file));
-      if (info.isSymbolicLink() || (directory ? !info.isDirectory() : !info.isFile())) {
-        throw refused(`the ${file} marker is missing or not a regular ${directory ? 'directory' : 'file'}`);
+    removeBoundedRoot(root, {
+      uid,
+      allowedEntries: USER_INSTALL_ENTRIES,
+      io,
+      refused,
+      owner: 'the current user'
+    });
+  } catch (err) {
+    if (err?.code === 'USER_TREE_REMOVAL_REFUSED') throw err;
+    throw refused(err instanceof Error ? err.message : 'the tree could not be verified');
+  }
+}
+
+/**
+ * Root-only bounded removal of a failed SYSTEM install at /opt/nc. This is not
+ * a general system-root fallback: it requires real+effective root, the exact
+ * canonical root, no unit/helper/lifecycle artifact, and only the known partial
+ * payload directories. A real or unverifiable installation stays fail-closed.
+ * @param {string} root
+ * @param {{ platform?: string, getuid?: (() => number)|null, geteuid?: (() => number)|null, io?: typeof fs }} [options]
+ */
+export function removePartialSystemRoot(root, { platform = os.platform(), getuid = process.getuid, geteuid = process.geteuid, io = fs } = {}) {
+  const refused = (reason) => Object.assign(
+    new Error(`Refusing bounded removal of ${root}: ${reason}.`),
+    { code: 'PARTIAL_SYSTEM_REMOVAL_REFUSED' }
+  );
+  if (!isPartialSystemRemovalCandidate(root, { platform, getuid, geteuid })) {
+    throw refused('it is not the canonical partial system root');
+  }
+  try {
+    for (const file of PARTIAL_SYSTEM_FORBIDDEN_PATHS) {
+      try {
+        io.lstatSync(file);
+      } catch (err) {
+        if (err?.code === 'ENOENT') continue;
+        throw refused(`existing installation state at ${file} cannot be verified`);
       }
-      if (info.uid !== uid) throw refused(`the ${file} marker is not owned by the current user`);
+      throw refused(`${file} exists; a real installation requires its packaged maintenance`);
     }
-    io.accessSync(path.join(resolved, 'config', 'nc-client.env'), fs.constants.R_OK);
-    for (const name of entries) {
-      io.rmSync(path.join(resolved, name), { recursive: true, force: true });
-    }
-    io.rmdirSync(resolved);
+    removeBoundedRoot(path.resolve(root), {
+      uid: 0,
+      allowedEntries: PARTIAL_SYSTEM_ENTRIES,
+      io,
+      refused,
+      owner: 'root'
+    });
   } catch (err) {
-    if (err?.code === 'USER_TREE_REMOVAL_REFUSED') throw err;
+    if (err?.code === 'PARTIAL_SYSTEM_REMOVAL_REFUSED') throw err;
     throw refused(err instanceof Error ? err.message : 'the tree could not be verified');
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "node-command",
-  "version": "2.0.8",
+  "version": "2.0.9",
   "type": "module",
   "license": "Apache-2.0",
   "engines": {