release: 1.3.4

uninstall.sh

@@ -417,6 +417,7 @@ remove_prefix() {
     log "warning: 保留非符号链接 current：$current"
   fi
   remove_tree "$releases" 'releases'
+  remove_managed_node
   remove_tree "$PREFIX/.update-work" 'update work'
   remove_file_if_owned "$PREFIX/.update-state" 'update state'
   if [[ -d "$PREFIX" && ! -L "$PREFIX" ]]; then
@@ -429,6 +430,33 @@ remove_prefix() {
   fi
 }
 
+remove_managed_node() {
+  local node_root="$PREFIX/nodejs" marker
+  [[ -e "$node_root" || -L "$node_root" ]] || return 0
+  [[ -d "$node_root" && ! -L "$node_root" ]] || die "Node.js 管理目录不是安全目录：$node_root"
+  marker="$node_root/.tallynote-managed"
+  if [[ ! -f "$marker" || "$(sed -n '1p' "$marker" 2>/dev/null)" != tallynote-managed-node-v1 ]]; then
+    log "保留非 TallyNote 管理的 Node.js 目录：$node_root"
+    return 0
+  fi
+  allowed_owner "$node_root" || die "Node.js 管理目录的所有者不受信任：$node_root"
+  # Node distributions contain npm/corepack symlinks. They are safe to remove
+  # because rm never follows symlinks; validate ownership and permissions for
+  # every node while deliberately permitting those internal links.
+  local node mode_bits
+  while IFS= read -r node; do
+    allowed_owner "$node" || die "Node.js 管理目录节点的所有者不受信任：$node"
+    [[ -L "$node" ]] && continue
+    mode_bits=$(stat_mode_bits "$node")
+    (( (mode_bits & 18) == 0 )) || die "Node.js 管理目录权限过宽：$node"
+  done < <(find "$node_root" -print)
+  if (( DRY_RUN )); then
+    log "dry-run: remove managed Node.js $node_root"
+  else
+    rm -rf -- "$node_root"
+  fi
+}
+
 remove_config() {
   remove_file_if_owned "$CONFIG_DIR/update-signing-key.pub" 'update public key'
   remove_file_if_owned "$CONFIG_DIR/tallynote.env" 'environment file'