fix: expose simple uninstall commands

Author: onjsdnjs

README.md

@@ -34,7 +34,8 @@ $ErrorActionPreference='Stop'; & ([scriptblock]::Create((Invoke-WebRequest https
 - 변경되지 않는 버전별 설치기: `https://install.ctxa.ai/<installer-tag>/install.sh` 또는 `install.ps1`
 - 고정 CLI 릴리스 설치: `CONTEXA_VERSION=<release-tag>`
 - 직전 정상 바이너리로 롤백: `CONTEXA_INSTALL_ACTION=rollback`
-- CLI 바이너리 제거: `CONTEXA_INSTALL_ACTION=uninstall`
+- Windows CLI 바이너리 제거: `irm https://install.ctxa.ai/uninstall.ps1 | iex`
+- Linux/macOS CLI 바이너리 제거: `curl -fsSL https://install.ctxa.ai/uninstall.sh | sh`
 - 사용자 프로젝트 원복: `contexa reset` — CLI 제거와 다른 작업입니다.
 
 동일 버전을 다시 실행하면 설치 바이너리를 교체하지 않습니다. 업데이트가 성공하면 직전 정상 바이너리를 `.previous`로 보존해 롤백 대상으로 사용합니다. 이전 경로에서 발견된 다른 `contexa` 바이너리는 자동으로 삭제하지 않고 경고만 출력합니다.

api/index.js

@@ -7,6 +7,8 @@ const path = require('path');
 // Routing:
 //   /install.ps1, /win, /windows, PowerShell UA -> install.ps1
 //   /install.sh, /sh, /linux, /mac, everything else -> install.sh
+//   /uninstall.ps1 -> uninstall.ps1
+//   /uninstall.sh -> uninstall.sh
 module.exports = (req, res) => {
   const pathname = new URL(req.url || '/', 'https://install.ctxa.ai').pathname;
   const routePath = pathname.toLowerCase();
@@ -26,14 +28,22 @@ module.exports = (req, res) => {
 
   const explicitPs1 = routePath === '/install.ps1';
   const explicitSh = routePath === '/install.sh';
+  const explicitUninstallPs1 = routePath === '/uninstall.ps1';
+  const explicitUninstallSh = routePath === '/uninstall.sh';
   const windowsAlias = routePath === '/win' || routePath === '/windows';
   const shellAlias = routePath === '/sh' || routePath === '/linux' || routePath === '/mac';
   const wantsPs1 = explicitPs1
-    || (!explicitSh && !shellAlias && (windowsAlias || ua.includes('powershell') || ua.includes('windowspowershell')));
+    || (!explicitSh && !explicitUninstallSh && !shellAlias
+      && (windowsAlias || ua.includes('powershell') || ua.includes('windowspowershell')));
 
-  const fileName = wantsPs1 ? 'install.ps1' : 'install.sh';
+  const uninstallRoute = explicitUninstallPs1 || explicitUninstallSh;
+  const fileName = explicitUninstallPs1
+    ? 'uninstall.ps1'
+    : explicitUninstallSh
+      ? 'uninstall.sh'
+      : wantsPs1 ? 'install.ps1' : 'install.sh';
   const stableRef = process.env.CONTEXA_STABLE_INSTALLER_REF;
-  if (stableRef) {
+  if (stableRef && !uninstallRoute) {
     if (!/^(?:v[0-9A-Za-z][0-9A-Za-z._-]*|[0-9a-f]{40})$/.test(stableRef)) {
       res.statusCode = 503;
       res.setHeader('Content-Type', 'text/plain; charset=utf-8');

install.ps1

@@ -642,7 +642,7 @@ function Invoke-ContexaInstaller {
         Write-Host '    contexa reset --simulate'
         Write-Host ('  ' + (Select-InstallerText 'Immutable reinstall: set CONTEXA_VERSION=' '64+Z7J28IOuyhOyghCDsnqzshKTsuZg6IENPTlRFWEFfVkVSU0lPTj0=') + $version + (Select-InstallerText ' and run this installer again.' '7J2EIOyEpOygle2VmOqzoCDshKTsuZgg7ZSE66Gc6re4656o7J2EIOuLpOyLnCDsi6TtlontlZjshLjsmpQu'))
         Write-Host ('  ' + (Select-InstallerText 'Rollback: set CONTEXA_INSTALL_ACTION=rollback and run this installer.' '66Gk67CxOiBDT05URVhBX0lOU1RBTExfQUNUSU9OPXJvbGxiYWNr7J2EIOyEpOygle2VmOqzoCDshKTsuZgg7ZSE66Gc6re4656o7J2EIOyLpO2Wie2VmOyEuOyalC4='))
-        Write-Host ('  ' + (Select-InstallerText 'Uninstall: set CONTEXA_INSTALL_ACTION=uninstall and run this installer. Project reset is separate.' '7KCc6rGwOiBDT05URVhBX0lOU1RBTExfQUNUSU9OPXVuaW5zdGFsbOydhCDshKTsoJXtlZjqs6Ag7ISk7LmYIO2UhOuhnOq3uOueqOydhCDsi6TtlontlZjshLjsmpQuIO2UhOuhnOygne2KuCByZXNldOydgCDrs4Trj4TsnoXri4jri6Qu'))
+        Write-Host ('  ' + (Select-InstallerText 'Uninstall: irm https://install.ctxa.ai/uninstall.ps1 | iex (project reset is separate).' '7KCc6rGwOiBpcm0gaHR0cHM6Ly9pbnN0YWxsLmN0eGEuYWkvdW5pbnN0YWxsLnBzMSB8IGlleCAo7ZSE66Gc7KCd7Yq4IHJlc2V07J2AIOuzhOuPhCk='))
     } catch {
         if ($oldMoved -and -not (Test-Path -LiteralPath $finalPath) -and (Test-Path -LiteralPath $backupPath)) {
             [System.IO.File]::Move($backupPath, $finalPath)

install.sh

@@ -24,7 +24,7 @@ msg() {
       primary) printf '%s' '주요 명령:' ;;
       immutable) printf '%s' '동일 버전 재설치: CONTEXA_VERSION=' ;;
       rollback) printf '%s' '롤백: CONTEXA_INSTALL_ACTION=rollback' ;;
-      uninstall) printf '%s' '제거: CONTEXA_INSTALL_ACTION=uninstall (프로젝트 reset은 별도)' ;;
+      uninstall) printf '%s' '제거: curl -fsSL https://install.ctxa.ai/uninstall.sh | sh (프로젝트 reset은 별도)' ;;
       unsupported_action) printf '%s' '지원하지 않는 CONTEXA_INSTALL_ACTION' ;;
     esac
   else
@@ -38,7 +38,7 @@ msg() {
       primary) printf '%s' 'Primary commands:' ;;
       immutable) printf '%s' 'Immutable reinstall: CONTEXA_VERSION=' ;;
       rollback) printf '%s' 'Rollback: CONTEXA_INSTALL_ACTION=rollback' ;;
-      uninstall) printf '%s' 'Uninstall: CONTEXA_INSTALL_ACTION=uninstall (project reset is separate)' ;;
+      uninstall) printf '%s' 'Uninstall: curl -fsSL https://install.ctxa.ai/uninstall.sh | sh (project reset is separate)' ;;
       unsupported_action) printf '%s' 'Unsupported CONTEXA_INSTALL_ACTION' ;;
     esac
   fi

test/installers.test.js

@@ -8,6 +8,8 @@ const { spawnSync } = require('child_process');
 const root = path.join(__dirname, '..');
 const ps1Path = path.join(root, 'install.ps1');
 const shPath = path.join(root, 'install.sh');
+const uninstallPs1Path = path.join(root, 'uninstall.ps1');
+const uninstallShPath = path.join(root, 'uninstall.sh');
 const vercelPath = path.join(root, 'vercel.json');
 const packagePath = path.join(root, 'package.json');
 const api = require('../api/index');
@@ -117,6 +119,20 @@ test('installers use semantic product versions and never request administrator e
 test('installer files are written without UTF-8 BOM', () => {
   assert.notDeepEqual([...firstBytes(ps1Path, 3)], [0xef, 0xbb, 0xbf]);
   assert.notDeepEqual([...firstBytes(shPath, 3)], [0xef, 0xbb, 0xbf]);
+  assert.notDeepEqual([...firstBytes(uninstallPs1Path, 3)], [0xef, 0xbb, 0xbf]);
+  assert.notDeepEqual([...firstBytes(uninstallShPath, 3)], [0xef, 0xbb, 0xbf]);
+});
+
+test('public uninstall entrypoints reuse the installer without leaking control state', () => {
+  const ps = read(uninstallPs1Path);
+  const sh = read(uninstallShPath);
+  assert.ok(ps.startsWith('#Requires -Version 5.1'));
+  assert.match(ps, /CONTEXA_INSTALL_ACTION = 'uninstall'/);
+  assert.match(ps, /https:\/\/install\.ctxa\.ai\/install\.ps1/);
+  assert.match(ps, /Remove-Item Env:CONTEXA_INSTALL_ACTION/);
+  assert.ok(sh.startsWith('#!/bin/sh'));
+  assert.match(sh, /CONTEXA_INSTALL_ACTION=uninstall sh/);
+  assert.match(sh, /https:\/\/install\.ctxa\.ai\/install\.sh/);
 });
 
 test('Vercel routes explicit installer paths through the secured API contract', () => {
@@ -127,7 +143,7 @@ test('Vercel routes explicit installer paths through the secured API contract',
     'direct redirects bypass the API response security headers');
   assert.ok(config.rewrites.some(entry =>
     entry.source === '/(.*)' && entry.destination === '/api'));
-  for (const route of ['/install.ps1', '/install.sh']) {
+  for (const route of ['/install.ps1', '/install.sh', '/uninstall.ps1', '/uninstall.sh']) {
     const entry = config.headers.find(candidate => candidate.source === route);
     assert.ok(entry, `missing Vercel header contract for ${route}`);
     const headers = Object.fromEntries(
@@ -163,6 +179,14 @@ test('api prioritizes explicit paths and exposes immutable version URLs', () =>
   assert.ok(sh.body.startsWith('#!/bin/sh'));
   assert.equal(sh.headers['cache-control'], 'no-store');
 
+  const uninstallPs = invoke('/uninstall.ps1');
+  assert.ok(uninstallPs.body.startsWith('#Requires -Version 5.1'));
+  assert.match(uninstallPs.body, /CONTEXA_INSTALL_ACTION = 'uninstall'/);
+
+  const uninstallSh = invoke('/uninstall.sh', 'WindowsPowerShell/5.1');
+  assert.ok(uninstallSh.body.startsWith('#!/bin/sh'));
+  assert.match(uninstallSh.body, /CONTEXA_INSTALL_ACTION=uninstall sh/);
+
   const immutable = invoke('/v9.9.9-installer-test/install.ps1');
   assert.equal(immutable.statusCode, 302);
   assert.equal(immutable.headers.location, 'https://raw.githubusercontent.com/contexa-security/install-ctxa/v9.9.9-installer-test/install.ps1');
@@ -181,6 +205,9 @@ test('api prioritizes explicit paths and exposes immutable version URLs', () =>
     assert.equal(stable.headers['content-type'], 'text/plain; charset=utf-8');
     assert.equal(stable.headers['cache-control'], 'no-store');
     assert.equal(stable.headers['x-content-type-options'], 'nosniff');
+    const stableUninstall = invoke('/uninstall.ps1');
+    assert.equal(stableUninstall.statusCode, 200);
+    assert.match(stableUninstall.body, /CONTEXA_INSTALL_ACTION = 'uninstall'/);
   } finally {
     if (originalStableRef === undefined) delete process.env.CONTEXA_STABLE_INSTALLER_REF;
     else process.env.CONTEXA_STABLE_INSTALLER_REF = originalStableRef;

uninstall.ps1

@@ -0,0 +1,18 @@
+#Requires -Version 5.1
+
+& {
+    $hadInstallAction = Test-Path Env:CONTEXA_INSTALL_ACTION
+    $previousInstallAction = $env:CONTEXA_INSTALL_ACTION
+
+    try {
+        $env:CONTEXA_INSTALL_ACTION = 'uninstall'
+        $installer = Invoke-WebRequest 'https://install.ctxa.ai/install.ps1' -UseBasicParsing
+        & ([scriptblock]::Create($installer.Content))
+    } finally {
+        if ($hadInstallAction) {
+            $env:CONTEXA_INSTALL_ACTION = $previousInstallAction
+        } else {
+            Remove-Item Env:CONTEXA_INSTALL_ACTION -ErrorAction SilentlyContinue
+        }
+    }
+}

uninstall.sh

@@ -0,0 +1,12 @@
+#!/bin/sh
+set -u
+
+installer_file="$(mktemp)" || exit 1
+trap 'rm -f "$installer_file"' EXIT HUP INT TERM
+
+if ! curl -fsSL --connect-timeout 5 --max-time 30 \
+  https://install.ctxa.ai/install.sh -o "$installer_file"; then
+  exit 1
+fi
+
+CONTEXA_INSTALL_ACTION=uninstall sh "$installer_file"

vercel.json

@@ -21,6 +21,22 @@
         { "key": "Cache-Control", "value": "no-store" },
         { "key": "X-Content-Type-Options", "value": "nosniff" }
       ]
+    },
+    {
+      "source": "/uninstall.ps1",
+      "headers": [
+        { "key": "Content-Type", "value": "text/plain; charset=utf-8" },
+        { "key": "Cache-Control", "value": "no-store" },
+        { "key": "X-Content-Type-Options", "value": "nosniff" }
+      ]
+    },
+    {
+      "source": "/uninstall.sh",
+      "headers": [
+        { "key": "Content-Type", "value": "text/plain; charset=utf-8" },
+        { "key": "Cache-Control", "value": "no-store" },
+        { "key": "X-Content-Type-Options", "value": "nosniff" }
+      ]
     }
   ]
 }