@7ots/cli 0.1.8 → 0.1.9

package/cli/7ots.mjs

@@ -5,9 +5,9 @@
  */
 
 import { spawn, spawnSync } from 'node:child_process';
-import { existsSync, mkdirSync, openSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, openSync, statSync, writeFileSync } from 'node:fs';
 import { createRequire } from 'node:module';
-import { join } from 'node:path';
+import { dirname, join } from 'node:path';
 import { createIdentity, describe, identityPrompt, loadIdentity, cleanSeed } from './lib/identity.mjs';
 import { loadConfig } from './lib/config.mjs';
 import { t, cliLang } from './lib/i18n.mjs';
@@ -190,12 +190,24 @@ function menuLang() {
   return pick(process.env.SEVENOTS_LANG) || pick(lang) || pick(String(process.env.LC_ALL || process.env.LC_MESSAGES || process.env.LANG || '').slice(0, 2).toLowerCase()) || cliLang();
 }
 
+// Electron installed per user (~/.7ots/electron) has a chrome-sandbox that is not root:4755, and Ubuntu 24.04+
+// blocks unprivileged user namespaces (AppArmor), so Chromium aborts with SIGTRAP before showing a window.
+// Without a usable setuid helper, run unsandboxed: the window only loads the pet's own 127.0.0.1 page.
+function electronSandboxArgs(bin) {
+  if (process.platform !== 'linux') return [];
+  try {
+    const st = statSync(join(dirname(bin), 'chrome-sandbox'));
+    if (st.uid === 0 && st.mode & 0o4000) return [];
+  } catch {}
+  return ['--no-sandbox'];
+}
+
 function openDesktop({ opaque = false, view3d = false } = {}) {
   console.log(dim(t('pet.electron')));
   const { bin, error } = ensureElectron();
   if (!bin) return Promise.resolve({ ok: false, error });
   const log = openSync(homeFile('electron.log'), 'a');
-  const child = spawn(bin, [join(PKG_ROOT, 'cli', 'pet', 'electron', 'main.cjs')], {
+  const child = spawn(bin, [join(PKG_ROOT, 'cli', 'pet', 'electron', 'main.cjs'), ...electronSandboxArgs(bin)], {
     stdio: ['ignore', log, log],
     detached: true,
     env: { ...process.env, SEVENOTS_PET_URL: `http://127.0.0.1:${PET_PORT}`, SEVENOTS_PET_TOKEN: petToken(), SEVENOTS_PET_OPAQUE: opaque ? '1' : '', SEVENOTS_PET_3D: view3d ? '1' : '', SEVENOTS_PET_LANG: menuLang() },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@7ots/cli",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "7ots.com — your AI companion with a face of its own: a desktop pet that watches over your coding agent (Claude Code and shell hooks), a personal assistant (reminders, alerts, notes, opens sites, sees your screen if allowed) and a reproducible identity (face, personality, voice) for any agent — in apuchat meet calls, Orquesta projects or your own server.",
   "homepage": "https://7ots.com",
   "repository": {