@co0ontty/wand 1.72.0 → 1.74.1

package/dist/tui/commands.js

@@ -5,7 +5,7 @@
  * 命令本身不直接写 stdout / stderr —— TUI 模式下 stderr 已经被 log-bus 劫持。
  */
 import { spawn, spawnSync } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync, unlinkSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import process from "node:process";
@@ -513,12 +513,59 @@ function currentUserName() {
         return process.env.USER || process.env.LOGNAME || "root";
     }
 }
+function ownerUserNameForPath(targetPath) {
+    const candidates = [targetPath, path.dirname(targetPath)];
+    for (const candidate of candidates) {
+        try {
+            const uid = statUid(candidate);
+            if (process.env.SUDO_UID === String(uid) && process.env.SUDO_USER) {
+                return process.env.SUDO_USER;
+            }
+            const resolved = spawnSync("id", ["-un", String(uid)], { encoding: "utf8", timeout: 3000 });
+            const name = (resolved.stdout || "").trim();
+            if (resolved.status === 0 && name)
+                return name;
+        }
+        catch {
+            /* try next candidate */
+        }
+    }
+    return process.env.SUDO_USER || currentUserName();
+}
+function homeForUser(userName, fallback) {
+    if (!userName || userName === "root")
+        return fallback;
+    if (process.platform === "darwin") {
+        const resolved = spawnSync("dscl", [".", "-read", `/Users/${userName}`, "NFSHomeDirectory"], {
+            encoding: "utf8",
+            timeout: 3000,
+        });
+        const match = (resolved.stdout || "").match(/NFSHomeDirectory:\s*(.+)/);
+        if (resolved.status === 0 && match?.[1])
+            return match[1].trim();
+    }
+    if (process.platform === "linux") {
+        const resolved = spawnSync("getent", ["passwd", userName], { encoding: "utf8", timeout: 3000 });
+        const home = (resolved.stdout || "").split(":")[5];
+        if (resolved.status === 0 && home)
+            return home.trim();
+    }
+    return fallback;
+}
+function statUid(targetPath) {
+    return readFileStat(targetPath).uid;
+}
+function readFileStat(targetPath) {
+    return statSync(targetPath);
+}
 function installSystemdService(ctx, scope) {
     const unitPath = servicePathFor(scope);
     const wandBin = resolveWandBin(ctx);
     const nodeBin = process.execPath;
     const nodeBinDir = path.dirname(nodeBin);
-    const runHome = process.env.HOME || os.homedir();
+    const runUser = scope === "system" ? ownerUserNameForPath(ctx.configPath) : currentUserName();
+    const fallbackHome = process.env.HOME || os.homedir();
+    const runHome = scope === "system" ? homeForUser(runUser, fallbackHome) : fallbackHome;
     // 关键：把调用 `wand service:install` 时的真实 PATH 写进 unit。
     // 否则 systemd 默认 PATH 极简（system scope 之前写死 `nodeBin:/usr/local/...`，
     // user scope 干脆没写），spawn 出的 claude/codex 子进程会撞 "command not found"
@@ -544,7 +591,6 @@ function installSystemdService(ctx, scope) {
     ];
     let unitLines;
     if (scope === "system") {
-        const runUser = currentUserName();
         unitLines = [
             ...commonExec,
             `User=${runUser}`,
@@ -628,16 +674,20 @@ function installLaunchdService(ctx, scope) {
     const wandBin = resolveWandBin(ctx);
     const nodeBin = process.execPath;
     const nodeBinDir = path.dirname(nodeBin);
-    const runHome = process.env.HOME || os.homedir();
+    const runUser = scope === "system" ? ownerUserNameForPath(ctx.configPath) : currentUserName();
+    const fallbackHome = process.env.HOME || os.homedir();
+    const runHome = scope === "system" ? homeForUser(runUser, fallbackHome) : fallbackHome;
     // 与 systemd 同理：launchd 默认 PATH 极简，spawn 出的 claude 会找不到。
     const servicePath = buildServicePath(nodeBinDir, runHome);
-    // LaunchDaemon (system) 跑在 root，但 wand 数据应该归 ctx.configPath 的 owner；
-    // 简化处理：system 模式下不强制改 owner，让用户自己提前 chown。
+    const userNameField = scope === "system"
+        ? `  <key>UserName</key><string>${runUser}</string>\n`
+        : "";
     const plist = `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
   <key>Label</key><string>com.wand.web</string>
+${userNameField}  <key>WorkingDirectory</key><string>${runHome}</string>
   <key>ProgramArguments</key>
   <array>
     <string>${nodeBin}</string>

package/dist/tui/index.js

@@ -218,9 +218,9 @@ export function startTui(deps) {
         // 默认装 system-wide。非 root 时 installService 会返回明确错误,toast 自然展示。
         const isRoot = typeof process.getuid === "function" ? process.getuid() === 0 : false;
         const body = process.platform === "linux"
-            ? `将写入 /etc/systemd/system/wand.service，systemctl enable --now，开机自启。\n${isRoot ? "当前是 root，可以直接装。" : "⚠ 需要 root,建议先 Ctrl+C 退出 TUI 再 sudo wand web 重新进。"}\n不想要 root？退出 TUI 跑 wand service:install --user (登出会被回收)。`
+            ? `将写入 /etc/systemd/system/wand.service，systemctl enable --now，开机自启。\n${isRoot ? "当前是 root，可以直接装。" : "⚠ 需要 root,请退出 TUI 后直接跑 sudo wand service:install。"}\n不想要 root？退出 TUI 跑 wand service:install --user (登出会被回收)。`
             : process.platform === "darwin"
-                ? `将写入 /Library/LaunchDaemons/com.wand.web.plist，launchctl load，开机自启。\n${isRoot ? "当前是 root,可以直接装。" : "⚠ 需要 root,建议先 Ctrl+C 退出 TUI 再 sudo wand web 重新进。"}`
+                ? `将写入 /Library/LaunchDaemons/com.wand.web.plist，launchctl load，开机自启。\n${isRoot ? "当前是 root,可以直接装。" : "⚠ 需要 root,请退出 TUI 后直接跑 sudo wand service:install。"}`
                 : "当前平台暂不支持。";
         const ok = await layout.confirm({ title: "注册为系统服务", body });
         if (!ok)

package/dist/tui/ipc-server.js

@@ -4,7 +4,8 @@
  * Windows 不支持（socketPath 返回空字符串），调用方应跳过 startIpcServer。
  */
 import net from "node:net";
-import { existsSync, unlinkSync } from "node:fs";
+import { chmodSync, chownSync, existsSync, statSync, unlinkSync } from "node:fs";
+import path from "node:path";
 import { getErrorMessage } from "../error-utils.js";
 export function startIpcServer(deps) {
     if (!deps.socketPath)
@@ -83,7 +84,9 @@ export function startIpcServer(deps) {
         // 不要崩进程；attach 模式不可用也不影响主功能。
         process.stderr.write(`[wand] IPC server error: ${err.message}\n`);
     });
-    server.listen(deps.socketPath);
+    server.listen(deps.socketPath, () => {
+        applySocketOwnership(deps.socketPath);
+    });
     return {
         close: async () => {
             await new Promise((resolve) => {
@@ -99,3 +102,18 @@ export function startIpcServer(deps) {
         },
     };
 }
+function applySocketOwnership(socketPath) {
+    try {
+        const owner = statSync(path.dirname(socketPath));
+        chownSync(socketPath, owner.uid, owner.gid);
+    }
+    catch {
+        /* best effort: non-root processes cannot chown, and usually already own the socket */
+    }
+    try {
+        chmodSync(socketPath, 0o600);
+    }
+    catch {
+        /* noop */
+    }
+}