@coworker-jp/aidr 0.0.1 → 0.0.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coworker-jp/aidr",
-  "version": "0.0.1",
+  "version": "0.0.3",
   "description": "AIDR setup CLI - installs ai-scanner hooks for 19+ AI coding agents",
   "type": "module",
   "bin": {

package/src/agents/claude.mjs

@@ -42,7 +42,7 @@ export async function install(installBase, accessKey, opts = {}) {
   ];
   const settingsPath = path.join(base, "settings.json");
   const [settingsRes, ...scriptResults] = await Promise.all([
-    writeJsonMerge(settingsPath, buildClaudeSettings(accessKey, scope), mergeClaudeSettings, { dryRun }),
+    writeJsonMerge(settingsPath, buildClaudeSettings(accessKey, scope), mergeClaudeSettings, { dryRun, backup: scope !== "project" }),
     ...scriptEntries.map(([p, c, mode]) => writeFileSafe(p, c, { dryRun, force: true, backup: false, mode })),
   ]);
   const scriptBackups = scriptResults.map((r) => r && r.backupPath).filter(Boolean);

package/src/agents/codex.mjs

@@ -59,7 +59,7 @@ export async function install(installBase, accessKey, opts = {}) {
     path.join(base, "hooks.json"),
     buildCodexHooksJson(scope, home),
     mergeCodexHooksJson,
-    { dryRun, mode: 0o644 },
+    { dryRun, mode: 0o644, backup: scope !== "project" },
   );
 
   // 2) Merge config.toml to enable the feature flag. Backs up pre-merge TOML

package/src/agents/cursor.mjs

@@ -47,7 +47,7 @@ export async function install(installBase, accessKey, opts = {}) {
     path.join(base, "hooks.json"),
     buildCursorHooksJson(scope, home),
     mergeCursorHooksJson,
-    { dryRun, mode: 0o644 },
+    { dryRun, mode: 0o644, backup: scope !== "project" },
   );
 
   const entries = [

package/src/agents/gemini.mjs

@@ -15,14 +15,14 @@ export const meta = {
 };
 
 export async function install(home, accessKey, opts = {}) {
-  const { dryRun = false } = opts;
+  const { dryRun = false, scope = "project" } = opts;
   const base = meta.configDir(home);
   const hooks = path.join(base, "hooks");
   const binary = path.join(home, meta.agentDir, "bin", "ai-scanner");
   const settingsPath = path.join(base, "settings.json");
   const preHookPath = path.join(hooks, "aidr-pre.sh");
   const [settingsRes, hookRes] = await Promise.all([
-    writeJsonMerge(settingsPath, buildGeminiSettings(accessKey, binary), mergeGeminiSettings, { dryRun }),
+    writeJsonMerge(settingsPath, buildGeminiSettings(accessKey, binary), mergeGeminiSettings, { dryRun, backup: scope !== "project" }),
     writeFileSafe(preHookPath, T.getGeminiPreHookSh(binary), { dryRun, force: true, mode: 0o755 }),
   ]);
   return {

package/src/agents/windsurf.mjs

@@ -44,7 +44,7 @@ export async function install(installBase, accessKey, opts = {}) {
     path.join(base, "hooks.json"),
     buildWindsurfHooksJson(scope, home),
     mergeWindsurfHooksJson,
-    { dryRun, mode: 0o644 },
+    { dryRun, mode: 0o644, backup: scope !== "project" },
   );
 
   const entries = [

package/src/cli.mjs

@@ -2,7 +2,7 @@ import path from "node:path";
 import os from "node:os";
 import fs from "node:fs/promises";
 import readline from "node:readline";
-import { execFile } from "node:child_process";
+import { execFile, spawnSync } from "node:child_process";
 import { promisify } from "node:util";
 import { fileURLToPath } from "node:url";
 import { Command } from "commander";
@@ -13,6 +13,7 @@ import { verifyKey, maskKey } from "./verify.mjs";
 import { fetchBinary, fetchOpengrep } from "./binary-fetcher.mjs";
 import { detectInstalled } from "./detect.mjs";
 import { installBrowserExtension } from "./browser-extension.mjs";
+import { resolveCallerHome, isRunningUnderSudo, chownToCaller } from "./sudo-user.mjs";
 
 // Package identity — read at module load from the bundled package.json.
 // The PROD publish workflow renames the package to `@coworker-jp/aidr`;
@@ -83,7 +84,7 @@ async function cmdInstall(opts) {
     });
   }
 
-  const home = process.env.HOME || os.homedir();
+  const home = resolveCallerHome();
   const scope = opts.scope || "user";
   const base = scope === "user" ? home : process.cwd();
   validateKey(opts.key);
@@ -127,11 +128,12 @@ async function cmdInstall(opts) {
     opts.scheduled = true;
   }
 
-  // --scheduled installs a cron / systemd / launchd entry that runs
-  // `ai-scanner scan endpoint-info` periodically against an agent-independent
-  // binary at ~/.aidr/bin/ai-scanner. Auto-add the standalone install so the
-  // binary fetch loop drops a copy there even when the user only listed AI
-  // agents (claude / cursor / ...) on the command line.
+  // --scheduled installs a system-wide cron / systemd / launchd entry that
+  // runs `ai-scanner scan endpoint-info` periodically as root, against an
+  // agent-independent binary at /opt/coworker/aidr/bin/ai-scanner. Auto-add
+  // the standalone install so the binary fetch loop drops a copy there
+  // even when the user only listed AI agents (claude / cursor / ...) on
+  // the command line.
   if (opts.scheduled && !agents.includes("standalone")) {
     agents.push("standalone");
   }
@@ -142,6 +144,29 @@ async function cmdInstall(opts) {
     process.exit(1);
   }
 
+  // --scheduled の system path 書き込みは root 必須。
+  // - TTY あり (対話 shell): `sudo -E` で自分自身を re-exec、password prompt が出る
+  // - TTY なし (CI / pipe): sudo は対話的に password を聞けないので fail-fast 案内
+  // smoke / unit test では `AI_SCANNER_FAKE_ROOT=1` を設定してこのチェックを skip 可能。
+  if (opts.scheduled && !opts.dryRun
+      && process.getuid && process.getuid() !== 0
+      && process.env.AI_SCANNER_FAKE_ROOT !== "1") {
+    const interactive = process.stdin.isTTY && process.stdout.isTTY && process.platform !== "win32";
+    if (interactive) {
+      console.error("--scheduled requires root. Re-running via sudo (you may be prompted for your password)...");
+      const result = spawnSync(
+        "sudo",
+        ["-E", process.execPath, ...process.argv.slice(1)],
+        { stdio: "inherit" }
+      );
+      process.exit(result.status ?? 1);
+    }
+    console.error("Error: --scheduled requires root privileges (writes /opt/coworker/aidr, /etc/systemd/system, /etc/aidr).");
+    console.error("Re-run with sudo (non-interactive shells cannot prompt for password):");
+    console.error(`  sudo -E npx @coworker-jp/aidr install --scheduled --key <ak_xxx>`);
+    process.exit(2);
+  }
+
   // Confirmation for existing shared settings.json (claude / gemini).
   // --yes bypasses; --dry-run doesn't write so skip; otherwise prompt on TTY,
   // error if non-interactive (safer than silently merging in CI).
@@ -171,9 +196,16 @@ async function cmdInstall(opts) {
   }
 
   if (!opts.skipBinary && !opts.dryRun) {
+    const { SYSTEM_BIN_DIR } = await import("./scheduled.mjs");
     const agentBinDirs = [];
     for (const name of agents) {
       const mod = await loadAgent(name);
+      // --scheduled 時の standalone は system path (/opt/coworker/aidr/bin)
+      // に置く。それ以外は従来通り per-user の ~/.<agent>/bin。
+      if (name === "standalone" && opts.scheduled) {
+        agentBinDirs.push(SYSTEM_BIN_DIR);
+        continue;
+      }
       const agentDir = mod.meta.agentDir;
       if (!agentDir) continue;
       agentBinDirs.push(path.join(home, agentDir, "bin"));
@@ -252,16 +284,11 @@ async function cmdInstall(opts) {
 
   if (opts.scheduled && !opts.dryRun) {
     const { installScheduled } = await import("./scheduled.mjs");
-    // Always point the cron / systemd / launchd entry at the standalone
-    // binary (~/.aidr/bin/ai-scanner). It is agent-independent, self-updates
-    // on every endpoint-info run, and survives an individual agent's removal.
-    const standalone = await loadAgent("standalone");
-    const binaryPath = path.join(home, standalone.meta.agentDir, "bin", "ai-scanner");
+    // Schedule entries always point at /opt/coworker/aidr/bin/ai-scanner
+    // (system-wide, root-owned). The path is hard-coded inside scheduled.mjs.
     try {
       await installScheduled({
-        home,
         accessKey: opts.key,
-        binaryPath,
         dryRun: opts.dryRun,
         interval: intervalHours,
       });
@@ -282,6 +309,19 @@ async function cmdInstall(opts) {
     }
   }
 
+  // Auto-sudo re-exec wrote per-agent files as root into the original user's
+  // home / cwd. Hand them back so the user can manage them without sudo on
+  // subsequent runs. System-wide writes under /opt + /etc are intentionally
+  // left root-owned by skipping anything outside `base`.
+  if (isRunningUnderSudo() && !opts.dryRun) {
+    for (const r of installResults) {
+      const mod = await loadAgent(r.name);
+      const agentDir = mod.meta.agentDir;
+      if (!agentDir) continue;
+      await chownToCaller(path.join(base, agentDir));
+    }
+  }
+
   if (restartAgents.length > 0 && !opts.dryRun) {
     const list = restartAgents.join(", ");
     console.log("");
@@ -294,7 +334,7 @@ async function cmdInstall(opts) {
 }
 
 async function cmdUninstall(opts) {
-  const home = process.env.HOME || os.homedir();
+  const home = resolveCallerHome();
   const scope = opts.scope || "user";
   const base = scope === "user" ? home : process.cwd();
 
@@ -409,16 +449,38 @@ async function cmdUninstall(opts) {
     }
   }));
 
+  // Schedule entries live in system paths (/etc, /opt, /Library/LaunchDaemons)
+  // and need root to remove. Mirror cmdInstall's auto-sudo: TTY なら sudo に
+  // re-exec、non-TTY は guidance を出して per-user 部分だけ撤去で完了。
   try {
-    const { uninstallScheduled } = await import("./scheduled.mjs");
-    await uninstallScheduled({ home, dryRun: opts.dryRun });
+    const { uninstallScheduled, isScheduledInstalled } = await import("./scheduled.mjs");
+    if (await isScheduledInstalled()) {
+      const isRoot = process.env.AI_SCANNER_FAKE_ROOT === "1"
+        || (process.getuid && process.getuid() === 0);
+      if (!isRoot) {
+        const interactive = process.stdin.isTTY && process.stdout.isTTY && process.platform !== "win32";
+        if (interactive) {
+          console.error("Scheduled entry detected. Re-running via sudo to remove (you may be prompted for your password)...");
+          const result = spawnSync(
+            "sudo",
+            ["-E", process.execPath, ...process.argv.slice(1)],
+            { stdio: "inherit" }
+          );
+          process.exit(result.status ?? 0);
+        }
+        console.error("Note: scheduled entry detected but uninstall needs root. Re-run:");
+        console.error(`  sudo -E npx @coworker-jp/aidr uninstall`);
+      } else {
+        await uninstallScheduled({ dryRun: opts.dryRun });
+      }
+    }
   } catch (e) {
     console.error(`scheduled uninstall warning: ${e.message}`);
   }
 }
 
 async function cmdDoctor() {
-  const home = process.env.HOME || os.homedir();
+  const home = resolveCallerHome();
   console.log(`home: ${home}`);
   console.log(`node: ${process.version}`);
   console.log(`platform: ${process.platform}/${process.arch}`);
@@ -455,7 +517,7 @@ export async function run(argv) {
   program
     .name("aidr")
     .description("AIDR setup CLI — installs ai-scanner hooks for AI coding agents")
-    .version("0.0.1");
+    .version("0.0.3");
 
   program
     .command("install")

package/src/fs-utils.mjs

@@ -127,6 +127,10 @@ export async function removeIfExists(p) {
 export async function writeJsonMerge(target, ourObject, mergeFn, {
   dryRun = false,
   mode = 0o644,
+  // `backup: false` で書き込み前バックアップを skip。リポジトリ git 配下に
+  // 入る project scope では、git 自体が history を持つので `<target>.backup-<ts>`
+  // が単に noise を増やす。user scope (~/.<agent>/...) では既定 true のまま残す。
+  backup = true,
   stdout = process.stdout,
   stderr = process.stderr,
 } = {}) {
@@ -160,16 +164,23 @@ export async function writeJsonMerge(target, ourObject, mergeFn, {
     return { written: false, path: target, backupPath: null, unchanged: true };
   }
 
-  if (stat && !dryRun) {
+  if (stat && backup && !dryRun) {
     backupPath = backupPathFor(target);
     await fsp.copyFile(target, backupPath);
   }
   if (stat) {
-    stderr.write(
-      `WARNING: ${target} already exists. ` +
-      `${dryRun ? "(dry-run: would back up)" : `Backed up to ${backupPath}.`}\n` +
-      `Merging ai-scanner env/hooks; your other settings are preserved.\n`
-    );
+    if (backup) {
+      stderr.write(
+        `WARNING: ${target} already exists. ` +
+        `${dryRun ? "(dry-run: would back up)" : `Backed up to ${backupPath}.`}\n` +
+        `Merging ai-scanner env/hooks; your other settings are preserved.\n`
+      );
+    } else {
+      stderr.write(
+        `Updating ${target} (no backup; project scope is git-tracked).\n` +
+        `Merging ai-scanner env/hooks; your other settings are preserved.\n`
+      );
+    }
   }
 
   if (dryRun) {

package/src/scheduled.mjs

@@ -1,62 +1,105 @@
 import fs from "fs/promises";
 import path from "path";
-import os from "os";
 import { execFile } from "child_process";
 import { promisify } from "util";
 
 const execFileP = promisify(execFile);
 
-function systemdDir(home) {
-  return path.join(home, ".config", "systemd", "user");
+// System-wide install paths (root-only). The schedule entry runs as root so
+// endpoint-info can collect host-wide inventory (process list, SUID, /etc/*).
+// All paths are owned by root:root; the access-key env file is mode 0600.
+//
+// `AIDR_SCHEDULED_ROOT` env (smoke / unit test only) prefixes every path so
+// they land under a tmpdir like `/tmp/test123/opt/coworker/aidr/bin/...`
+// without ever touching real /etc or /opt. Production should never set this.
+const ROOT_PREFIX = process.env.AIDR_SCHEDULED_ROOT || "";
+
+export const SYSTEM_BIN_DIR     = ROOT_PREFIX + "/opt/coworker/aidr/bin";
+export const SYSTEM_BIN         = path.join(SYSTEM_BIN_DIR, "ai-scanner");
+export const SYSTEM_OPENGREP    = path.join(SYSTEM_BIN_DIR, "opengrep");
+export const SYSTEM_USR_LOCAL_BIN = ROOT_PREFIX + "/usr/local/bin/ai-scanner";
+const SYSTEM_ENV_DIR            = ROOT_PREFIX + "/etc/aidr";
+export const SYSTEM_ENV_FILE    = path.join(SYSTEM_ENV_DIR, "aidr.env");
+
+// Linux systemd
+const SYSTEMD_DIR             = ROOT_PREFIX + "/etc/systemd/system";
+export const SYSTEMD_SERVICE  = path.join(SYSTEMD_DIR, "aidr-scheduled.service");
+export const SYSTEMD_TIMER    = path.join(SYSTEMD_DIR, "aidr-scheduled.timer");
+
+// macOS launchd (LaunchDaemons run as root, available pre-login)
+export const LAUNCHD_PLIST    = ROOT_PREFIX + "/Library/LaunchDaemons/jp.coworker.aidr.scheduled.plist";
+export const LAUNCHD_WRAPPER  = path.join(SYSTEM_BIN_DIR, "aidr-scheduled-wrapper.sh");
+
+// Linux cron fallback (system cron, runs as root)
+export const CRON_FILE        = ROOT_PREFIX + "/etc/cron.d/aidr-scheduled";
+
+function isRoot() {
+  if (process.env.AI_SCANNER_FAKE_ROOT === "1") return true;
+  return Boolean(process.getuid && process.getuid() === 0);
 }
-function systemdService(home) { return path.join(systemdDir(home), "aidr-scheduled.service"); }
-function systemdTimer(home)   { return path.join(systemdDir(home), "aidr-scheduled.timer"); }
-function systemdEnv(home)     { return path.join(systemdDir(home), "aidr-scheduled.env"); }
-function launchdPlist(home)   { return path.join(home, "Library", "LaunchAgents", "jp.coworker.aidr.scheduled.plist"); }
 
 async function exists(p) {
   try { await fs.access(p); return true; } catch { return false; }
 }
 
-export async function isScheduledInstalled(home) {
+export async function isScheduledInstalled() {
   return (
-    await exists(systemdTimer(home)) ||
-    await exists(launchdPlist(home))
+    await exists(SYSTEMD_TIMER) ||
+    await exists(LAUNCHD_PLIST) ||
+    await exists(CRON_FILE)
   );
 }
 
 export async function installScheduled(opts) {
-  const { home = os.homedir(), accessKey, binaryPath,
-          dryRun = false, interval = 4 } = opts;
+  const { accessKey, dryRun = false, interval = 4 } = opts;
   const noActivate = opts.noActivate || process.env.AI_SCANNER_NO_SCHEDULED_ACTIVATE === "1";
 
-  // Schedule entry is agent-independent (cron points at ~/.aidr/bin/ai-scanner
-  // and the binary self-updates on each run). If a previous schedule entry
-  // exists, replace it unconditionally — the only thing that could differ is
-  // the binary path or interval, both of which the new install owns.
-  if (await isScheduledInstalled(home)) {
-    await uninstallScheduled({ home, dryRun, noActivate });
+  if (!isRoot()) {
+    throw new Error("installScheduled requires root privileges (system paths under /etc and /opt)");
   }
 
+  // Always use the canonical system binary path; the binary is placed there by
+  // the standalone agent's binary fetch step before this function runs.
+  const binaryPath = SYSTEM_BIN;
+
+  // Replace any prior schedule entry. Avoids duplicate ExecStart / interval drift.
+  if (await isScheduledInstalled()) {
+    await uninstallScheduled({ dryRun, noActivate });
+  }
+
+  // Write the shared env file first; both Linux and macOS paths reference it.
+  await writeEnvFile(accessKey, dryRun);
+
   const platform = process.platform;
   if (platform === "linux") {
-    await installSystemd({ home, accessKey, binaryPath, dryRun, noActivate, interval });
+    await installSystemd({ dryRun, noActivate, interval, binaryPath });
   } else if (platform === "darwin") {
-    await installLaunchd({ home, accessKey, binaryPath, dryRun, noActivate, interval });
+    await installLaunchd({ dryRun, noActivate, interval, binaryPath });
   } else {
-    await installCrontab({ binaryPath, dryRun, interval });
+    await installCronDir({ binaryPath, dryRun, interval });
   }
 }
 
-async function installSystemd({ home, accessKey, binaryPath, dryRun, noActivate, interval = 4 }) {
-  const dir = systemdDir(home);
+async function writeEnvFile(accessKey, dryRun) {
+  const envContent = `AI_SCANNER_ACCESS_KEY=${accessKey}\n`;
+  if (dryRun) {
+    console.log("[dry-run] Would create:", SYSTEM_ENV_FILE, "(mode 0600)");
+    return;
+  }
+  await fs.mkdir(SYSTEM_ENV_DIR, { recursive: true, mode: 0o755 });
+  await fs.writeFile(SYSTEM_ENV_FILE, envContent, { mode: 0o600 });
+}
 
+async function installSystemd({ binaryPath, dryRun, noActivate, interval = 4 }) {
   const serviceContent = `[Unit]
 Description=AIDR scheduled endpoint-info scan
+After=network-online.target
+Wants=network-online.target
 
 [Service]
 Type=oneshot
-EnvironmentFile=${systemdEnv(home)}
+User=root
+EnvironmentFile=${SYSTEM_ENV_FILE}
 ExecStart=${binaryPath} scan endpoint-info
 `;
 
@@ -72,32 +115,40 @@ Persistent=true
 WantedBy=timers.target
 `;
 
-  const envContent = `AI_SCANNER_ACCESS_KEY=${accessKey}\n`;
-
   if (dryRun) {
-    console.log("[dry-run] Would create:", systemdService(home), systemdTimer(home), systemdEnv(home));
+    console.log("[dry-run] Would create:", SYSTEMD_SERVICE, SYSTEMD_TIMER);
     return;
   }
 
-  await fs.mkdir(dir, { recursive: true });
-  await fs.writeFile(systemdService(home), serviceContent, { mode: 0o644 });
-  await fs.writeFile(systemdTimer(home), timerContent, { mode: 0o644 });
-  await fs.writeFile(systemdEnv(home), envContent, { mode: 0o600 });
+  await fs.mkdir(path.dirname(SYSTEMD_SERVICE), { recursive: true });
+  await fs.writeFile(SYSTEMD_SERVICE, serviceContent, { mode: 0o644 });
+  await fs.writeFile(SYSTEMD_TIMER, timerContent, { mode: 0o644 });
 
   if (!noActivate) {
     try {
-      await execFileP("systemctl", ["--user", "daemon-reload"]);
-      await execFileP("systemctl", ["--user", "enable", "--now", "aidr-scheduled.timer"]);
-      console.log(`Scheduled scan enabled via systemd user timer (every ${interval}h)`);
+      await execFileP("systemctl", ["daemon-reload"]);
+      await execFileP("systemctl", ["enable", "--now", "aidr-scheduled.timer"]);
+      console.log(`Scheduled scan enabled via system systemd timer (every ${interval}h)`);
     } catch (e) {
-      console.warn("Warning: systemctl --user failed:", e.message);
-      console.warn("Timer files were written. Enable manually: systemctl --user enable --now aidr-scheduled.timer");
+      console.warn("Warning: systemctl failed:", e.message);
+      console.warn("Timer files were written. Enable manually: sudo systemctl enable --now aidr-scheduled.timer");
     }
   }
 }
 
-async function installLaunchd({ home, accessKey, binaryPath, dryRun, noActivate, interval = 4 }) {
-  const dir = path.join(home, "Library", "LaunchAgents");
+async function installLaunchd({ binaryPath, dryRun, noActivate, interval = 4 }) {
+  // launchd does not support EnvironmentFile, so we use a tiny wrapper that
+  // sources /etc/aidr/aidr.env and execs the binary. Plist itself stays 0644
+  // (launchctl bootstrap requires it readable); the secret lives in the env
+  // file at 0600.
+  const wrapperContent = `#!/bin/bash
+# Generated by aidr install --scheduled. Sources the system env file and
+# execs ai-scanner so the access key is not embedded in the LaunchDaemon plist.
+set -a
+. ${SYSTEM_ENV_FILE}
+set +a
+exec ${binaryPath} scan endpoint-info
+`;
 
   const plistContent = `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -105,17 +156,12 @@ async function installLaunchd({ home, accessKey, binaryPath, dryRun, noActivate,
 <dict>
   <key>Label</key>
   <string>jp.coworker.aidr.scheduled</string>
+  <key>UserName</key>
+  <string>root</string>
   <key>ProgramArguments</key>
   <array>
-    <string>${binaryPath}</string>
-    <string>scan</string>
-    <string>endpoint-info</string>
+    <string>${LAUNCHD_WRAPPER}</string>
   </array>
-  <key>EnvironmentVariables</key>
-  <dict>
-    <key>AI_SCANNER_ACCESS_KEY</key>
-    <string>${accessKey}</string>
-  </dict>
   <key>StartInterval</key>
   <integer>${interval * 3600}</integer>
   <key>RunAtLoad</key>
@@ -125,95 +171,78 @@ async function installLaunchd({ home, accessKey, binaryPath, dryRun, noActivate,
 `;
 
   if (dryRun) {
-    console.log("[dry-run] Would create:", launchdPlist(home));
+    console.log("[dry-run] Would create:", LAUNCHD_WRAPPER, LAUNCHD_PLIST);
     return;
   }
 
-  await fs.mkdir(dir, { recursive: true });
-  await fs.writeFile(launchdPlist(home), plistContent, { mode: 0o644 });
+  await fs.mkdir(path.dirname(LAUNCHD_WRAPPER), { recursive: true });
+  await fs.mkdir(path.dirname(LAUNCHD_PLIST), { recursive: true });
+  await fs.writeFile(LAUNCHD_WRAPPER, wrapperContent, { mode: 0o755 });
+  await fs.writeFile(LAUNCHD_PLIST, plistContent, { mode: 0o644 });
 
   if (!noActivate) {
     try {
-      const uid = process.getuid?.() ?? (await execFileP("id", ["-u"])).stdout.trim();
-      await execFileP("launchctl", ["bootstrap", `gui/${uid}`, launchdPlist(home)]);
-      console.log(`Scheduled scan enabled via launchd (every ${interval}h)`);
+      await execFileP("launchctl", ["bootstrap", "system", LAUNCHD_PLIST]);
+      console.log(`Scheduled scan enabled via system LaunchDaemon (every ${interval}h)`);
     } catch (e) {
       console.warn("Warning: launchctl bootstrap failed:", e.message);
-      console.warn("Plist written. Enable manually: launchctl load ~/Library/LaunchAgents/jp.coworker.aidr.scheduled.plist");
+      console.warn(`Plist written. Enable manually: sudo launchctl bootstrap system ${LAUNCHD_PLIST}`);
     }
   }
 }
 
-async function installCrontab({ binaryPath, dryRun, interval = 4 }) {
-  const entry = `0 */${interval} * * * ${binaryPath} scan endpoint-info 2>/dev/null # aidr-scheduled\n`;
-
+async function installCronDir({ binaryPath, dryRun, interval = 4 }) {
+  // /etc/cron.d entries run as the user named in the line. We embed the env
+  // file source via a small inline script.
+  const entry = `0 */${interval} * * * root . ${SYSTEM_ENV_FILE} && ${binaryPath} scan endpoint-info 2>/dev/null # aidr-scheduled
+`;
   if (dryRun) {
-    console.log("[dry-run] Would add crontab entry:", entry.trim());
+    console.log("[dry-run] Would create:", CRON_FILE);
     return;
   }
-
-  let existing = "";
-  try {
-    const { stdout } = await execFileP("crontab", ["-l"]);
-    existing = stdout;
-  } catch { /* no crontab yet */ }
-
-  if (existing.includes("aidr-scheduled")) return;
-
-  const newCrontab = existing.endsWith("\n") || existing === ""
-    ? existing + entry
-    : existing + "\n" + entry;
-
-  const child = execFile("crontab", ["-"]);
-  child.stdin.write(newCrontab);
-  child.stdin.end();
-  await new Promise((resolve, reject) => child.on("close", c => c === 0 ? resolve() : reject(new Error(`crontab exit ${c}`))));
-  console.log(`Scheduled scan added to user crontab (every ${interval}h)`);
+  await fs.mkdir(path.dirname(CRON_FILE), { recursive: true });
+  await fs.writeFile(CRON_FILE, entry, { mode: 0o644 });
+  console.log(`Scheduled scan added to ${CRON_FILE} (every ${interval}h)`);
 }
 
-export async function uninstallScheduled({ home = os.homedir(), dryRun = false, noActivate = false } = {}) {
+export async function uninstallScheduled({ dryRun = false, noActivate = false } = {}) {
   noActivate = noActivate || process.env.AI_SCANNER_NO_SCHEDULED_ACTIVATE === "1";
 
-  if (await exists(systemdTimer(home))) {
+  if (!isRoot()) {
+    throw new Error("uninstallScheduled requires root privileges");
+  }
+
+  if (await exists(SYSTEMD_TIMER)) {
     if (!dryRun && !noActivate) {
-      try { await execFileP("systemctl", ["--user", "disable", "--now", "aidr-scheduled.timer"]); } catch { /* ignore */ }
+      try { await execFileP("systemctl", ["disable", "--now", "aidr-scheduled.timer"]); } catch { /* ignore */ }
     }
-    for (const f of [systemdService(home), systemdTimer(home), systemdEnv(home)]) {
+    for (const f of [SYSTEMD_SERVICE, SYSTEMD_TIMER]) {
       if (!dryRun) { try { await fs.unlink(f); } catch { /* ignore */ } }
       else { console.log("[dry-run] Would remove:", f); }
     }
   }
 
-  if (await exists(launchdPlist(home))) {
+  if (await exists(LAUNCHD_PLIST)) {
     if (!dryRun && !noActivate) {
-      try {
-        const uid = process.getuid?.() ?? (await execFileP("id", ["-u"])).stdout.trim();
-        await execFileP("launchctl", ["bootout", `gui/${uid}`, launchdPlist(home)]);
-      } catch { /* ignore */ }
+      try { await execFileP("launchctl", ["bootout", "system", LAUNCHD_PLIST]); } catch { /* ignore */ }
+    }
+    if (!dryRun) {
+      try { await fs.unlink(LAUNCHD_PLIST); } catch { /* ignore */ }
+      try { await fs.unlink(LAUNCHD_WRAPPER); } catch { /* ignore */ }
+    } else {
+      console.log("[dry-run] Would remove:", LAUNCHD_PLIST, LAUNCHD_WRAPPER);
     }
-    if (!dryRun) { try { await fs.unlink(launchdPlist(home)); } catch { /* ignore */ } }
-    else { console.log("[dry-run] Would remove:", launchdPlist(home)); }
   }
 
-  try {
-    const { stdout } = await execFileP("crontab", ["-l"]);
-    const filtered = stdout.split("\n").filter(l => !l.includes("aidr-scheduled")).join("\n");
-    if (filtered !== stdout) {
-      if (!dryRun) {
-        const child = execFile("crontab", ["-"]);
-        child.stdin.write(filtered + (filtered.endsWith("\n") ? "" : "\n"));
-        child.stdin.end();
-        await new Promise(r => child.on("close", r));
-      } else {
-        console.log("[dry-run] Would remove aidr-scheduled from crontab");
-      }
-    }
-  } catch { /* no crontab */ }
-}
+  if (await exists(CRON_FILE)) {
+    if (!dryRun) { try { await fs.unlink(CRON_FILE); } catch { /* ignore */ } }
+    else { console.log("[dry-run] Would remove:", CRON_FILE); }
+  }
 
-function promptUser(question) {
-  return new Promise(resolve => {
-    process.stdout.write(question);
-    process.stdin.once("data", d => resolve(d.toString().trim()));
-  });
+  // Remove the env file last so an aborted uninstall (mid-systemctl) doesn't
+  // strand a service file that still references a missing env file.
+  if (await exists(SYSTEM_ENV_FILE)) {
+    if (!dryRun) { try { await fs.unlink(SYSTEM_ENV_FILE); } catch { /* ignore */ } }
+    else { console.log("[dry-run] Would remove:", SYSTEM_ENV_FILE); }
+  }
 }

package/src/sudo-user.mjs

@@ -0,0 +1,111 @@
+// SUDO_USER-aware HOME resolution and ownership helpers.
+//
+// `aidr install --scheduled` auto-escalates via `sudo -E` (cli.mjs).
+// After sudo, the new node process runs as root with HOME reset to /root by
+// the default `set_home` policy. Without correction, every path derived from
+// HOME (e.g. ~/.claude/settings.json under `--scope user`) would land in
+// /root instead of the original user's home, AND every file we write would
+// be root-owned even though the user expects to manage them.
+//
+// We restore the caller's identity via the SUDO_USER / SUDO_UID / SUDO_GID
+// vars sudo always sets, and chown the user-scope writes back to that user
+// when the install completes.
+
+import fs from "node:fs";
+import fsp from "node:fs/promises";
+import path from "node:path";
+import os from "node:os";
+import { execFileSync } from "node:child_process";
+
+/**
+ * Look up `username`'s home directory.
+ * 1. /etc/passwd  (Linux always; macOS for system users only)
+ * 2. macOS dscl   (regular macOS users live in Open Directory)
+ * Returns null if not found.
+ *
+ * Test override: AIDR_PASSWD_FILE points at an alternate passwd-format file.
+ */
+export function lookupUserHome(username) {
+  if (!username) return null;
+  const passwdPath = process.env.AIDR_PASSWD_FILE || "/etc/passwd";
+  try {
+    const passwd = fs.readFileSync(passwdPath, "utf8");
+    for (const line of passwd.split("\n")) {
+      const f = line.split(":");
+      if (f[0] === username && f[5]) return f[5];
+    }
+  } catch { /* fall through */ }
+
+  if (process.platform === "darwin" && !process.env.AIDR_PASSWD_FILE) {
+    try {
+      const out = execFileSync(
+        "dscl", [".", "-read", `/Users/${username}`, "NFSHomeDirectory"],
+        { encoding: "utf8", timeout: 2000 }
+      );
+      const m = out.match(/NFSHomeDirectory:\s*(.+)/);
+      if (m) return m[1].trim();
+    } catch { /* fall through */ }
+  }
+  return null;
+}
+
+/**
+ * Resolve the calling user's home.
+ * - If running as root with SUDO_USER set, use SUDO_USER's home (auto-sudo case).
+ * - Otherwise fall back to $HOME / os.homedir().
+ *
+ * Test override: AIDR_FORCE_HOME bypasses everything.
+ */
+export function resolveCallerHome() {
+  if (process.env.AIDR_FORCE_HOME) return process.env.AIDR_FORCE_HOME;
+  if (isRunningUnderSudo()) {
+    const sudoHome = lookupUserHome(process.env.SUDO_USER);
+    if (sudoHome) return sudoHome;
+  }
+  return process.env.HOME || os.homedir();
+}
+
+/**
+ * True when we're running as root *and* SUDO_USER is set — i.e. the auto-sudo
+ * re-exec path. Plain `su` or login-as-root sets neither, and is treated as
+ * intentional root usage (no chown back).
+ */
+export function isRunningUnderSudo() {
+  if (process.platform === "win32") return false;
+  if (!process.getuid || process.getuid() !== 0) return false;
+  return Boolean(process.env.SUDO_USER);
+}
+
+/**
+ * SUDO_UID / SUDO_GID parsed as integers, or null when not under sudo.
+ */
+export function callerIds() {
+  if (!isRunningUnderSudo()) return null;
+  const uid = parseInt(process.env.SUDO_UID || "", 10);
+  const gid = parseInt(process.env.SUDO_GID || "", 10);
+  if (Number.isInteger(uid) && Number.isInteger(gid)) return { uid, gid };
+  return null;
+}
+
+/**
+ * Recursively chown a path tree to the caller (SUDO_USER) when running under
+ * auto-sudo. No-op when not under sudo or on Windows. Errors per-entry are
+ * swallowed — worst case the user fixes ownership manually with a single
+ * `chown -R`. Symlinks are chowned via lchown (don't follow).
+ */
+export async function chownToCaller(targetPath) {
+  const ids = callerIds();
+  if (!ids) return;
+  await chownTree(targetPath, ids.uid, ids.gid);
+}
+
+async function chownTree(p, uid, gid) {
+  let st;
+  try { st = await fsp.lstat(p); } catch { return; }
+  try { await fsp.lchown(p, uid, gid); } catch { /* ignore */ }
+  if (st.isDirectory()) {
+    let entries;
+    try { entries = await fsp.readdir(p); } catch { return; }
+    await Promise.all(entries.map((e) => chownTree(path.join(p, e), uid, gid)));
+  }
+}

package/src/templates.mjs

@@ -300,7 +300,8 @@ export AI_SCANNER_DETECTION_LOG="\${CLAUDE_PROJECT_DIR:-.}/.claude/logs/detectio
 
 ${SCAN_HELPERS}
 
-jq -r '.tool_response // ""' | run_scanner scan websearch`;
+jq -r '.tool_response // ""' | run_scanner scan websearch
+`;
 
 export const LOG_WEB_URLS_SH = `#!/bin/bash
 # Log URLs from WebSearch and WebFetch tool calls