@coworker-jp/aidr 0.0.2 → 0.0.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coworker-jp/aidr",
-  "version": "0.0.2",
+  "version": "0.0.3",
   "description": "AIDR setup CLI - installs ai-scanner hooks for 19+ AI coding agents",
   "type": "module",
   "bin": {

package/src/cli.mjs

@@ -13,6 +13,7 @@ import { verifyKey, maskKey } from "./verify.mjs";
 import { fetchBinary, fetchOpengrep } from "./binary-fetcher.mjs";
 import { detectInstalled } from "./detect.mjs";
 import { installBrowserExtension } from "./browser-extension.mjs";
+import { resolveCallerHome, isRunningUnderSudo, chownToCaller } from "./sudo-user.mjs";
 
 // Package identity — read at module load from the bundled package.json.
 // The PROD publish workflow renames the package to `@coworker-jp/aidr`;
@@ -83,7 +84,7 @@ async function cmdInstall(opts) {
     });
   }
 
-  const home = process.env.HOME || os.homedir();
+  const home = resolveCallerHome();
   const scope = opts.scope || "user";
   const base = scope === "user" ? home : process.cwd();
   validateKey(opts.key);
@@ -308,6 +309,19 @@ async function cmdInstall(opts) {
     }
   }
 
+  // Auto-sudo re-exec wrote per-agent files as root into the original user's
+  // home / cwd. Hand them back so the user can manage them without sudo on
+  // subsequent runs. System-wide writes under /opt + /etc are intentionally
+  // left root-owned by skipping anything outside `base`.
+  if (isRunningUnderSudo() && !opts.dryRun) {
+    for (const r of installResults) {
+      const mod = await loadAgent(r.name);
+      const agentDir = mod.meta.agentDir;
+      if (!agentDir) continue;
+      await chownToCaller(path.join(base, agentDir));
+    }
+  }
+
   if (restartAgents.length > 0 && !opts.dryRun) {
     const list = restartAgents.join(", ");
     console.log("");
@@ -320,7 +334,7 @@ async function cmdInstall(opts) {
 }
 
 async function cmdUninstall(opts) {
-  const home = process.env.HOME || os.homedir();
+  const home = resolveCallerHome();
   const scope = opts.scope || "user";
   const base = scope === "user" ? home : process.cwd();
 
@@ -466,7 +480,7 @@ async function cmdUninstall(opts) {
 }
 
 async function cmdDoctor() {
-  const home = process.env.HOME || os.homedir();
+  const home = resolveCallerHome();
   console.log(`home: ${home}`);
   console.log(`node: ${process.version}`);
   console.log(`platform: ${process.platform}/${process.arch}`);
@@ -503,7 +517,7 @@ export async function run(argv) {
   program
     .name("aidr")
     .description("AIDR setup CLI — installs ai-scanner hooks for AI coding agents")
-    .version("0.0.2");
+    .version("0.0.3");
 
   program
     .command("install")

package/src/sudo-user.mjs

@@ -0,0 +1,111 @@
+// SUDO_USER-aware HOME resolution and ownership helpers.
+//
+// `aidr install --scheduled` auto-escalates via `sudo -E` (cli.mjs).
+// After sudo, the new node process runs as root with HOME reset to /root by
+// the default `set_home` policy. Without correction, every path derived from
+// HOME (e.g. ~/.claude/settings.json under `--scope user`) would land in
+// /root instead of the original user's home, AND every file we write would
+// be root-owned even though the user expects to manage them.
+//
+// We restore the caller's identity via the SUDO_USER / SUDO_UID / SUDO_GID
+// vars sudo always sets, and chown the user-scope writes back to that user
+// when the install completes.
+
+import fs from "node:fs";
+import fsp from "node:fs/promises";
+import path from "node:path";
+import os from "node:os";
+import { execFileSync } from "node:child_process";
+
+/**
+ * Look up `username`'s home directory.
+ * 1. /etc/passwd  (Linux always; macOS for system users only)
+ * 2. macOS dscl   (regular macOS users live in Open Directory)
+ * Returns null if not found.
+ *
+ * Test override: AIDR_PASSWD_FILE points at an alternate passwd-format file.
+ */
+export function lookupUserHome(username) {
+  if (!username) return null;
+  const passwdPath = process.env.AIDR_PASSWD_FILE || "/etc/passwd";
+  try {
+    const passwd = fs.readFileSync(passwdPath, "utf8");
+    for (const line of passwd.split("\n")) {
+      const f = line.split(":");
+      if (f[0] === username && f[5]) return f[5];
+    }
+  } catch { /* fall through */ }
+
+  if (process.platform === "darwin" && !process.env.AIDR_PASSWD_FILE) {
+    try {
+      const out = execFileSync(
+        "dscl", [".", "-read", `/Users/${username}`, "NFSHomeDirectory"],
+        { encoding: "utf8", timeout: 2000 }
+      );
+      const m = out.match(/NFSHomeDirectory:\s*(.+)/);
+      if (m) return m[1].trim();
+    } catch { /* fall through */ }
+  }
+  return null;
+}
+
+/**
+ * Resolve the calling user's home.
+ * - If running as root with SUDO_USER set, use SUDO_USER's home (auto-sudo case).
+ * - Otherwise fall back to $HOME / os.homedir().
+ *
+ * Test override: AIDR_FORCE_HOME bypasses everything.
+ */
+export function resolveCallerHome() {
+  if (process.env.AIDR_FORCE_HOME) return process.env.AIDR_FORCE_HOME;
+  if (isRunningUnderSudo()) {
+    const sudoHome = lookupUserHome(process.env.SUDO_USER);
+    if (sudoHome) return sudoHome;
+  }
+  return process.env.HOME || os.homedir();
+}
+
+/**
+ * True when we're running as root *and* SUDO_USER is set — i.e. the auto-sudo
+ * re-exec path. Plain `su` or login-as-root sets neither, and is treated as
+ * intentional root usage (no chown back).
+ */
+export function isRunningUnderSudo() {
+  if (process.platform === "win32") return false;
+  if (!process.getuid || process.getuid() !== 0) return false;
+  return Boolean(process.env.SUDO_USER);
+}
+
+/**
+ * SUDO_UID / SUDO_GID parsed as integers, or null when not under sudo.
+ */
+export function callerIds() {
+  if (!isRunningUnderSudo()) return null;
+  const uid = parseInt(process.env.SUDO_UID || "", 10);
+  const gid = parseInt(process.env.SUDO_GID || "", 10);
+  if (Number.isInteger(uid) && Number.isInteger(gid)) return { uid, gid };
+  return null;
+}
+
+/**
+ * Recursively chown a path tree to the caller (SUDO_USER) when running under
+ * auto-sudo. No-op when not under sudo or on Windows. Errors per-entry are
+ * swallowed — worst case the user fixes ownership manually with a single
+ * `chown -R`. Symlinks are chowned via lchown (don't follow).
+ */
+export async function chownToCaller(targetPath) {
+  const ids = callerIds();
+  if (!ids) return;
+  await chownTree(targetPath, ids.uid, ids.gid);
+}
+
+async function chownTree(p, uid, gid) {
+  let st;
+  try { st = await fsp.lstat(p); } catch { return; }
+  try { await fsp.lchown(p, uid, gid); } catch { /* ignore */ }
+  if (st.isDirectory()) {
+    let entries;
+    try { entries = await fsp.readdir(p); } catch { return; }
+    await Promise.all(entries.map((e) => chownTree(path.join(p, e), uid, gid)));
+  }
+}