@coworker-jp/aidr 0.0.8 → 0.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coworker-jp/aidr",
-  "version": "0.0.8",
+  "version": "0.1.0",
   "description": "AIDR setup CLI - installs ai-scanner hooks for 19+ AI coding agents",
   "type": "module",
   "bin": {

package/src/cli.mjs

@@ -589,7 +589,7 @@ export async function run(argv) {
   program
     .name("aidr")
     .description("AIDR setup CLI — installs ai-scanner hooks for AI coding agents")
-    .version("0.0.6");
+    .version("0.1.0");
 
   program
     .command("install")

package/src/scheduled.mjs

@@ -1,6 +1,6 @@
 import fs from "fs/promises";
 import path from "path";
-import { execFile } from "child_process";
+import { execFile, spawnSync } from "child_process";
 import { promisify } from "util";
 
 const execFileP = promisify(execFile);
@@ -177,15 +177,82 @@ export async function installScheduled(opts) {
 }
 
 async function writeEnvFile(accessKey, dryRun) {
-  const envContent = `AI_SCANNER_ACCESS_KEY=${accessKey}\n`;
+  // Capture the install-time actor identity here (NOT at scheduled
+  // run-time) because the scheduler runs as root with no Apple ID, no
+  // git config, and $USER="root". Without this, the Rust scanner would
+  // emit snapshots labelled "unknown" (or worse, fall through to
+  // customer_email — the bug this whole helper exists to fix).
+  const actorId = resolveInstallerActorId();
+  let envContent = `AI_SCANNER_ACCESS_KEY=${accessKey}\n`;
+  if (actorId) envContent += `AI_SCANNER_ACTOR_ID=${actorId}\n`;
   if (dryRun) {
     console.log("[dry-run] Would create:", SYSTEM_ENV_FILE, "(mode 0600)");
+    if (actorId) console.log("[dry-run]   actor_id captured:", actorId);
     return;
   }
   await fs.mkdir(SYSTEM_ENV_DIR, { recursive: true, mode: 0o755 });
   await fs.writeFile(SYSTEM_ENV_FILE, envContent, { mode: 0o600 });
 }
 
+/**
+ * Resolve the **pre-sudo user's** identity for embedding in
+ * AI_SCANNER_ACTOR_ID at install time. Order, per user spec:
+ *   1. SUDO_USER's git config user.email (run as that user — root has
+ *      its own (usually empty) git config that we must not return)
+ *   2. macOS: SUDO_USER's Apple ID (`defaults read MobileMeAccounts`)
+ *   3. SUDO_USER itself (the Unix username)
+ *
+ * Returns `null` when none of the above succeed (e.g. install was run
+ * as bare root with no SUDO_USER). The caller writes nothing in that
+ * case; the Rust scanner then surfaces "unknown" instead of mislabeling
+ * the snapshot with the user-portal login email.
+ *
+ * Test override: AIDR_INSTALLER_ACTOR_ID env bypasses every detection
+ * step (used by Node unit tests so they don't have to mock spawnSync).
+ */
+export function resolveInstallerActorId() {
+  if (process.env.AIDR_INSTALLER_ACTOR_ID) {
+    return process.env.AIDR_INSTALLER_ACTOR_ID || null;
+  }
+  const sudoUser = process.env.SUDO_USER;
+  if (!sudoUser) return null;
+
+  // 1. git config user.email — run AS the SUDO_USER so we read their
+  //    ~/.gitconfig, not /root/.gitconfig (which is normally empty).
+  //    --global is intentional: per-repo configs aren't relevant for
+  //    a host-level identity. timeout caps a hung git invocation.
+  const gitRes = spawnSync(
+    "sudo",
+    ["-u", sudoUser, "git", "config", "--global", "--get", "user.email"],
+    { encoding: "utf8", timeout: 5000 },
+  );
+  if (gitRes.status === 0) {
+    const email = (gitRes.stdout || "").trim();
+    if (email) return email;
+  }
+
+  // 2. macOS Apple ID. Mirrors the Rust binary's parse_apple_id: read
+  //    the first AccountID line from MobileMeAccounts. Must run as the
+  //    SUDO_USER — root has no MobileMeAccounts plist of its own.
+  if (process.platform === "darwin") {
+    const dRes = spawnSync(
+      "sudo",
+      ["-u", sudoUser, "defaults", "read", "MobileMeAccounts"],
+      { encoding: "utf8", timeout: 5000 },
+    );
+    if (dRes.status === 0) {
+      const m = (dRes.stdout || "").match(/AccountID\s*=\s*"([^"]+)"/);
+      const id = m && m[1] ? m[1].trim() : "";
+      if (id) return id;
+    }
+  }
+
+  // 3. Username fallback. Better than "unknown" because at least it
+  //    ties the snapshot to a Unix account on the host, but it loses
+  //    the cross-host identity that an email gives us.
+  return sudoUser;
+}
+
 async function installSystemd({ binaryPath, dryRun, noActivate, interval = 4 }) {
   // StandardOutput=append: requires systemd 240+ (released 2018). Modern
   // distros (RHEL 9 / Ubuntu 20.04+ / Debian 11+) all support it. Older
@@ -237,7 +304,7 @@ WantedBy=timers.target
   }
 }
 
-async function installLaunchd({ binaryPath, dryRun, noActivate, interval = 4 }) {
+export async function installLaunchd({ binaryPath, dryRun, noActivate, interval = 4 }) {
   // launchd does not support EnvironmentFile, so we use a tiny wrapper that
   // sources /etc/aidr/aidr.env and execs the binary. Plist itself stays 0644
   // (launchctl bootstrap requires it readable); the secret lives in the env
@@ -248,6 +315,13 @@ async function installLaunchd({ binaryPath, dryRun, noActivate, interval = 4 })
 set -a
 . ${SYSTEM_ENV_FILE}
 set +a
+# launchd starts daemons with a narrow default PATH (/usr/bin:/bin:/usr/sbin:/sbin)
+# that omits Homebrew. Without this, scan endpoint-info silently misses brew
+# packages because Command::new("brew") spawn fails — gem still works because
+# /usr/bin/gem is on the default PATH. Both Apple Silicon (/opt/homebrew/bin)
+# and Intel (/usr/local/bin) prefixes are safe to prepend on either arch since
+# missing dirs in PATH are simply ignored at lookup time.
+export PATH="/opt/homebrew/bin:/usr/local/bin:/opt/homebrew/sbin:/usr/local/sbin:\${PATH:-/usr/bin:/bin:/usr/sbin:/sbin}"
 exec ${binaryPath} scan endpoint-info
 `;
 

package/src/sentinel.mjs

@@ -22,6 +22,7 @@ import {
   ensureSystemLogDir,
   writeLogrotateConfig,
   removeSystemLog,
+  resolveInstallerActorId,
 } from "./scheduled.mjs";
 
 const execFileP = promisify(execFile);
@@ -138,13 +139,30 @@ export async function installSentinel(opts = {}) {
   await ensureSystemLogDir(SENTINEL_LOG_FILE, { dryRun });
   await writeLogrotateConfig({ dryRun });
 
-  // 3. Write env file (append AI_SCANNER_ACCESS_KEY if missing)
+  // 3. Write env file (append AI_SCANNER_ACCESS_KEY + AI_SCANNER_ACTOR_ID
+  //    if missing). When --with-sentinel runs alongside --scheduled,
+  //    scheduled.mjs's writeEnvFile has already written both lines and
+  //    we no-op. When --with-sentinel runs standalone (no --scheduled),
+  //    we are the only writer of aidr.env and must capture the
+  //    pre-sudo SUDO_USER identity ourselves; otherwise the daemon
+  //    would report `unknown` actor (or worse, the customer_email
+  //    fallback before that branch was removed).
   if (accessKey && !dryRun) {
     let content = "";
     try { content = await fs.readFile(SYSTEM_ENV_FILE, "utf8"); } catch { /* first run */ }
+    let appended = "";
     if (!content.includes("AI_SCANNER_ACCESS_KEY")) {
+      appended += `\nAI_SCANNER_ACCESS_KEY=${accessKey}\n`;
+    }
+    if (!content.includes("AI_SCANNER_ACTOR_ID")) {
+      const actorId = resolveInstallerActorId();
+      if (actorId) {
+        appended += `AI_SCANNER_ACTOR_ID=${actorId}\n`;
+      }
+    }
+    if (appended) {
       await fs.mkdir(path.dirname(SYSTEM_ENV_FILE), { recursive: true });
-      await fs.appendFile(SYSTEM_ENV_FILE, `\nAI_SCANNER_ACCESS_KEY=${accessKey}\n`);
+      await fs.appendFile(SYSTEM_ENV_FILE, appended);
       await fs.chmod(SYSTEM_ENV_FILE, 0o600);
     }
   }