@coworker-jp/aidr 0.1.0 → 0.1.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coworker-jp/aidr",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "AIDR setup CLI - installs ai-scanner hooks for 19+ AI coding agents",
   "type": "module",
   "bin": {

package/src/cli.mjs

@@ -589,7 +589,7 @@ export async function run(argv) {
   program
     .name("aidr")
     .description("AIDR setup CLI — installs ai-scanner hooks for AI coding agents")
-    .version("0.1.0");
+    .version("0.1.2");
 
   program
     .command("install")

package/src/scheduled.mjs

@@ -1,6 +1,6 @@
 import fs from "fs/promises";
 import path from "path";
-import { execFile, spawnSync } from "child_process";
+import { execFile } from "child_process";
 import { promisify } from "util";
 
 const execFileP = promisify(execFile);
@@ -177,82 +177,25 @@ export async function installScheduled(opts) {
 }
 
 async function writeEnvFile(accessKey, dryRun) {
-  // Capture the install-time actor identity here (NOT at scheduled
-  // run-time) because the scheduler runs as root with no Apple ID, no
-  // git config, and $USER="root". Without this, the Rust scanner would
-  // emit snapshots labelled "unknown" (or worse, fall through to
-  // customer_email — the bug this whole helper exists to fix).
-  const actorId = resolveInstallerActorId();
+  // Capture only the SUDO_USER (the unix username of whoever ran
+  // `sudo aidr install ...`) — the Rust binary will resolve the full
+  // identity (Apple ID / git email / username) at scan time using
+  // `sudo -u <invoker>` so it reads the invoker's plist / gitconfig
+  // instead of root's empty ones. Pre-resolving here is the wrong
+  // layer because the Apple ID needs to be re-read in the right user
+  // context at runtime anyway (root has no MobileMeAccounts.plist).
+  const invoker = process.env.SUDO_USER || null;
   let envContent = `AI_SCANNER_ACCESS_KEY=${accessKey}\n`;
-  if (actorId) envContent += `AI_SCANNER_ACTOR_ID=${actorId}\n`;
+  if (invoker) envContent += `AI_SCANNER_INVOKER_USER=${invoker}\n`;
   if (dryRun) {
     console.log("[dry-run] Would create:", SYSTEM_ENV_FILE, "(mode 0600)");
-    if (actorId) console.log("[dry-run]   actor_id captured:", actorId);
+    if (invoker) console.log("[dry-run]   invoker captured:", invoker);
     return;
   }
   await fs.mkdir(SYSTEM_ENV_DIR, { recursive: true, mode: 0o755 });
   await fs.writeFile(SYSTEM_ENV_FILE, envContent, { mode: 0o600 });
 }
 
-/**
- * Resolve the **pre-sudo user's** identity for embedding in
- * AI_SCANNER_ACTOR_ID at install time. Order, per user spec:
- *   1. SUDO_USER's git config user.email (run as that user — root has
- *      its own (usually empty) git config that we must not return)
- *   2. macOS: SUDO_USER's Apple ID (`defaults read MobileMeAccounts`)
- *   3. SUDO_USER itself (the Unix username)
- *
- * Returns `null` when none of the above succeed (e.g. install was run
- * as bare root with no SUDO_USER). The caller writes nothing in that
- * case; the Rust scanner then surfaces "unknown" instead of mislabeling
- * the snapshot with the user-portal login email.
- *
- * Test override: AIDR_INSTALLER_ACTOR_ID env bypasses every detection
- * step (used by Node unit tests so they don't have to mock spawnSync).
- */
-export function resolveInstallerActorId() {
-  if (process.env.AIDR_INSTALLER_ACTOR_ID) {
-    return process.env.AIDR_INSTALLER_ACTOR_ID || null;
-  }
-  const sudoUser = process.env.SUDO_USER;
-  if (!sudoUser) return null;
-
-  // 1. git config user.email — run AS the SUDO_USER so we read their
-  //    ~/.gitconfig, not /root/.gitconfig (which is normally empty).
-  //    --global is intentional: per-repo configs aren't relevant for
-  //    a host-level identity. timeout caps a hung git invocation.
-  const gitRes = spawnSync(
-    "sudo",
-    ["-u", sudoUser, "git", "config", "--global", "--get", "user.email"],
-    { encoding: "utf8", timeout: 5000 },
-  );
-  if (gitRes.status === 0) {
-    const email = (gitRes.stdout || "").trim();
-    if (email) return email;
-  }
-
-  // 2. macOS Apple ID. Mirrors the Rust binary's parse_apple_id: read
-  //    the first AccountID line from MobileMeAccounts. Must run as the
-  //    SUDO_USER — root has no MobileMeAccounts plist of its own.
-  if (process.platform === "darwin") {
-    const dRes = spawnSync(
-      "sudo",
-      ["-u", sudoUser, "defaults", "read", "MobileMeAccounts"],
-      { encoding: "utf8", timeout: 5000 },
-    );
-    if (dRes.status === 0) {
-      const m = (dRes.stdout || "").match(/AccountID\s*=\s*"([^"]+)"/);
-      const id = m && m[1] ? m[1].trim() : "";
-      if (id) return id;
-    }
-  }
-
-  // 3. Username fallback. Better than "unknown" because at least it
-  //    ties the snapshot to a Unix account on the host, but it loses
-  //    the cross-host identity that an email gives us.
-  return sudoUser;
-}
-
 async function installSystemd({ binaryPath, dryRun, noActivate, interval = 4 }) {
   // StandardOutput=append: requires systemd 240+ (released 2018). Modern
   // distros (RHEL 9 / Ubuntu 20.04+ / Debian 11+) all support it. Older

package/src/sentinel.mjs

@@ -22,7 +22,6 @@ import {
   ensureSystemLogDir,
   writeLogrotateConfig,
   removeSystemLog,
-  resolveInstallerActorId,
 } from "./scheduled.mjs";
 
 const execFileP = promisify(execFile);
@@ -139,14 +138,15 @@ export async function installSentinel(opts = {}) {
   await ensureSystemLogDir(SENTINEL_LOG_FILE, { dryRun });
   await writeLogrotateConfig({ dryRun });
 
-  // 3. Write env file (append AI_SCANNER_ACCESS_KEY + AI_SCANNER_ACTOR_ID
+  // 3. Write env file (append AI_SCANNER_ACCESS_KEY + AI_SCANNER_INVOKER_USER
   //    if missing). When --with-sentinel runs alongside --scheduled,
   //    scheduled.mjs's writeEnvFile has already written both lines and
   //    we no-op. When --with-sentinel runs standalone (no --scheduled),
-  //    we are the only writer of aidr.env and must capture the
-  //    pre-sudo SUDO_USER identity ourselves; otherwise the daemon
-  //    would report `unknown` actor (or worse, the customer_email
-  //    fallback before that branch was removed).
+  //    we are the only writer of aidr.env and must capture SUDO_USER
+  //    ourselves; otherwise the daemon (running as root with no useful
+  //    git/Apple/USER) reports `unknown`. Identity resolution itself
+  //    (Apple ID / git email / username) happens at scan time inside
+  //    the Rust binary using `sudo -u <invoker>`.
   if (accessKey && !dryRun) {
     let content = "";
     try { content = await fs.readFile(SYSTEM_ENV_FILE, "utf8"); } catch { /* first run */ }
@@ -154,10 +154,10 @@ export async function installSentinel(opts = {}) {
     if (!content.includes("AI_SCANNER_ACCESS_KEY")) {
       appended += `\nAI_SCANNER_ACCESS_KEY=${accessKey}\n`;
     }
-    if (!content.includes("AI_SCANNER_ACTOR_ID")) {
-      const actorId = resolveInstallerActorId();
-      if (actorId) {
-        appended += `AI_SCANNER_ACTOR_ID=${actorId}\n`;
+    if (!content.includes("AI_SCANNER_INVOKER_USER")) {
+      const invoker = process.env.SUDO_USER;
+      if (invoker) {
+        appended += `AI_SCANNER_INVOKER_USER=${invoker}\n`;
       }
     }
     if (appended) {