@coworker-jp/aidr 0.1.10 → 0.1.18

package/src/scheduled.mjs

@@ -2,13 +2,20 @@ import fs from "fs/promises";
 import path from "path";
 import { execFile } from "child_process";
 import { promisify } from "util";
-import { resolveInvokerUser } from "./invoker-resolve.mjs";
 
 const execFileP = promisify(execFile);
 
-// System-wide install paths (root-only). The schedule entry runs as root so
-// endpoint-info can collect host-wide inventory (process list, SUID, /etc/*).
-// All paths are owned by root:root; the access-key env file is mode 0600.
+// System-wide install paths (root-only), shared with the legacy
+// coworker-sentinel cleanup (sentinel.mjs). Historically this module wrote a
+// cron.d / launchd schedule entry (`aidr install --scheduled`) that ran
+// `ai-scanner scan endpoint-info` periodically; that mechanism is retired —
+// endpoint-info collection now runs from the coworker-sentinel daemon's
+// internal timer (installed via the OS-native installers, not aidr).
+// What remains here is:
+//   - the path constants (still the canonical legacy system layout)
+//   - the shared log / logrotate cleanup helpers used by sentinel.mjs
+//   - cleanupLegacyScheduled(), which removes leftover schedule entries
+//     written by older aidr versions.
 //
 // `AIDR_SCHEDULED_ROOT` env (smoke / unit test only) prefixes every path so
 // they land under a tmpdir like `/tmp/test123/opt/coworker/aidr/bin/...`
@@ -33,19 +40,21 @@ const SYSTEM_ENV_DIR            = IS_WIN
   : ROOT_PREFIX + "/etc/aidr";
 export const SYSTEM_ENV_FILE    = path.join(SYSTEM_ENV_DIR, "aidr.env");
 
-// macOS launchd (LaunchDaemons run as root, available pre-login)
+// Legacy macOS launchd entry (LaunchDaemons ran as root, pre-login) —
+// written by `aidr install --scheduled` before the sentinel-daemon scheduler.
+// Kept only so cleanupLegacyScheduled can find and remove old installs.
 export const LAUNCHD_PLIST    = ROOT_PREFIX + "/Library/LaunchDaemons/jp.coworker.aidr.scheduled.plist";
+export const LAUNCHD_LABEL    = "jp.coworker.aidr.scheduled";
 export const LAUNCHD_WRAPPER  = path.join(SYSTEM_BIN_DIR, "aidr-scheduled-wrapper.sh");
 
-// Linux: cron.d entry, runs as root every N hours.
+// Legacy Linux cron.d entry (same retirement).
 export const CRON_FILE        = ROOT_PREFIX + "/etc/cron.d/aidr-scheduled";
 
-// Shared world-readable system log directory. Both aidr-scheduled and
-// coworker-sentinel daemons write here so non-root users can `tail` errors
-// without sudo (memory: feedback_server_failures_never_burden_client.md).
-// Mode 0755 root:root, files mode 0644. launchd's `StandardOutPath` (macOS)
-// redirects daemon stderr/stdout here; for Linux cron, the entry uses a
-// literal `>> ... 2>&1` redirect.
+// Shared world-readable system log directory. The coworker-sentinel daemon
+// writes here so non-root users can `tail` errors without sudo (memory:
+// feedback_server_failures_never_burden_client.md). Mode 0755 root:root,
+// files mode 0644. SCHEDULED_LOG_FILE is the legacy aidr-scheduled log,
+// kept only so cleanupLegacyScheduled can remove it.
 export const SYSTEM_LOG_DIR     = IS_WIN
   ? path.join(WIN_PROGRAMDATA, "coworker", "logs")
   : ROOT_PREFIX + "/var/log/coworker";
@@ -63,26 +72,9 @@ async function exists(p) {
 }
 
 /**
- * Create SYSTEM_LOG_DIR (mode 0755 root:root) and touch the given daemon's
- * log file (mode 0644) if it doesn't already exist. Idempotent — both
- * installScheduled and installSentinel call this so the daemon's first run
- * has a writable target even before any line is logged.
- */
-export async function ensureSystemLogDir(logFile, { dryRun = false } = {}) {
-  if (dryRun) {
-    console.log("[dry-run] Would create:", SYSTEM_LOG_DIR, "(mode 0755) and touch", logFile, "(mode 0644)");
-    return;
-  }
-  await fs.mkdir(SYSTEM_LOG_DIR, { recursive: true, mode: 0o755 });
-  if (!(await exists(logFile))) {
-    const fd = await fs.open(logFile, "w", 0o644);
-    await fd.close();
-  }
-}
-
-/**
- * Drop /etc/logrotate.d/coworker covering both daemons. Idempotent: same
- * content overwritten on every install. The logrotate command itself may
+ * Drop /etc/logrotate.d/coworker for the sentinel daemon log. Idempotent:
+ * used by cleanupLegacyScheduled to strip the retired scheduled.log stanza
+ * from configs written by older aidr versions. The logrotate command itself may
  * not be present on minimal containers; the config file is harmless when
  * no logrotate is installed (it simply isn't read). Operators on systems
  * without logrotate should configure their own rotation.
@@ -91,17 +83,7 @@ export async function writeLogrotateConfig({ dryRun = false } = {}) {
   // logrotate is a Unix tool; Windows has no equivalent here (the service can
   // size-rotate its own audit log). No-op on Windows.
   if (process.platform === "win32") return;
-  const body = `# Generated by aidr install. Covers both aidr-scheduled (weekly) and
-# coworker-sentinel (daily, more chatty under load).
-/var/log/coworker/scheduled.log {
-    weekly
-    rotate 4
-    compress
-    missingok
-    notifempty
-    create 0644 root root
-}
-
+  const body = `# Generated by aidr install. Covers the coworker-sentinel daemon log.
 /var/log/coworker/sentinel.log {
     daily
     rotate 7
@@ -122,8 +104,8 @@ export async function writeLogrotateConfig({ dryRun = false } = {}) {
 /**
  * Remove the given daemon's log file. If both daemon log files are gone
  * afterwards, also rmdir SYSTEM_LOG_DIR and remove the logrotate config.
- * Used by uninstallScheduled and uninstallSentinel; the order doesn't
- * matter (whichever daemon uninstalls last wins the cleanup).
+ * Used by cleanupLegacyScheduled and uninstallSentinel; the order doesn't
+ * matter (whichever cleanup runs last wins the dir/logrotate removal).
  */
 export async function removeSystemLog(logFile, { dryRun = false } = {}) {
   if (await exists(logFile)) {
@@ -144,196 +126,75 @@ export async function removeSystemLog(logFile, { dryRun = false } = {}) {
   }
 }
 
+/**
+ * Detect leftovers of the retired `aidr install --scheduled` mechanism
+ * (cron.d entry / launchd plist / launchd wrapper) from older aidr versions.
+ */
 export async function isScheduledInstalled() {
-  return (await exists(LAUNCHD_PLIST)) || (await exists(CRON_FILE));
+  return (await exists(LAUNCHD_PLIST))
+      || (await exists(CRON_FILE))
+      || (await exists(LAUNCHD_WRAPPER));
 }
 
-export async function installScheduled(opts) {
-  const { accessKey, dryRun = false, interval = 4 } = opts;
-  const noActivate = opts.noActivate || process.env.AI_SCANNER_NO_SCHEDULED_ACTIVATE === "1";
-
-  if (!isRoot()) {
-    throw new Error("installScheduled requires root privileges (system paths under /etc and /opt)");
-  }
-
-  // Always use the canonical system binary path; the binary is placed there by
-  // the standalone agent's binary fetch step before this function runs.
-  const binaryPath = SYSTEM_BIN;
-
-  // Replace any prior schedule entry. Avoids duplicate ExecStart / interval drift.
-  if (await isScheduledInstalled()) {
-    await uninstallScheduled({ dryRun, noActivate });
-  }
-
-  // Write the shared env file first; both Linux and macOS paths reference it.
-  await writeEnvFile(accessKey, dryRun);
-
-  // Create the world-readable log dir + touch scheduled.log + drop the
-  // shared logrotate config. Both run before the launchd / cron entry so
-  // the daemon's first invocation has a target to append to.
-  await ensureSystemLogDir(SCHEDULED_LOG_FILE, { dryRun });
-  await writeLogrotateConfig({ dryRun });
-
-  if (process.platform === "darwin") {
-    await installLaunchd({ dryRun, noActivate, interval, binaryPath });
-  } else {
-    await installCronDir({ binaryPath, dryRun, interval });
-  }
-}
-
-async function writeEnvFile(accessKey, dryRun) {
-  // Capture the invoker username (SUDO_USER first, then `who am i` /
-  // `logname` / `loginctl` / $LOGNAME / $USER fallbacks) — the Rust
-  // binary resolves the full identity (Apple ID / git email / username)
-  // at scan time using `sudo -u <invoker>` so it reads the invoker's
-  // plist / gitconfig instead of root's empty ones. Pre-resolving here
-  // is the wrong layer because the Apple ID needs to be re-read in the
-  // right user context at runtime anyway (root has no MobileMeAccounts).
-  const invoker = resolveInvokerUser();
-  let envContent = `AI_SCANNER_ACCESS_KEY=${accessKey}\n`;
-  if (invoker) envContent += `AI_SCANNER_INVOKER_USER=${invoker}\n`;
-  if (dryRun) {
-    console.log("[dry-run] Would create:", SYSTEM_ENV_FILE, "(mode 0600)");
-    if (invoker) console.log("[dry-run]   invoker captured:", invoker);
-    return;
-  }
-  await fs.mkdir(SYSTEM_ENV_DIR, { recursive: true, mode: 0o755 });
-  await fs.writeFile(SYSTEM_ENV_FILE, envContent, { mode: 0o600 });
-}
-
-export async function installLaunchd({ binaryPath, dryRun, noActivate, interval = 4 }) {
-  // launchd does not support EnvironmentFile, so we use a tiny wrapper that
-  // sources /etc/aidr/aidr.env and execs the binary. Plist itself stays 0644
-  // (launchctl bootstrap requires it readable); the secret lives in the env
-  // file at 0600.
-  const wrapperContent = `#!/bin/bash
-# Generated by aidr install --scheduled. Sources the system env file and
-# execs ai-scanner so the access key is not embedded in the LaunchDaemon plist.
-set -a
-. ${SYSTEM_ENV_FILE}
-set +a
-# launchd starts daemons with a narrow default PATH (/usr/bin:/bin:/usr/sbin:/sbin)
-# that omits Homebrew. Without this, scan endpoint-info silently misses brew
-# packages because Command::new("brew") spawn fails — gem still works because
-# /usr/bin/gem is on the default PATH. Both Apple Silicon (/opt/homebrew/bin)
-# and Intel (/usr/local/bin) prefixes are safe to prepend on either arch since
-# missing dirs in PATH are simply ignored at lookup time.
-export PATH="/opt/homebrew/bin:/usr/local/bin:/opt/homebrew/sbin:/usr/local/sbin:\${PATH:-/usr/bin:/bin:/usr/sbin:/sbin}"
-exec ${binaryPath} scan endpoint-info
-`;
-
-  const plistContent = `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>Label</key>
-  <string>jp.coworker.aidr.scheduled</string>
-  <key>UserName</key>
-  <string>root</string>
-  <key>ProgramArguments</key>
-  <array>
-    <string>${LAUNCHD_WRAPPER}</string>
-  </array>
-  <key>StartInterval</key>
-  <integer>${interval * 3600}</integer>
-  <key>RunAtLoad</key>
-  <false/>
-  <key>StandardOutPath</key>
-  <string>${SCHEDULED_LOG_FILE}</string>
-  <key>StandardErrorPath</key>
-  <string>${SCHEDULED_LOG_FILE}</string>
-</dict>
-</plist>
-`;
-
-  if (dryRun) {
-    console.log("[dry-run] Would create:", LAUNCHD_WRAPPER, LAUNCHD_PLIST);
-    return;
-  }
-
-  await fs.mkdir(path.dirname(LAUNCHD_WRAPPER), { recursive: true });
-  await fs.mkdir(path.dirname(LAUNCHD_PLIST), { recursive: true });
-  await fs.writeFile(LAUNCHD_WRAPPER, wrapperContent, { mode: 0o755 });
-  await fs.writeFile(LAUNCHD_PLIST, plistContent, { mode: 0o644 });
-
-  if (!noActivate) {
-    try {
-      await execFileP("launchctl", ["bootstrap", "system", LAUNCHD_PLIST]);
-      console.log(`Scheduled scan enabled via system LaunchDaemon (every ${interval}h)`);
-    } catch (e) {
-      console.warn("Warning: launchctl bootstrap failed:", e.message);
-      console.warn(`Plist written. Enable manually: sudo launchctl bootstrap system ${LAUNCHD_PLIST}`);
-    }
-  }
-}
-
-async function installCronDir({ binaryPath, dryRun, interval = 4 }) {
-  // The aidr.env file is plain `KEY=VALUE` lines (no `export` prefix —
-  // systemd's EnvironmentFile= used by the sentinel service requires that
-  // form). Plain `. file` sets shell-local variables that don't propagate
-  // to the spawned ai-scanner process; `set -a` flips on auto-export so
-  // every assignment becomes an environment variable. Same pattern as the
-  // launchd wrapper on macOS.
-  const entry = `0 */${interval} * * * root set -a; . ${SYSTEM_ENV_FILE}; set +a; ${binaryPath} scan endpoint-info >> ${SCHEDULED_LOG_FILE} 2>&1
-`;
-  if (dryRun) {
-    console.log("[dry-run] Would create:", CRON_FILE);
-    return;
-  }
-  await fs.mkdir(path.dirname(CRON_FILE), { recursive: true });
-  await fs.writeFile(CRON_FILE, entry, { mode: 0o644 });
-  console.log(`Scheduled scan added to ${CRON_FILE} (every ${interval}h)`);
-
-  // Warn (don't fail) when no cron daemon is detected. The file is valid;
-  // the user just needs to install one (`apt install cron`, `dnf install
-  // cronie`, etc.) before the next scheduled hour for it to fire.
-  if (!await hasCronDaemon()) {
-    console.warn(
-      "WARNING: cron daemon not detected. Install one (`apt install cron` / `dnf install cronie` / `apk add dcron`) so /etc/cron.d/aidr-scheduled actually fires."
-    );
-  }
-}
-
-async function hasCronDaemon() {
-  for (const candidate of ["/usr/sbin/cron", "/usr/sbin/crond", "/sbin/cron", "/sbin/crond"]) {
-    if (await exists(candidate)) return true;
-  }
-  return false;
-}
-
-export async function uninstallScheduled({ dryRun = false, noActivate = false } = {}) {
-  noActivate = noActivate || process.env.AI_SCANNER_NO_SCHEDULED_ACTIVATE === "1";
-
+/**
+ * Remove every artifact the retired `aidr install --scheduled` flow wrote:
+ *   - /etc/cron.d/aidr-scheduled                                   (Linux)
+ *   - /Library/LaunchDaemons/jp.coworker.aidr.scheduled.plist      (macOS,
+ *     with a best-effort `launchctl bootout system/<label>` first)
+ *   - the launchd wrapper script in SYSTEM_BIN_DIR
+ *   - /var/log/coworker/scheduled.log (+ the log dir / logrotate config if
+ *     no daemon log remains — see removeSystemLog)
+ *   - the stale scheduled.log stanza in /etc/logrotate.d/coworker when the
+ *     config survives because sentinel is still installed
+ *
+ * MUST NOT touch /etc/aidr/aidr.env: the coworker-sentinel daemon reads its
+ * access key from that shared env file.
+ *
+ * Idempotent; safe to call when nothing is installed.
+ */
+export async function cleanupLegacyScheduled({ dryRun = false } = {}) {
   if (!isRoot()) {
-    throw new Error("uninstallScheduled requires root privileges");
+    throw new Error("cleanupLegacyScheduled requires root privileges (system paths under /etc and /opt)");
   }
+  const noActivate = process.env.AI_SCANNER_NO_SCHEDULED_ACTIVATE === "1";
 
   if (await exists(LAUNCHD_PLIST)) {
-    if (!dryRun && !noActivate) {
-      try { await execFileP("launchctl", ["bootout", "system", LAUNCHD_PLIST]); } catch { /* ignore */ }
-    }
-    if (!dryRun) {
-      try { await fs.unlink(LAUNCHD_PLIST); } catch { /* ignore */ }
-      try { await fs.unlink(LAUNCHD_WRAPPER); } catch { /* ignore */ }
+    if (dryRun) {
+      console.log("[dry-run] Would remove:", LAUNCHD_PLIST);
     } else {
-      console.log("[dry-run] Would remove:", LAUNCHD_PLIST, LAUNCHD_WRAPPER);
+      if (!noActivate) {
+        // Best-effort: unloads the running LaunchDaemon so the entry stops
+        // firing immediately. Fails harmlessly when it was never bootstrapped
+        // (or off-macOS in tests).
+        try { await execFileP("launchctl", ["bootout", `system/${LAUNCHD_LABEL}`]); } catch { /* ignore */ }
+      }
+      try { await fs.unlink(LAUNCHD_PLIST); } catch { /* ignore */ }
     }
   }
 
-  if (await exists(CRON_FILE)) {
-    if (!dryRun) { try { await fs.unlink(CRON_FILE); } catch { /* ignore */ } }
-    else { console.log("[dry-run] Would remove:", CRON_FILE); }
+  for (const f of [LAUNCHD_WRAPPER, CRON_FILE]) {
+    if (await exists(f)) {
+      if (dryRun) { console.log("[dry-run] Would remove:", f); }
+      else { try { await fs.unlink(f); } catch { /* ignore */ } }
+    }
   }
 
-  // Remove the env file last so an aborted uninstall doesn't strand a
-  // schedule entry that still references a missing env file.
-  if (await exists(SYSTEM_ENV_FILE)) {
-    if (!dryRun) { try { await fs.unlink(SYSTEM_ENV_FILE); } catch { /* ignore */ } }
-    else { console.log("[dry-run] Would remove:", SYSTEM_ENV_FILE); }
-  }
+  // NOTE: SYSTEM_ENV_FILE (/etc/aidr/aidr.env) is deliberately NOT removed —
+  // the coworker-sentinel daemon reads AI_SCANNER_ACCESS_KEY /
+  // AI_SCANNER_INVOKER_USER from it.
 
-  // Drop the scheduled log file. removeSystemLog also rmdirs SYSTEM_LOG_DIR
-  // and deletes /etc/logrotate.d/coworker if no daemon log files remain
-  // (i.e. sentinel is also uninstalled).
+  // Drop the legacy scheduled log file. removeSystemLog also rmdirs
+  // SYSTEM_LOG_DIR and deletes /etc/logrotate.d/coworker when no daemon log
+  // remains (i.e. sentinel is not installed either).
   await removeSystemLog(SCHEDULED_LOG_FILE, { dryRun });
+
+  // When the logrotate config survives (sentinel still installed), older
+  // installs left a stale scheduled.log stanza in it — rewrite with the
+  // current sentinel-only content.
+  if (!dryRun && (await exists(LOGROTATE_FILE))) {
+    const body = await fs.readFile(LOGROTATE_FILE, "utf8").catch(() => "");
+    if (body.includes("scheduled.log")) {
+      await writeLogrotateConfig({ dryRun });
+    }
+  }
 }