@coworker-jp/aidr 0.1.2 → 0.1.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coworker-jp/aidr",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "AIDR setup CLI - installs ai-scanner hooks for 19+ AI coding agents",
   "type": "module",
   "bin": {

package/src/cli.mjs

@@ -589,7 +589,7 @@ export async function run(argv) {
   program
     .name("aidr")
     .description("AIDR setup CLI — installs ai-scanner hooks for AI coding agents")
-    .version("0.1.2");
+    .version("0.1.3");
 
   program
     .command("install")

package/src/invoker-resolve.mjs

@@ -0,0 +1,63 @@
+// Best-effort invoker username resolution at install time.
+//
+// `aidr install --scheduled` / `--with-sentinel` writes the unix username
+// into `/etc/aidr/aidr.env` as `AI_SCANNER_INVOKER_USER`. The Rust daemon
+// reads it back to resolve git email / Apple ID / $HOME of the actual
+// installer (root daemons have no useful identity of their own).
+//
+// In the auto-sudo path the CLI re-execs itself via `sudo -E`, which sets
+// SUDO_USER. But several real-world contexts arrive here as bare root
+// without SUDO_USER:
+//   - `ssh root@host` then `npx ... install --scheduled` (no sudo prefix)
+//   - container / CI where the user is already root
+//   - sudo policy that strips SUDO_USER
+//
+// We walk a fallback chain so the resulting daemon snapshot reports the
+// real user instead of `actor_id=unknown`. Each step is best-effort and
+// never throws — we return `null` when no signal is available, which is
+// the honest outcome for genuinely identity-less contexts (CI runners).
+
+import { execSync } from "node:child_process";
+
+function tryExec(cmd) {
+  try {
+    return execSync(cmd, { stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
+  } catch {
+    return "";
+  }
+}
+
+function isUsable(name) {
+  return name && name !== "root";
+}
+
+export function resolveInvokerUser() {
+  if (process.env.SUDO_USER) return process.env.SUDO_USER;
+
+  // `who am i` reads utmp, so it returns the actual login user even after
+  // `sudo -i` / `su -`. Empty under non-tty / no utmp.
+  const whoUser = tryExec("who am i").split(/\s+/)[0];
+  if (isUsable(whoUser)) return whoUser;
+
+  // POSIX `logname` gives controlling-tty owner. Slightly different code
+  // path from `who am i` — kept as a separate fallback because they fail
+  // independently on minimal images.
+  const logname = tryExec("logname");
+  if (isUsable(logname)) return logname;
+
+  // systemd Linux: `loginctl list-sessions` columns are: SESSION UID USER ...
+  const loginctl = tryExec("loginctl list-sessions --no-legend");
+  for (const line of loginctl.split("\n")) {
+    const fields = line.trim().split(/\s+/);
+    if (fields.length >= 3 && isUsable(fields[2])) return fields[2];
+  }
+
+  // Env fallbacks (root-filtered) so a user-shell install without sudo at
+  // all (rare for --scheduled, possible for plain --agent without root)
+  // still captures the obvious answer.
+  for (const env of ["LOGNAME", "USER"]) {
+    if (isUsable(process.env[env])) return process.env[env];
+  }
+
+  return null;
+}

package/src/scheduled.mjs

@@ -2,6 +2,7 @@ import fs from "fs/promises";
 import path from "path";
 import { execFile } from "child_process";
 import { promisify } from "util";
+import { resolveInvokerUser } from "./invoker-resolve.mjs";
 
 const execFileP = promisify(execFile);
 
@@ -177,14 +178,14 @@ export async function installScheduled(opts) {
 }
 
 async function writeEnvFile(accessKey, dryRun) {
-  // Capture only the SUDO_USER (the unix username of whoever ran
-  // `sudo aidr install ...`) — the Rust binary will resolve the full
-  // identity (Apple ID / git email / username) at scan time using
-  // `sudo -u <invoker>` so it reads the invoker's plist / gitconfig
-  // instead of root's empty ones. Pre-resolving here is the wrong
-  // layer because the Apple ID needs to be re-read in the right user
-  // context at runtime anyway (root has no MobileMeAccounts.plist).
-  const invoker = process.env.SUDO_USER || null;
+  // Capture the invoker username (SUDO_USER first, then `who am i` /
+  // `logname` / `loginctl` / $LOGNAME / $USER fallbacks) — the Rust
+  // binary resolves the full identity (Apple ID / git email / username)
+  // at scan time using `sudo -u <invoker>` so it reads the invoker's
+  // plist / gitconfig instead of root's empty ones. Pre-resolving here
+  // is the wrong layer because the Apple ID needs to be re-read in the
+  // right user context at runtime anyway (root has no MobileMeAccounts).
+  const invoker = resolveInvokerUser();
   let envContent = `AI_SCANNER_ACCESS_KEY=${accessKey}\n`;
   if (invoker) envContent += `AI_SCANNER_INVOKER_USER=${invoker}\n`;
   if (dryRun) {

package/src/sentinel.mjs

@@ -13,6 +13,7 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import { execFile, spawnSync } from "node:child_process";
+import { resolveInvokerUser } from "./invoker-resolve.mjs";
 import { promisify } from "node:util";
 import { fetchSentinel, detectPlatform } from "./binary-fetcher.mjs";
 import {
@@ -155,7 +156,7 @@ export async function installSentinel(opts = {}) {
       appended += `\nAI_SCANNER_ACCESS_KEY=${accessKey}\n`;
     }
     if (!content.includes("AI_SCANNER_INVOKER_USER")) {
-      const invoker = process.env.SUDO_USER;
+      const invoker = resolveInvokerUser();
       if (invoker) {
         appended += `AI_SCANNER_INVOKER_USER=${invoker}\n`;
       }