@geekbeer/minion 2.57.0 → 2.59.0

package/core/routes/sudoers.js

@@ -0,0 +1,70 @@
+/**
+ * Sudoers endpoint
+ *
+ * Endpoints:
+ * - GET /api/sudoers - List sudo permissions for the current user
+ */
+
+const { exec } = require('child_process')
+const { promisify } = require('util')
+const execAsync = promisify(exec)
+
+const { verifyToken } = require('../lib/auth')
+
+/**
+ * Parse `sudo -l` output into structured permission entries
+ * @param {string} output - Raw output from `sudo -l`
+ * @returns {string[]} List of allowed commands
+ */
+function parseSudoList(output) {
+  const lines = output.split('\n')
+  const commands = []
+
+  for (const line of lines) {
+    const trimmed = line.trim()
+    // Lines starting with (root) contain permission entries
+    if (trimmed.startsWith('(root)') || trimmed.startsWith('(ALL)')) {
+      // Extract the command part after NOPASSWD: or the run-as spec
+      const match = trimmed.match(/(?:NOPASSWD:\s*)(.+)$/)
+      if (match) {
+        commands.push(match[1].trim())
+      }
+    }
+  }
+
+  return commands
+}
+
+/**
+ * Register sudoers routes as Fastify plugin
+ * @param {import('fastify').FastifyInstance} fastify
+ */
+async function sudoersRoutes(fastify) {
+  fastify.get('/api/sudoers', async (request, reply) => {
+    if (!verifyToken(request)) {
+      reply.code(401)
+      return { success: false, error: 'Unauthorized' }
+    }
+
+    try {
+      const { stdout } = await execAsync('sudo -n -l 2>/dev/null', { timeout: 5000 })
+      const commands = parseSudoList(stdout)
+
+      return {
+        success: true,
+        commands,
+        raw: stdout.trim(),
+      }
+    } catch (error) {
+      // sudo -l may fail if sudo is not configured at all
+      return {
+        success: true,
+        commands: [],
+        raw: '',
+        note: 'sudo is not configured or no permissions granted',
+      }
+    }
+  })
+}
+
+module.exports = { sudoersRoutes }

package/linux/minion-cli.sh

@@ -320,6 +320,9 @@ do_setup() {
     local SUDOERS_FILE="/etc/sudoers.d/minion-agent"
 
     {
+      # Fail immediately instead of prompting for password (safety net for LLM agents)
+      echo "Defaults:${TARGET_USER} passwd_tries=0"
+      echo ""
       echo "${TARGET_USER} ALL=(root) NOPASSWD: ${NPM_BIN} install -g @geekbeer/minion@latest"
       echo "${TARGET_USER} ALL=(root) NOPASSWD: ${NPM_BIN} install -g @geekbeer/minion@latest --registry *"
       echo "${TARGET_USER} ALL=(root) NOPASSWD: /usr/bin/apt-get install *"

package/linux/server.js

@@ -20,6 +20,7 @@
  * Secrets:              GET /api/secrets, PUT/DELETE /api/secrets/:key
  * Config:               GET /api/config/backup, GET/PUT /api/config/env
  * Executions:           GET /api/executions, GET /api/executions/:id, etc.
+ * Sudoers:              GET /api/sudoers
  * ─────────────────────────────────────────────────────────────────────────────
  */
 
@@ -65,6 +66,7 @@ const { authRoutes } = require('../core/routes/auth')
 const { variableRoutes } = require('../core/routes/variables')
 const { memoryRoutes } = require('../core/routes/memory')
 const { dailyLogRoutes } = require('../core/routes/daily-logs')
+const { sudoersRoutes } = require('../core/routes/sudoers')
 
 // Linux-specific routes
 const { commandRoutes, getProcessManager, getAllowedCommands } = require('./routes/commands')
@@ -265,6 +267,7 @@ async function registerAllRoutes(app) {
   await app.register(variableRoutes)
   await app.register(memoryRoutes)
   await app.register(dailyLogRoutes)
+  await app.register(sudoersRoutes)
 
   // Linux-specific routes
   await app.register(commandRoutes)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geekbeer/minion",
-  "version": "2.57.0",
+  "version": "2.59.0",
   "description": "AI Agent runtime for Minion - manages status and skill deployment on VPS",
   "main": "linux/server.js",
   "bin": {

package/rules/core.md

@@ -7,6 +7,7 @@ You are an AI agent running on a Minion VPS, managed by @geekbeer/minion.
 - **HQサーバーのソースコードを読みに行く必要はありません。** 必要なAPI仕様はすべてドキュメントに記載されています。
 - API の詳細仕様が必要な場合は `~/.minion/docs/api-reference.md` を参照してください。
 - タスクの手順が不明な場合は `~/.minion/docs/task-guides.md` を参照してください。
+- **`sudo` を使用しないこと。** 必要なツール・ライブラリはすべてセットアップ済みです。`sudo` はパスワード未設定のため実行できません。パッケージのインストールや環境構築が必要に見える場合でも、既にインストール済みであることを前提に作業を進めてください。
 
 ## Architecture