@jive-ai/cli 0.0.45 → 0.0.47

package/dist/index.mjs

@@ -28,9 +28,16 @@ import httpProxy from "http-proxy";
 
 //#region src/lib/config.ts
 /**
+* Get the effective home directory - uses SUDO_USER's home when running with sudo
+*/
+function getEffectiveHomeDir() {
+	if (process.env.SUDO_USER) return `/home/${process.env.SUDO_USER}`;
+	return os.homedir();
+}
+/**
 * `~/.jive/credentials.json`
 */
-const CREDENTIALS_PATH = path.join(os.homedir(), ".jive", "credentials.json");
+const CREDENTIALS_PATH = path.join(getEffectiveHomeDir(), ".jive", "credentials.json");
 /**
 * `<cwd>/.jive/config.json`
 */
@@ -1023,6 +1030,48 @@ const mutations = {
         }
       }
     }
+  `),
+	CreateIssue: graphql(`
+    mutation CreateIssue($input: CreateIssueInput!) {
+      createIssue(input: $input) {
+        success
+        issue {
+          id
+          number
+          title
+          htmlUrl
+          labels {
+            name
+            color
+          }
+        }
+        errors {
+          message
+          code
+        }
+      }
+    }
+  `),
+	UpdateIssue: graphql(`
+    mutation UpdateIssue($input: UpdateIssueInput!) {
+      updateIssue(input: $input) {
+        success
+        issue {
+          id
+          number
+          title
+          htmlUrl
+          labels {
+            name
+            color
+          }
+        }
+        errors {
+          message
+          code
+        }
+      }
+    }
   `),
 	RegisterRunner: graphql(`
     mutation RegisterRunner($input: RegisterRunnerInput!) {
@@ -1563,6 +1612,46 @@ var ApiClient = class {
 			}
 		};
 	}
+	async createIssue(projectId, data) {
+		const result = await (await getGraphQLClient()).request(mutations.CreateIssue, { input: {
+			projectId: String(projectId),
+			title: data.title,
+			body: data.body,
+			labels: data.labels
+		} });
+		if (result.createIssue.errors?.length) throw this.formatError({ message: result.createIssue.errors[0].message });
+		return {
+			success: result.createIssue.success,
+			issue: {
+				id: result.createIssue.issue.id,
+				number: result.createIssue.issue.number,
+				title: result.createIssue.issue.title,
+				htmlUrl: result.createIssue.issue.htmlUrl,
+				labels: result.createIssue.issue.labels
+			}
+		};
+	}
+	async updateIssue(projectId, data) {
+		const result = await (await getGraphQLClient()).request(mutations.UpdateIssue, { input: {
+			projectId: String(projectId),
+			number: data.number,
+			title: data.title,
+			body: data.body,
+			state: data.state,
+			labels: data.labels
+		} });
+		if (result.updateIssue.errors?.length) throw this.formatError({ message: result.updateIssue.errors[0].message });
+		return {
+			success: result.updateIssue.success,
+			issue: {
+				id: result.updateIssue.issue.id,
+				number: result.updateIssue.issue.number,
+				title: result.updateIssue.issue.title,
+				htmlUrl: result.updateIssue.issue.htmlUrl,
+				labels: result.updateIssue.issue.labels
+			}
+		};
+	}
 	async getTaskSteps(id) {
 		const data = await (await getGraphQLClient()).request(queries.GetPlan, { id: String(id) });
 		if (!data.plan?.steps) return [];
@@ -1961,7 +2050,7 @@ async function createGraphQLClient() {
 
 //#endregion
 //#region package.json
-var version = "0.0.45";
+var version = "0.0.47";
 
 //#endregion
 //#region src/runner/index.ts
@@ -2184,7 +2273,6 @@ var TaskRunner = class {
 		const url = new URL(WS_URL);
 		url.searchParams.set("apiKey", jiveApiKey);
 		url.searchParams.set("runnerId", this.config.id.toString());
-		console.log(chalk.dim(`Connecting to ${url.toString()}...`));
 		this.ws = new WebSocket(url.toString());
 		this.ws.on("open", () => this.handleOpen());
 		this.ws.on("message", (data) => this.handleMessage(data));
@@ -2419,17 +2507,10 @@ async function queryClaude(prompt, mcpServer, opts) {
 			permissionMode: mapPermissionMode(permissionMode),
 			...betaFlags.length > 0 && { betas: betaFlags },
 			canUseTool: async (toolName, input) => {
-				if (toolName === "AskUserQuestion") {
-					const result = await task.requestUserQuestions(input);
-					if (result) return {
-						behavior: "allow",
-						updatedInput: result
-					};
-					else return {
-						behavior: "deny",
-						message: "User did not answer questions in time"
-					};
-				}
+				if (toolName === "AskUserQuestion") return {
+					behavior: "deny",
+					message: "AskUserQuestion is not allowed. Use the ask_user_question tool from the jive-tasks MCP server instead."
+				};
 				if (await task.requestToolPermission(toolName, input)) return {
 					behavior: "allow",
 					updatedInput: input
@@ -2439,6 +2520,11 @@ async function queryClaude(prompt, mcpServer, opts) {
 					message: "User denied this action"
 				};
 			},
+			systemPrompt: {
+				type: "preset",
+				preset: "claude_code",
+				append: "When you want to use AskUserQuestion, use the ask_user_question tool from the jive-tasks MCP server instead. DO NOT USE THE AskUserQuestion tool directly."
+			},
 			stderr: (data) => {
 				console.error(data.toString());
 			}
@@ -2714,6 +2800,136 @@ function createTasksSdkServer(task) {
 						isError: true
 					};
 				}
+			}),
+			tool("create_issue", "Create an issue on GitHub or GitLab for the current project. Use this to track bugs, feature requests, or other work items.", {
+				title: z.string().describe("Issue title - a concise summary of the issue"),
+				body: z.string().describe("Issue body/description - detailed explanation of the issue"),
+				labels: z.array(z.string()).optional().describe("Optional labels to apply to the issue")
+			}, async (args) => {
+				if (!context) return {
+					content: [{
+						type: "text",
+						text: "Error: Task context not initialized"
+					}],
+					isError: true
+				};
+				try {
+					const apiClient$1 = getApiClient();
+					const { project } = await apiClient$1.getTask(context.taskId);
+					if (!project) return {
+						content: [{
+							type: "text",
+							text: "Error: Project not found for this task"
+						}],
+						isError: true
+					};
+					task.debugLog(`Creating issue: ${args.title}`);
+					const result = await apiClient$1.createIssue(project.id, {
+						title: args.title,
+						body: args.body,
+						labels: args.labels
+					});
+					task.debugLog(`Issue created: ${JSON.stringify(result, null, 2)}`);
+					return { content: [{
+						type: "text",
+						text: JSON.stringify({
+							success: true,
+							projectId: project.id,
+							issue: result.issue
+						}, null, 2)
+					}] };
+				} catch (error$1) {
+					return {
+						content: [{
+							type: "text",
+							text: `Error creating issue: ${error$1.message}`
+						}],
+						isError: true
+					};
+				}
+			}),
+			tool("update_issue", "Update an existing issue on GitHub or GitLab. Use this to modify issue title, body, state (open/closed), or labels.", {
+				number: z.number().describe("Issue number to update"),
+				title: z.string().optional().describe("New title for the issue"),
+				body: z.string().optional().describe("New body/description for the issue"),
+				state: z.enum(["open", "closed"]).optional().describe("Issue state - \"open\" or \"closed\""),
+				labels: z.array(z.string()).optional().describe("Labels to set on the issue (replaces existing labels)")
+			}, async (args) => {
+				if (!context) return {
+					content: [{
+						type: "text",
+						text: "Error: Task context not initialized"
+					}],
+					isError: true
+				};
+				try {
+					const apiClient$1 = getApiClient();
+					const { project } = await apiClient$1.getTask(context.taskId);
+					if (!project) return {
+						content: [{
+							type: "text",
+							text: "Error: Project not found for this task"
+						}],
+						isError: true
+					};
+					task.debugLog(`Updating issue #${args.number}`);
+					const result = await apiClient$1.updateIssue(project.id, {
+						number: args.number,
+						title: args.title,
+						body: args.body,
+						state: args.state,
+						labels: args.labels
+					});
+					task.debugLog(`Issue updated: ${JSON.stringify(result, null, 2)}`);
+					return { content: [{
+						type: "text",
+						text: JSON.stringify({
+							success: true,
+							projectId: project.id,
+							issue: result.issue
+						}, null, 2)
+					}] };
+				} catch (error$1) {
+					return {
+						content: [{
+							type: "text",
+							text: `Error updating issue: ${error$1.message}`
+						}],
+						isError: true
+					};
+				}
+			}),
+			tool("ask_user_question", "Ask the user clarifying questions. Returns immediately - answers will be provided in a follow-up message.", { questions: z.array(z.object({
+				question: z.string().describe("The question to ask"),
+				header: z.string().describe("Short header/label for the question"),
+				options: z.array(z.object({
+					label: z.string(),
+					description: z.string()
+				})).describe("Options for the user to choose from"),
+				multiSelect: z.boolean().describe("Allow multiple selections")
+			})).describe("Questions to ask the user") }, async (args) => {
+				if (!context) return {
+					content: [{
+						type: "text",
+						text: "Error: Task context not initialized"
+					}],
+					isError: true
+				};
+				try {
+					task.sendUserQuestionRequest(args.questions);
+					return { content: [{
+						type: "text",
+						text: `Questions sent to user. Their answers will be provided in a follow-up message. You may continue with other work while waiting.`
+					}] };
+				} catch (error$1) {
+					return {
+						content: [{
+							type: "text",
+							text: `Error: ${error$1.message}`
+						}],
+						isError: true
+					};
+				}
 			})
 		]
 	});
@@ -2882,7 +3098,6 @@ var Task = class {
 	heartbeatInterval = null;
 	pendingAcks = /* @__PURE__ */ new Map();
 	pendingPermissions = /* @__PURE__ */ new Map();
-	pendingQuestions = /* @__PURE__ */ new Map();
 	tunnels = /* @__PURE__ */ new Map();
 	proxies = /* @__PURE__ */ new Map();
 	primaryTunnelHost = null;
@@ -3057,10 +3272,6 @@ var Task = class {
 						this.handleToolPermissionResponse(inputMessage.payload);
 						continue;
 					}
-					if (inputMessage.type === "user_question_response") {
-						this.handleUserQuestionResponse(inputMessage.payload);
-						continue;
-					}
 					if (this.status !== "idle") {
 						this.debugLog(`Queueing message (status: ${this.status}): ${inputMessage.type}`);
 						this.queuedMessages.push(inputMessage);
@@ -3115,43 +3326,21 @@ var Task = class {
 		return approved;
 	}
 	/**
-	* Request user to answer questions. Returns promise that resolves to { questions, answers } or null.
-	* Auto-denies (returns null) after 60 seconds if no response received.
+	* Send user questions to the server (non-blocking).
+	* Answers will come back as a user message via promptSendToRunner.
 	*/
-	async requestUserQuestions(input) {
+	sendUserQuestionRequest(questions) {
 		const requestId = crypto.randomUUID();
-		const TIMEOUT_MS = 6e4 * 60 * 24;
-		const questionPromise = new Promise((resolve) => {
-			const timeout = setTimeout(() => {
-				this.debugLog(`User question request ${requestId} timed out (24h)`);
-				this.pendingQuestions.delete(requestId);
-				resolve(null);
-			}, TIMEOUT_MS);
-			this.pendingQuestions.set(requestId, {
-				resolve,
-				timeout
-			});
-		});
 		this.sendToTaskRunner({
 			type: "user_question_request",
 			payload: {
 				requestId,
 				sessionId: this.ctx.sessionId,
-				questions: input.questions,
-				expiresAt: new Date(Date.now() + TIMEOUT_MS).toISOString()
+				questions,
+				expiresAt: new Date(Date.now() + 6e4 * 60 * 24).toISOString()
 			}
 		});
-		this.debugLog(`Waiting for user to answer ${input.questions.length} question(s)...`);
-		const answers = await questionPromise;
-		if (!answers) {
-			this.debugLog(`User did not answer questions in time`);
-			return null;
-		}
-		this.debugLog(`User answered questions`);
-		return {
-			questions: input.questions,
-			answers
-		};
+		this.debugLog(`Sent ${questions.length} question(s) to user (requestId: ${requestId})`);
 	}
 	/**
 	* Handle tool permission response from runner
@@ -3167,20 +3356,6 @@ var Task = class {
 		pending.resolve(payload.approved);
 		this.pendingPermissions.delete(payload.requestId);
 	}
-	/**
-	* Handle user question response from runner
-	*/
-	handleUserQuestionResponse(payload) {
-		const pending = this.pendingQuestions.get(payload.requestId);
-		if (!pending) {
-			this.debugLog(`Received question response for unknown request: ${payload.requestId}`);
-			return;
-		}
-		this.updateLastActivity();
-		clearTimeout(pending.timeout);
-		pending.resolve(payload.answers);
-		this.pendingQuestions.delete(payload.requestId);
-	}
 	processMessage(inputMessage) {
 		this.updateLastActivity();
 		switch (inputMessage.type) {
@@ -3193,9 +3368,6 @@ var Task = class {
 			case "tool_permission_response":
 				this.handleToolPermissionResponse(inputMessage.payload);
 				break;
-			case "user_question_response":
-				this.handleUserQuestionResponse(inputMessage.payload);
-				break;
 		}
 	}
 	processQueuedMessages() {
@@ -3732,6 +3904,17 @@ Host gitlab.com
 		this.claudeAbortController = null;
 		this.sendStatusUpdate("idle");
 	}
+	reportUsage(message) {
+		if (!("total_cost_usd" in message)) return;
+		this.sendToTaskRunner({
+			type: "usage",
+			payload: { usage: {
+				total_cost_usd: message.total_cost_usd,
+				total_input_tokens: message.usage.input_tokens,
+				total_output_tokens: message.usage.output_tokens
+			} }
+		});
+	}
 	async queryClaude(prompt, mode = "BYPASS_PERMISSIONS") {
 		if (this.status !== "idle") {
 			this.debugLog(`WARNING: queryClaude called while status is '${this.status}'`);
@@ -3750,7 +3933,7 @@ Host gitlab.com
 				permissionMode: mode,
 				task: this
 			});
-			for await (const _message of result);
+			for await (const message of result) if (message.type === "result") this.reportUsage(message);
 			const finalLines = await this.readNewSessionLines();
 			for (const line of finalLines) try {
 				const parsed = JSON.parse(line);
@@ -4139,7 +4322,7 @@ async function installServiceCommand() {
 	console.log(chalk.bold("\nJive Task Runner Service Installation"));
 	console.log(chalk.dim("=========================================\n"));
 	try {
-		const { getServiceManager, validateServiceInstallation, detectPlatform } = await import("./service-4H4YceKv.mjs");
+		const { getServiceManager, validateServiceInstallation, detectPlatform } = await import("./service-MMjLsA9C.mjs");
 		if (detectPlatform() === "unsupported") {
 			console.error(chalk.red("Service installation is not supported on this platform."));
 			console.log(chalk.dim("\nCurrently supported platforms:"));
@@ -4171,7 +4354,8 @@ async function installServiceCommand() {
 		}
 		if (validation.hasWarnings) console.log(chalk.yellow("\n⚠ Installation can proceed, but there are warnings."));
 		console.log(chalk.dim(`\nPlatform: Linux (systemd)`));
-		console.log(chalk.dim(`Service file: ~/.config/systemd/user/jive-task-runner.service\n`));
+		console.log(chalk.dim(`Service file: /etc/systemd/system/jive-task-runner.service`));
+		console.log(chalk.dim(`Credentials: /etc/jive/runner.env\n`));
 		const { confirm } = await prompts({
 			type: "confirm",
 			name: "confirm",
@@ -4182,8 +4366,9 @@ async function installServiceCommand() {
 			console.log(chalk.yellow("Installation cancelled"));
 			return;
 		}
-		spinner.start("Creating service file...");
 		const manager = getServiceManager();
+		await manager.checkAndMigrateLegacyService();
+		spinner.start("Creating service file...");
 		await manager.install();
 		spinner.succeed("Service installed successfully!");
 		const { startNow } = await prompts({
@@ -4201,9 +4386,10 @@ async function installServiceCommand() {
 			if (status.uptime) console.log(chalk.dim(`Uptime: ${status.uptime}`));
 		}
 		console.log(chalk.bold("\nNext steps:"));
-		console.log(chalk.dim("  • View logs:    ") + chalk.cyan("jive task-runner service-logs"));
-		console.log(chalk.dim("  • Check status: ") + chalk.cyan("jive task-runner service-status"));
-		console.log(chalk.dim("  • Restart:      ") + chalk.cyan("jive task-runner service-restart"));
+		console.log(chalk.dim("  • View logs:    ") + chalk.cyan("journalctl -u jive-task-runner -f"));
+		console.log(chalk.dim("  • Check status: ") + chalk.cyan("systemctl status jive-task-runner"));
+		console.log(chalk.dim("  • Restart:      ") + chalk.cyan("sudo systemctl restart jive-task-runner"));
+		console.log(chalk.dim("  • Uninstall:    ") + chalk.cyan("jive task-runner uninstall-service"));
 	} catch (error$1) {
 		console.error(chalk.red(`\n✗ Installation failed: ${error$1.message}`));
 		process.exit(1);
@@ -4214,7 +4400,7 @@ async function installServiceCommand() {
 */
 async function uninstallServiceCommand() {
 	try {
-		const { getServiceManager } = await import("./service-4H4YceKv.mjs");
+		const { getServiceManager } = await import("./service-MMjLsA9C.mjs");
 		const manager = getServiceManager();
 		if (!await manager.isInstalled()) {
 			console.log(chalk.yellow("Service is not installed."));
@@ -4244,7 +4430,7 @@ async function uninstallServiceCommand() {
 */
 async function serviceStatusCommand() {
 	try {
-		const { getServiceManager } = await import("./service-4H4YceKv.mjs");
+		const { getServiceManager } = await import("./service-MMjLsA9C.mjs");
 		const manager = getServiceManager();
 		if (!await manager.isInstalled()) {
 			console.log(chalk.dim("Service is not installed."));
@@ -4276,10 +4462,10 @@ async function serviceStatusCommand() {
 		}
 		console.log(chalk.bold("\nCommands:"));
 		console.log(chalk.dim("─".repeat(60)));
-		console.log(chalk.dim("  Logs:      ") + chalk.cyan("jive task-runner service-logs [-f]"));
-		console.log(chalk.dim("  Restart:   ") + chalk.cyan("jive task-runner service-restart"));
-		if (status.running) console.log(chalk.dim("  Stop:      ") + chalk.cyan("systemctl --user stop jive-task-runner"));
-		else console.log(chalk.dim("  Start:     ") + chalk.cyan("systemctl --user start jive-task-runner"));
+		console.log(chalk.dim("  Logs:      ") + chalk.cyan("journalctl -u jive-task-runner -f"));
+		console.log(chalk.dim("  Restart:   ") + chalk.cyan("sudo systemctl restart jive-task-runner"));
+		if (status.running) console.log(chalk.dim("  Stop:      ") + chalk.cyan("sudo systemctl stop jive-task-runner"));
+		else console.log(chalk.dim("  Start:     ") + chalk.cyan("sudo systemctl start jive-task-runner"));
 		console.log(chalk.dim("  Uninstall: ") + chalk.cyan("jive task-runner uninstall-service"));
 		console.log();
 	} catch (error$1) {
@@ -4292,7 +4478,7 @@ async function serviceStatusCommand() {
 */
 async function serviceLogsCommand(options) {
 	try {
-		const { getServiceManager } = await import("./service-4H4YceKv.mjs");
+		const { getServiceManager } = await import("./service-MMjLsA9C.mjs");
 		const manager = getServiceManager();
 		if (!await manager.isInstalled()) {
 			console.log(chalk.dim("Service is not installed."));
@@ -4314,7 +4500,7 @@ async function serviceLogsCommand(options) {
 */
 async function serviceRestartCommand() {
 	try {
-		const { getServiceManager } = await import("./service-4H4YceKv.mjs");
+		const { getServiceManager } = await import("./service-MMjLsA9C.mjs");
 		const manager = getServiceManager();
 		if (!await manager.isInstalled()) {
 			console.log(chalk.dim("Service is not installed."));

package/dist/{service-4H4YceKv.mjs → service-MMjLsA9C.mjs}

@@ -2,21 +2,31 @@ import { E as WS_URL, T as GRAPHQL_API_URL, w as API_URL } from "./index.mjs";
 import fs from "fs/promises";
 import path from "path";
 import os from "os";
-import { exec, spawn } from "child_process";
+import { exec, spawn, spawnSync } from "child_process";
 import { promisify } from "util";
 
 //#region src/lib/service/systemd.ts
 const execAsync$1 = promisify(exec);
+const SERVICE_NAME = "jive-task-runner";
+const SYSTEM_SERVICE_PATH = `/etc/systemd/system/${SERVICE_NAME}.service`;
+const USER_SERVICE_DIR = path.join(os.homedir(), ".config", "systemd", "user");
+const LEGACY_USER_SERVICE_PATH = path.join(USER_SERVICE_DIR, `${SERVICE_NAME}.service`);
+const ENV_DIR = "/etc/jive";
+const ENV_FILE_PATH = `${ENV_DIR}/runner.env`;
 const SERVICE_TEMPLATE = `[Unit]
 Description=Jive Task Runner
 Documentation=https://getjive.app/docs
-After=network-online.target
+After=network-online.target docker.service
 Wants=network-online.target
+Requires=docker.service
 
 [Service]
 Type=simple
+User={{SERVICE_USER}}
+Group={{SERVICE_GROUP}}
+WorkingDirectory={{WORKING_DIRECTORY}}
 ExecStart={{JIVE_BINARY_PATH}} task-runner start
-Restart=on-failure
+Restart=always
 RestartSec=30
 TimeoutStartSec=90
 TimeoutStopSec=30
@@ -24,13 +34,10 @@ StartLimitBurst=5
 StartLimitIntervalSec=10m
 KillMode=mixed
 Environment="PATH={{NODE_BIN_PATH}}:/usr/local/bin:/usr/bin:/bin"
-Environment="JIVE_API_KEY={{JIVE_API_KEY}}"
-Environment="ANTHROPIC_API_KEY={{ANTHROPIC_API_KEY}}"
-Environment="JIVE_TEAM_ID={{JIVE_TEAM_ID}}"
-Environment="JIVE_RUNNER_ID={{JIVE_RUNNER_ID}}"
 Environment="JIVE_API_URL={{JIVE_API_URL}}"
 Environment="JIVE_WS_URL={{JIVE_WS_URL}}"
 Environment="JIVE_GRAPHQL_API_URL={{JIVE_GRAPHQL_API_URL}}"
+EnvironmentFile={{ENV_FILE_PATH}}
 
 StandardOutput=journal
 StandardError=journal
@@ -43,16 +50,64 @@ ProtectKernelTunables=true
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
 
 [Install]
-WantedBy=default.target
+WantedBy=multi-user.target
 `;
+/**
+* Check if the current process is running as root (UID 0)
+*/
+function isRunningAsRoot() {
+	return process.getuid?.() === 0;
+}
+/**
+* Re-execute the current command with sudo, preserving PATH and environment.
+* This allows users to just run `jive task-runner install-service` without
+* needing to manually invoke sudo with the correct environment.
+*/
+function reExecWithSudo() {
+	const nodePath = process.execPath;
+	const scriptPath = process.argv[1];
+	const args = process.argv.slice(2);
+	console.log("Root privileges required. Re-running with sudo...\n");
+	const result = spawnSync("sudo", [
+		"--preserve-env=PATH,HOME",
+		`SUDO_USER=${process.env.USER}`,
+		`SUDO_UID=${process.getuid?.() || 1e3}`,
+		`SUDO_GID=${process.getgid?.() || 1e3}`,
+		nodePath,
+		scriptPath,
+		...args
+	], {
+		stdio: "inherit",
+		env: process.env
+	});
+	process.exit(result.status ?? 1);
+}
+/**
+* Get the original user info when running with sudo
+* Returns the user who invoked sudo, not root
+*/
+function getCurrentUser() {
+	return {
+		uid: parseInt(process.env.SUDO_UID || String(process.getuid?.() || 1e3), 10),
+		gid: parseInt(process.env.SUDO_GID || String(process.getgid?.() || 1e3), 10),
+		username: process.env.SUDO_USER || process.env.USER || "jive",
+		homeDir: process.env.SUDO_USER ? `/home/${process.env.SUDO_USER}` : os.homedir()
+	};
+}
 var SystemdServiceManager = class {
-	servicePath;
-	serviceName = "jive-task-runner";
-	constructor() {
-		const homeDir = os.homedir();
-		this.servicePath = path.join(homeDir, ".config", "systemd", "user", `${this.serviceName}.service`);
+	servicePath = SYSTEM_SERVICE_PATH;
+	serviceName = SERVICE_NAME;
+	/**
+	* Check for legacy user service and handle migration.
+	* Call this BEFORE starting any spinners since it may prompt the user.
+	*/
+	async checkAndMigrateLegacyService() {
+		if (!isRunningAsRoot()) reExecWithSudo();
+		await this.migrateFromUserService();
 	}
 	async install() {
+		if (!isRunningAsRoot()) reExecWithSudo();
+		const user = getCurrentUser();
 		const { getRunnerConfig } = await import("./tasks-Py86q1u7.mjs");
 		const { getCredentials } = await import("./config-7rVDmj2u.mjs");
 		const runnerConfig = await getRunnerConfig();
@@ -72,41 +127,86 @@ var SystemdServiceManager = class {
 			if (resolvedPath.includes(pattern)) throw new Error(`Detected unstable path for jive binary: ${resolvedPath}\nThis path contains '${pattern}' which may not persist across reboots.\n\nIf you're using fnm, try:\n  1. Run: fnm exec --using=default -- npm install -g @jive-ai/cli\n  2. Then run install-service again from a fresh terminal`);
 			if (resolvedNodePath.includes(pattern)) throw new Error(`Detected unstable path for node binary: ${resolvedNodePath}\nThis path contains '${pattern}' which may not persist across reboots.\n\nIf you're using fnm, ensure you have a default node version set:\n  fnm default <version>`);
 		}
-		const variables = {
-			JIVE_BINARY_PATH: resolvedPath,
-			NODE_BIN_PATH: nodeBinDir,
+		await this.createEnvironmentFile({
 			JIVE_API_KEY: credentials.token,
 			ANTHROPIC_API_KEY: credentials.anthropicApiKey || "",
 			JIVE_TEAM_ID: runnerConfig.teamId,
-			JIVE_RUNNER_ID: runnerConfig.id.toString(),
+			JIVE_RUNNER_ID: runnerConfig.id.toString()
+		});
+		const variables = {
+			SERVICE_USER: user.username,
+			SERVICE_GROUP: user.username,
+			WORKING_DIRECTORY: user.homeDir,
+			JIVE_BINARY_PATH: resolvedPath,
+			NODE_BIN_PATH: nodeBinDir,
 			JIVE_API_URL: process.env.JIVE_API_URL || API_URL,
 			JIVE_WS_URL: process.env.JIVE_WS_URL || WS_URL,
-			JIVE_GRAPHQL_API_URL: process.env.JIVE_GRAPHQL_API_URL || GRAPHQL_API_URL
+			JIVE_GRAPHQL_API_URL: process.env.JIVE_GRAPHQL_API_URL || GRAPHQL_API_URL,
+			ENV_FILE_PATH
 		};
 		let serviceContent = SERVICE_TEMPLATE;
 		for (const [key, value] of Object.entries(variables)) serviceContent = serviceContent.replace(new RegExp(`{{${key}}}`, "g"), value);
-		const serviceDir = path.dirname(this.servicePath);
-		await fs.mkdir(serviceDir, {
-			recursive: true,
-			mode: 493
-		});
-		const dirMode = (await fs.stat(serviceDir)).mode & 511;
-		if (dirMode > 493) throw new Error(`Systemd user directory has overly permissive permissions: ${dirMode.toString(8)}\nExpected 0755 or stricter. Fix with: chmod 755 ${serviceDir}`);
-		await fs.writeFile(this.servicePath, serviceContent, { mode: 384 });
+		await fs.writeFile(this.servicePath, serviceContent, { mode: 420 });
 		try {
-			await execAsync$1("systemctl --user daemon-reload", { timeout: 3e4 });
-			await execAsync$1(`systemctl --user enable ${this.serviceName}`, { timeout: 3e4 });
+			await execAsync$1("systemctl daemon-reload", { timeout: 3e4 });
+			await execAsync$1(`systemctl enable ${this.serviceName}`, { timeout: 3e4 });
 		} catch (error) {
 			try {
 				await fs.unlink(this.servicePath);
-				await execAsync$1("systemctl --user daemon-reload", { timeout: 3e4 });
+				await fs.unlink(ENV_FILE_PATH);
+				await execAsync$1("systemctl daemon-reload", { timeout: 3e4 });
 			} catch (cleanupError) {
 				console.error("Failed to clean up after installation failure:", cleanupError);
 			}
 			throw new Error(`Service installation failed: ${error.message}\nPartial installation has been rolled back.`);
 		}
 	}
+	/**
+	* Create the environment file with sensitive credentials
+	*/
+	async createEnvironmentFile(vars) {
+		await fs.mkdir(ENV_DIR, {
+			recursive: true,
+			mode: 493
+		});
+		const content = Object.entries(vars).map(([key, value]) => `${key}=${value}`).join("\n") + "\n";
+		await fs.writeFile(ENV_FILE_PATH, content, { mode: 384 });
+	}
+	/**
+	* Check for and migrate from legacy user service
+	*/
+	async migrateFromUserService() {
+		try {
+			await fs.access(LEGACY_USER_SERVICE_PATH);
+		} catch {
+			return;
+		}
+		const { default: prompts } = await import("prompts");
+		console.log("\n⚠  Found existing user service at:");
+		console.log(`   ${LEGACY_USER_SERVICE_PATH}\n`);
+		const { migrate } = await prompts({
+			type: "confirm",
+			name: "migrate",
+			message: "Migrate to system service? (This will remove the old user service)",
+			initial: true
+		});
+		if (!migrate) throw new Error("Migration cancelled. Remove the user service first or choose to migrate.");
+		const user = getCurrentUser();
+		console.log("Stopping and removing legacy user service...");
+		try {
+			await execAsync$1(`sudo -u ${user.username} systemctl --user stop ${this.serviceName}`, { timeout: 3e4 });
+		} catch {}
+		try {
+			await execAsync$1(`sudo -u ${user.username} systemctl --user disable ${this.serviceName}`, { timeout: 3e4 });
+		} catch {}
+		await fs.unlink(LEGACY_USER_SERVICE_PATH);
+		try {
+			await execAsync$1(`sudo -u ${user.username} systemctl --user daemon-reload`, { timeout: 3e4 });
+		} catch {}
+		console.log("Legacy user service removed successfully.\n");
+	}
 	async uninstall() {
+		if (!isRunningAsRoot()) reExecWithSudo();
 		try {
 			await this.stop();
 		} catch (error) {
@@ -114,7 +214,7 @@ var SystemdServiceManager = class {
 			else console.warn(`Warning: Failed to stop service: ${error.message}`);
 		}
 		try {
-			await execAsync$1(`systemctl --user disable ${this.serviceName}`, { timeout: 3e4 });
+			await execAsync$1(`systemctl disable ${this.serviceName}`, { timeout: 3e4 });
 		} catch (error) {
 			if (error.stderr?.includes("No such file") || error.message?.includes("not be found")) {} else if (error.code === "EACCES") console.warn("Warning: Permission denied when disabling service");
 			else console.warn(`Warning: Failed to disable service: ${error.message}`);
@@ -124,16 +224,24 @@ var SystemdServiceManager = class {
 		} catch (error) {
 			if (error.code !== "ENOENT") throw new Error(`Failed to remove service file: ${error.message}`);
 		}
-		await execAsync$1("systemctl --user daemon-reload", { timeout: 3e4 });
+		try {
+			await fs.unlink(ENV_FILE_PATH);
+		} catch (error) {
+			if (error.code !== "ENOENT") console.warn(`Warning: Failed to remove environment file: ${error.message}`);
+		}
+		try {
+			await fs.rmdir(ENV_DIR);
+		} catch {}
+		await execAsync$1("systemctl daemon-reload", { timeout: 3e4 });
 	}
 	async start() {
-		await execAsync$1(`systemctl --user start ${this.serviceName}`, { timeout: 3e4 });
+		await execAsync$1(`systemctl start ${this.serviceName}`, { timeout: 3e4 });
 	}
 	async stop() {
-		await execAsync$1(`systemctl --user stop ${this.serviceName}`, { timeout: 3e4 });
+		await execAsync$1(`systemctl stop ${this.serviceName}`, { timeout: 3e4 });
 	}
 	async restart() {
-		await execAsync$1(`systemctl --user restart ${this.serviceName}`, { timeout: 3e4 });
+		await execAsync$1(`systemctl restart ${this.serviceName}`, { timeout: 3e4 });
 	}
 	async status() {
 		if (!await this.isInstalled()) return {
@@ -142,11 +250,11 @@ var SystemdServiceManager = class {
 			enabled: false
 		};
 		try {
-			const { stdout } = await execAsync$1(`systemctl --user status ${this.serviceName} --no-pager`, { timeout: 3e4 });
+			const { stdout } = await execAsync$1(`systemctl status ${this.serviceName} --no-pager`, { timeout: 3e4 });
 			const running = stdout.includes("Active: active (running)");
 			const pid = this.extractPid(stdout);
 			const uptime = this.extractUptime(stdout);
-			const { stdout: isEnabledOutput } = await execAsync$1(`systemctl --user is-enabled ${this.serviceName}`, { timeout: 3e4 });
+			const { stdout: isEnabledOutput } = await execAsync$1(`systemctl is-enabled ${this.serviceName}`, { timeout: 3e4 });
 			return {
 				installed: true,
 				running,
@@ -155,7 +263,7 @@ var SystemdServiceManager = class {
 				pid
 			};
 		} catch (error) {
-			const { stdout: isEnabledOutput } = await execAsync$1(`systemctl --user is-enabled ${this.serviceName}`, { timeout: 3e4 }).catch(() => ({ stdout: "disabled" }));
+			const { stdout: isEnabledOutput } = await execAsync$1(`systemctl is-enabled ${this.serviceName}`, { timeout: 3e4 }).catch(() => ({ stdout: "disabled" }));
 			return {
 				installed: true,
 				running: false,
@@ -164,11 +272,7 @@ var SystemdServiceManager = class {
 		}
 	}
 	async logs(options) {
-		const args = [
-			"--user",
-			"-u",
-			this.serviceName
-		];
+		const args = ["-u", this.serviceName];
 		if (options?.follow) args.push("-f");
 		if (options?.lines) args.push("-n", options.lines.toString());
 		const logsProcess = spawn("journalctl", args, { stdio: "inherit" });
@@ -240,6 +344,18 @@ async function validateServiceInstallation() {
 	const checks = [];
 	let canInstall = true;
 	let hasWarnings = false;
+	if (!isRunningAsRoot()) {
+		checks.push({
+			name: "Root privileges",
+			status: "warning",
+			message: "Will prompt for sudo password"
+		});
+		hasWarnings = true;
+	} else checks.push({
+		name: "Root privileges",
+		status: "success",
+		message: "Running as root"
+	});
 	try {
 		const { getRunnerConfig } = await import("./tasks-Py86q1u7.mjs");
 		const runnerConfig = await getRunnerConfig();

package/package.json

@@ -1,7 +1,7 @@
 {
   "private": false,
   "name": "@jive-ai/cli",
-  "version": "0.0.45",
+  "version": "0.0.47",
   "main": "index.js",
   "files": [
     "dist",
@@ -15,7 +15,8 @@
     "test": "echo \"Error: no test specified\" && exit 1",
     "typecheck": "tsc --noEmit",
     "build": "tsdown && npm pack && npm install -g jive-ai-cli-*.tgz",
-    "docker:build": "bun run build && .docker/build.sh",
+    "docker:clean": "docker rmi jiveai/task:latest jiveai/task:$npm_package_version",
+    "docker:build": "bun run build && npm run docker:clean && .docker/build.sh",
     "docker:push": ".docker/build.sh --push",
     "prepublishOnly": "npm run typecheck && npm run build"
   },