@meridiona/meridian 1.9.1 → 1.10.0

package/bin/meridian.js

@@ -35,14 +35,56 @@ function run(file, args) {
   process.exit(r.status == null ? 1 : r.status);
 }
 
+// Is the global npm prefix writable without root? `npm i -g` installs into
+// <prefix>/lib/node_modules; on a /usr/local prefix that needs sudo, on a
+// Homebrew/user prefix it doesn't.
+function npmGlobalWritable() {
+  const r = spawnSync('npm', ['config', 'get', 'prefix'], { encoding: 'utf8' });
+  const prefix = (r.stdout || '').trim();
+  if (!prefix) return true; // unknown — let npm decide
+  try {
+    fs.accessSync(path.join(prefix, 'lib', 'node_modules'), fs.constants.W_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// Update the global package, elevating ONLY this step when the prefix needs
+// root. The rest of `update` (setup: per-user launchd agents, venv) must NOT run
+// as root, so we never sudo the whole command — just this one install.
+function npmInstallLatest() {
+  const args = ['install', '-g', '@meridiona/meridian@latest'];
+  if (npmGlobalWritable()) {
+    return spawnSync('npm', args, { stdio: 'inherit' });
+  }
+  console.error('meridian update: the global npm prefix needs root — elevating just the');
+  console.error('  package install (you may be prompted for your password)…');
+  return spawnSync('sudo', ['npm', ...args], { stdio: 'inherit' });
+}
+
 const cmd = process.argv[2];
 const rest = process.argv.slice(3);
 
+// Every Meridian command is per-user: launchd agents live under gui/$UID and
+// state under ~/.meridian. Running as root (e.g. `sudo meridian update`) makes
+// launchd bootstrap fail ("Domain does not support specified action") and leaves
+// root-owned files behind. Refuse up front — the one step that genuinely needs
+// root (`npm install -g` during `update`) is elevated on its own below.
+if (typeof process.getuid === 'function' && process.getuid() === 0) {
+  console.error('meridian: do not run as root / with sudo.');
+  console.error('  Meridian runs per-user (launchd agents under gui/$UID, files in ~/.meridian);');
+  console.error('  as root, launchd fails and ~/.meridian fills with root-owned files.');
+  console.error(`  Run it as your normal user:  meridian ${cmd || '<command>'}`);
+  console.error('  (`meridian update` elevates just the npm install step if your prefix needs root.)');
+  process.exit(1);
+}
+
 if (cmd === 'setup' || cmd === 'install') {
   const bundle = resolveBundle();
   run('bash', [path.join(bundle, 'scripts', 'meridian-npm-setup.sh'), bundle, ...rest]);
 } else if (cmd === 'update') {
-  const up = spawnSync('npm', ['install', '-g', '@meridiona/meridian@latest'], { stdio: 'inherit' });
+  const up = npmInstallLatest();
   if (up.status) process.exit(up.status);
   const bundle = resolveBundle();
   run('bash', [path.join(bundle, 'scripts', 'meridian-npm-setup.sh'), bundle, '--skip-permissions']);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meridiona/meridian",
-  "version": "1.9.1",
+  "version": "1.10.0",
   "description": "Your project management, written by your work — local-first PM automation from real dev activity (macOS, Apple Silicon).",
   "homepage": "https://github.com/Meridiona/meridian",
   "repository": {
@@ -24,7 +24,7 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@meridiona/meridian-darwin-arm64": "1.9.1"
+    "@meridiona/meridian-darwin-arm64": "1.10.0"
   },
   "publishConfig": {
     "access": "public"