@oaklandzoo/ostup 0.9.0 → 0.9.1

package/README.md

@@ -199,6 +199,7 @@ you do not have to repeat them every session.
 | Beginner installer failed | The bash and PowerShell installers log to `~/.ostup/logs/install-*.log`. The ostup CLI logs to `~/.ostup/logs/init-*.log`. Open the most recent log for the failing command's stderr. |
 | "BOOTSTRAP_FAILED: Homebrew missing" | You ran `npx ostup init` on a Mac without Homebrew. Run the Mac beginner installer at the top of this README instead. |
 | "BOOTSTRAP_FAILED: WinGet missing" | Update App Installer from the Microsoft Store: `ms-windows-store://pdp/?productid=9NBLGGH4NNS1`. |
+| "/opt/homebrew/Cellar is not writable" | You are on a shared Mac where Homebrew was installed by another user. 0.9.1+ handles this automatically by installing `gh` to `~/.local/bin/` and routing `vercel` through `~/.npm-global/`. If you saw this error, you are on 0.9.0; upgrade with `npx @oaklandzoo/ostup@latest`. |
 
 ## Advanced: API tokens instead of interactive login
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oaklandzoo/ostup",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "Scaffolds a new repo with the Ostup Agent Kit pre-installed: slash commands, doc templates, and a clean working state.",
   "type": "module",
   "bin": {

package/src/bootstrap.mjs

@@ -6,6 +6,9 @@
 import * as p from '@clack/prompts';
 import { execSync } from 'node:child_process';
 import { homedir } from 'node:os';
+import { existsSync, constants as fsConstants } from 'node:fs';
+import { access, readFile, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
 import { detectAll, installCommandFor } from './tool-registry.mjs';
 import { run as exec } from './exec.mjs';
 
@@ -55,6 +58,114 @@ function patchPathFor(plan) {
   process.env.PATH = toAdd.join(sep) + sep + (process.env.PATH || '');
 }
 
+// --- darwin multi-user helpers ----------------------------------------------
+// On a Mac where Homebrew was installed by a different user (shared / refurbished /
+// family Mac), the current user can READ /opt/homebrew/ (so detection passes) but
+// cannot WRITE to it (so `brew install gh` fails). Same applies to npm's global
+// prefix which lives under brew. These helpers detect that state and switch to
+// user-local install strategies that don't need sudo or admin handoff.
+
+async function isPathWritable(path) {
+  try {
+    await access(path, fsConstants.W_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function checkBrewWritable() {
+  for (const cellar of ['/opt/homebrew/Cellar', '/usr/local/Cellar']) {
+    if (existsSync(cellar)) {
+      return { exists: true, writable: await isPathWritable(cellar), cellar };
+    }
+  }
+  return { exists: false, writable: false, cellar: null };
+}
+
+async function checkNpmGlobalWritable() {
+  let prefix = null;
+  try {
+    prefix = execSync('npm prefix -g', { stdio: ['ignore', 'pipe', 'ignore'] }).toString().trim();
+  } catch {
+    return { prefix: null, writable: false };
+  }
+  if (!prefix) return { prefix: null, writable: false };
+  return { prefix, writable: await isPathWritable(prefix) };
+}
+
+async function appendToZshrcIfMissing(line) {
+  const zshrc = join(homedir(), '.zshrc');
+  try {
+    const body = existsSync(zshrc) ? await readFile(zshrc, 'utf8') : '';
+    if (body.includes(line)) return false;
+    const sep = body.length === 0 || body.endsWith('\n') ? '' : '\n';
+    await writeFile(zshrc, body + sep + line + '\n');
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function prependToProcessPath(dir) {
+  const sep = process.platform === 'win32' ? ';' : ':';
+  const parts = (process.env.PATH || '').split(sep);
+  if (parts.includes(dir)) return;
+  process.env.PATH = dir + sep + (process.env.PATH || '');
+}
+
+async function fetchLatestGhVersion() {
+  try {
+    const out = execSync(
+      'curl -fsSL https://api.github.com/repos/cli/cli/releases/latest',
+      { stdio: ['ignore', 'pipe', 'ignore'] }
+    ).toString();
+    const m = out.match(/"tag_name"\s*:\s*"v([0-9]+\.[0-9]+\.[0-9]+)"/);
+    return m ? m[1] : null;
+  } catch {
+    return null;
+  }
+}
+
+async function installGhBinaryDirect() {
+  // Multi-user-Mac fallback: download gh from its GitHub release tarball into
+  // ~/.local/bin/gh. No brew, no sudo, no admin handoff. Patches PATH for the
+  // current process and appends an export line to ~/.zshrc for future shells.
+  const home = homedir();
+  const binDir = join(home, '.local', 'bin');
+  const arch = process.arch === 'arm64' ? 'macOS_arm64' : 'macOS_amd64';
+  const version = (await fetchLatestGhVersion()) || '2.82.1';
+  const url = `https://github.com/cli/cli/releases/download/v${version}/gh_${version}_${arch}.tar.gz`;
+
+  const installScript = [
+    'set -euo pipefail',
+    `mkdir -p "${binDir}"`,
+    'tmp=$(mktemp -d)',
+    'cd "$tmp"',
+    `curl -fL -o gh.tar.gz "${url}"`,
+    'tar -xzf gh.tar.gz',
+    `cp gh_${version}_${arch}/bin/gh "${binDir}/gh"`,
+    `chmod +x "${binDir}/gh"`,
+    'rm -rf "$tmp"',
+  ].join('\n');
+
+  await exec('bootstrap-gh-direct', 'bash', ['-c', installScript], { stdio: 'inherit' });
+  prependToProcessPath(binDir);
+  await appendToZshrcIfMissing(`export PATH="${binDir}:$PATH"`);
+}
+
+async function setupUserNpmPrefix() {
+  // Multi-user-Mac fallback: route `npm install -g` into ~/.npm-global so the
+  // current user owns the directory and doesn't need write access to brew's
+  // npm prefix.
+  const home = homedir();
+  const prefix = join(home, '.npm-global');
+  const binDir = join(prefix, 'bin');
+  await exec('bootstrap-npm-prefix', 'npm', ['config', 'set', 'prefix', prefix], { stdio: 'inherit' });
+  prependToProcessPath(binDir);
+  await appendToZshrcIfMissing(`export PATH="${binDir}:$PATH"`);
+}
+
 function checkInstallPrerequisites(missing, hasOnPath, platform) {
   const reasons = [];
   for (const m of missing) {
@@ -167,10 +278,45 @@ export async function runBootstrap({
     }
   }
 
+  // On darwin: detect multi-user-Mac scenario (brew owned by another user) and
+  // switch to user-local install strategies before running the loop. Skip when
+  // running under an injected hasOnPath (tests use platform-agnostic flows).
+  const useUserGhFallback = new Set();
+  let needsUserNpmPrefix = false;
+  if (platform === 'darwin' && hasOnPath === defaultHasOnPath) {
+    const brewMissing = missing.filter((m) => installCommandFor(m.tool, platform).kind === 'brew');
+    const npmgMissing = missing.filter((m) => installCommandFor(m.tool, platform).kind === 'npm-g');
+    if (brewMissing.length > 0) {
+      const brewState = await checkBrewWritable();
+      if (brewState.exists && !brewState.writable) {
+        process.stdout.write('\n[bootstrap] Homebrew is installed but owned by another user.\n');
+        process.stdout.write('[bootstrap] Switching to user-local install for brew-managed tools (no sudo, no admin handoff).\n\n');
+        for (const m of brewMissing) {
+          if (m.tool.id === 'gh') useUserGhFallback.add(m.tool.id);
+        }
+      }
+    }
+    if (npmgMissing.length > 0) {
+      const npmState = await checkNpmGlobalWritable();
+      if (!npmState.writable) {
+        process.stdout.write('[bootstrap] npm global prefix is not writable by this user. Setting up ~/.npm-global as a per-user prefix.\n\n');
+        needsUserNpmPrefix = true;
+      }
+    }
+  }
+  if (needsUserNpmPrefix) {
+    await setupUserNpmPrefix();
+  }
+
   // Run installs sequentially. stdio: 'inherit' so sudo/UAC prompts, progress bars, and
   // any interactive winget/brew confirmations reach the user's terminal.
   const installed = [];
   for (const m of missing) {
+    if (useUserGhFallback.has(m.tool.id)) {
+      await installGhBinaryDirect();
+      installed.push(m.tool.id);
+      continue;
+    }
     const plan = installCommandFor(m.tool, platform);
     await exec(`bootstrap-${m.tool.id}`, plan.cmd, plan.args || [], {
       stdio: 'inherit',