agent-skillboard 0.2.12 → 0.2.14

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 ## Unreleased
 
+## 0.2.14 — 2026-07-03
+
+### Fixed
+
+- Sudo ownership restoration now only chowns managed guidance paths inside the
+  resolved invoking user's home, avoiding accidental ownership changes for
+  explicit agent roots outside that home.
+
+## 0.2.13 — 2026-07-03
+
+### Fixed
+
+- Sudo-driven setup now restores ownership of managed agent guidance files and
+  directories under the invoking user's home to `SUDO_UID:SUDO_GID`, avoiding
+  root-owned `SKILL.md` files after `sudo npm install -g agent-skillboard`.
+
 ## 0.2.12 — 2026-07-03
 
 ### Changed

package/README.md

@@ -96,8 +96,9 @@ npm install -g agent-skillboard
 If your system npm requires elevated permissions, `sudo npm install -g
 agent-skillboard` is also supported. In that flow, install-time setup resolves
 `SUDO_USER` and writes the user-level guidance skill under the invoking user's
-agent homes, while the `skillboard` binary still lands in the global prefix used
-by that npm command.
+agent homes. Managed guidance files written under the user's home are restored
+to the invoking user's ownership, while the `skillboard` binary still lands in
+the global prefix used by that npm command.
 
 The install-time setup writes a user-level `skillboard` guidance skill under
 detected agent homes. For Codex, detection includes `CODEX_HOME/skills`,

package/docs/install.md

@@ -38,7 +38,9 @@ sudo npm install -g agent-skillboard
 Under sudo, the postinstall setup resolves `SUDO_USER` and targets that user's
 agent homes instead of writing guidance under `/root`. The executable prefix is
 still decided by the npm command you run, so use the same npm/Node environment
-you expect to provide `skillboard` on `PATH`.
+you expect to provide `skillboard` on `PATH`. Managed guidance files and
+directories written under the user's home are restored to the invoking user's
+`SUDO_UID:SUDO_GID` ownership.
 
 The install-time setup writes a user-level SkillBoard guidance skill under
 detected agent homes such as `CODEX_HOME`, `AGENTS_HOME`, `CLAUDE_HOME`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-skillboard",
-  "version": "0.2.12",
+  "version": "0.2.14",
   "description": "Let AI agents pick and use allowed skills in each workflow.",
   "keywords": [
     "ai-agent",

package/src/lifecycle-cli.mjs

@@ -1,5 +1,5 @@
 import { execFile } from "node:child_process";
-import { access, mkdir, readFile, writeFile } from "node:fs/promises";
+import { access, chown, mkdir, readFile, writeFile } from "node:fs/promises";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { createInterface } from "node:readline";
 import { promisify } from "node:util";
@@ -49,7 +49,9 @@ export async function runSetupCommand(options, stdout, runtime = defaultRuntime(
   if (options.get("dir") !== undefined) {
     throw new Error("skillboard setup is agent-layer setup and does not accept --dir");
   }
-  const targets = await agentSetupTargets(options, runtime);
+  const env = runtime.env ?? process.env;
+  const home = await resolveSetupHome(env, runtime);
+  const targets = await agentSetupTargets(options, runtime, home);
   if (targets.length === 0) {
     stdout.write("No supported agent user skill roots were detected.\n");
     stdout.write(`Create a supported agent home or pass --agent ${supportedAgentNames().join(",")} to choose targets.\n`);
@@ -66,7 +68,7 @@ export async function runSetupCommand(options, stdout, runtime = defaultRuntime(
       return 1;
     }
   }
-  const result = await installAgentIntegration(targets);
+  const result = await installAgentIntegration(targets, setupOwnership(env, runtime, home));
   stdout.write("SkillBoard agent integration installed.\n");
   writeList(stdout, "Created", result.created);
   writeList(stdout, "Updated", result.updated);
@@ -219,9 +221,9 @@ function defaultRuntime() {
   };
 }
 
-async function agentSetupTargets(options, runtime) {
+async function agentSetupTargets(options, runtime, setupHome) {
   const env = runtime.env ?? process.env;
-  const home = await resolveSetupHome(env, runtime);
+  const home = setupHome ?? await resolveSetupHome(env, runtime);
   const requested = readCsv(options.get("agent"));
   const supported = new Set(supportedAgentNames());
   const names = requested.length === 0 ? supportedAgentNames() : requested;
@@ -252,6 +254,31 @@ async function resolveSetupHome(env, runtime) {
   return env.HOME ?? env.USERPROFILE;
 }
 
+function setupOwnership(env, runtime, home) {
+  if (process.platform === "win32" || !shouldUseSudoUserHome(env)) {
+    return null;
+  }
+  const uid = parseNonNegativeInteger(env.SUDO_UID);
+  const gid = parseNonNegativeInteger(env.SUDO_GID);
+  if (uid === null || gid === null) {
+    return null;
+  }
+  return {
+    uid,
+    gid,
+    home: resolve(home),
+    chown: runtime.chown ?? chown
+  };
+}
+
+function parseNonNegativeInteger(value) {
+  if (value === undefined || !/^\d+$/.test(value)) {
+    return null;
+  }
+  const parsed = Number(value);
+  return Number.isSafeInteger(parsed) ? parsed : null;
+}
+
 function shouldUseSudoUserHome(env) {
   const sudoUser = nonEmpty(env.SUDO_USER);
   return process.platform !== "win32"
@@ -308,7 +335,7 @@ function nonEmpty(value) {
   return value === undefined || value.trim() === "" ? null : value;
 }
 
-async function installAgentIntegration(targets) {
+async function installAgentIntegration(targets, ownership = null) {
   const created = [];
   const updated = [];
   const unchanged = [];
@@ -331,11 +358,45 @@ async function installAgentIntegration(targets) {
     }
     await mkdir(dirname(target.skillPath), { recursive: true });
     await writeFile(target.skillPath, content, "utf8");
+    await applyOwnership(target.skillPath, ownership);
     (existing === null ? created : updated).push(`${target.agent}:${target.skillPath}`);
   }
   return { created, updated, unchanged, preserved };
 }
 
+async function applyOwnership(path, ownership) {
+  if (ownership === null) {
+    return;
+  }
+  for (const ownedPath of ownershipPaths(path, ownership.home)) {
+    await ownership.chown(ownedPath, ownership.uid, ownership.gid);
+  }
+}
+
+function ownershipPaths(path, home) {
+  const resolvedHome = resolve(home);
+  const resolvedPath = resolve(path);
+  if (!isInside(resolvedPath, resolvedHome)) {
+    return [];
+  }
+  const directories = [];
+  let current = dirname(resolvedPath);
+  while (current !== resolvedHome && isInside(current, resolvedHome)) {
+    directories.push(current);
+    const parent = dirname(current);
+    if (parent === current) {
+      break;
+    }
+    current = parent;
+  }
+  return [...directories.reverse(), resolvedPath];
+}
+
+function isInside(path, parent) {
+  const relativePath = relative(parent, path);
+  return relativePath !== "" && !relativePath.startsWith("..") && !isAbsolute(relativePath);
+}
+
 function agentIntegrationSkill() {
   return `---
 name: skillboard