arisa 2.3.17 → 2.3.19

package/bin/arisa.js

@@ -428,7 +428,7 @@ const ARISA_BUN_ENV = 'export BUN_INSTALL=/home/arisa/.bun && export PATH=/home/
 function provisionArisaUser() {
   process.stdout.write("Creating user 'arisa' for Claude/Codex CLI execution...\n");
 
-  // 1. Create user
+  // 1. Create user with sudo access
   const useradd = spawnSync("useradd", ["-m", "-s", "/bin/bash", "arisa"], { stdio: "pipe" });
   if (useradd.status !== 0) {
     step(false, `Failed to create user: ${(useradd.stderr || "").toString().trim()}`);
@@ -436,7 +436,16 @@ function provisionArisaUser() {
   }
   step(true, "User arisa created");
 
-  // 2. Install bun for arisa (curl — lightweight, no bun child process)
+  // 2. Grant passwordless sudo (needed for full tool execution in Claude/Codex)
+  try {
+    writeFileSync("/etc/sudoers.d/arisa", "arisa ALL=(ALL) NOPASSWD: ALL\n", { mode: 0o440 });
+    step(true, "Passwordless sudo granted");
+  } catch (e) {
+    // Not fatal — sudo may not be installed in minimal containers
+    step(false, `Sudo setup skipped: ${e.message || e}`);
+  }
+
+  // 3. Install bun for arisa (curl — lightweight, no bun child process)
   process.stdout.write("  Installing bun for arisa (this may take a minute)...\n");
   const bunInstall = spawnSync("su", ["-", "arisa", "-c", "curl -fsSL https://bun.sh/install | bash"], {
     stdio: "inherit",
@@ -448,7 +457,7 @@ function provisionArisaUser() {
   }
   step(true, "Bun installed for arisa");
 
-  // 3. Write ink-shim for non-TTY execution (prevents Ink setRawMode crash)
+  // 4. Write ink-shim for non-TTY execution (prevents Ink setRawMode crash)
   const shimPath = "/home/arisa/.arisa-ink-shim.js";
   writeFileSync(shimPath, 'if(process.stdin&&!process.stdin.isTTY){process.stdin.setRawMode=()=>process.stdin;process.stdin.isTTY=true;}\n');
   spawnSync("chown", ["arisa:arisa", shimPath], { stdio: "ignore" });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arisa",
-  "version": "2.3.17",
+  "version": "2.3.19",
   "description": "Arisa - dynamic agent runtime with daemon/core architecture that evolves through user interaction",
   "keywords": [
     "tinyclaw",

package/scripts/dump-commands.ts

@@ -0,0 +1,26 @@
+#!/usr/bin/env bun
+/**
+ * Diagnostic: prints the exact su/bun commands that Arisa would execute,
+ * ready to copy-paste into a terminal.
+ */
+import { buildBunWrappedAgentCliCommand } from "../src/shared/ai-cli";
+
+function printable(cmd: string[]): string {
+  if (cmd[0] === "su") {
+    // cmd = ["su", "arisa", "-s", "/bin/bash", "-c", "<bash script>"]
+    // Wrap the -c argument in double quotes — safe because shellEscape only uses single quotes
+    return `${cmd.slice(0, 5).join(" ")} "${cmd[5]}"`;
+  }
+  // Non-root: just join, quoting args with spaces
+  return cmd.map(c => /[\s']/.test(c) ? `"${c}"` : c).join(" ");
+}
+
+const probeArgs = ["-p", "say ok", "--model", "haiku", "--output-format", "text", "--dangerously-skip-permissions"];
+const processorArgs = ["--dangerously-skip-permissions", "--output-format", "text", "--model", "claude-sonnet-4-20250514", "-p", "hello test"];
+
+console.log("=== AUTH PROBE (daemon/auto-install.ts) ===\n");
+console.log(printable(buildBunWrappedAgentCliCommand("claude", probeArgs)));
+
+console.log("\n\n=== MESSAGE PROCESSOR (core/processor.ts) ===\n");
+console.log(printable(buildBunWrappedAgentCliCommand("claude", processorArgs)));
+console.log();

package/src/core/media.ts

@@ -60,7 +60,7 @@ export async function transcribeAudio(base64: string, filename: string): Promise
     const file = Bun.file(tempPath);
     const transcription = await client.audio.transcriptions.create({
       file: file,
-      model: "whisper-1",
+      model: "gpt-4o-mini-transcribe",
     });
     log.info(`Transcribed audio: "${transcription.text.substring(0, 80)}..."`);
     return transcription.text;

package/src/core/processor.ts

@@ -142,10 +142,11 @@ async function runClaude(message: string, chatId: string): Promise<string> {
   log.info(
     `Claude send | promptChars: ${prompt.length} | preview: ${previewPrompt(prompt)}`
   );
-  log.info(`Claude spawn | cmd: claude --dangerously-skip-permissions --model ${model.model} -p <prompt>`);
+  const spawnCmd = buildBunWrappedAgentCliCommand("claude", args);
+  log.info(`Claude spawn cmd (${spawnCmd.length} parts):\n${spawnCmd.map((c, i) => `  [${i}] ${c}`).join("\n")}`);
   log.debug(`Claude prompt >>>>\n${prompt}\n<<<<`);
 
-  const proc = Bun.spawn(buildBunWrappedAgentCliCommand("claude", args), {
+  const proc = Bun.spawn(spawnCmd, {
     cwd: config.projectDir,
     stdin: "pipe",
     stdout: "pipe",
@@ -212,14 +213,11 @@ export async function processWithCodex(message: string): Promise<string> {
   log.info(
     `Codex send | promptChars: ${message.length} | preview: ${previewPrompt(message)}`
   );
-  log.info(
-    `Codex spawn | cmd: codex ${continueFlag
-      ? "exec resume --last --dangerously-bypass-approvals-and-sandbox <prompt>"
-      : `exec --dangerously-bypass-approvals-and-sandbox -C ${config.projectDir} <prompt>`}`
-  );
+  const spawnCmd = buildBunWrappedAgentCliCommand("codex", args);
+  log.info(`Codex spawn cmd (${spawnCmd.length} parts):\n${spawnCmd.map((c, i) => `  [${i}] ${c}`).join("\n")}`);
   log.debug(`Codex prompt >>>>\n${message}\n<<<<`);
 
-  const proc = Bun.spawn(buildBunWrappedAgentCliCommand("codex", args), {
+  const proc = Bun.spawn(spawnCmd, {
     cwd: config.projectDir,
     stdout: "pipe",
     stderr: "pipe",

package/src/daemon/auto-install.ts

@@ -10,7 +10,7 @@
  */
 
 import { createLogger } from "../shared/logger";
-import { isAgentCliInstalled, buildBunWrappedAgentCliCommand, type AgentCliName } from "../shared/ai-cli";
+import { isAgentCliInstalled, isRunningAsRoot, buildBunWrappedAgentCliCommand, type AgentCliName } from "../shared/ai-cli";
 
 const log = createLogger("daemon");
 
@@ -19,6 +19,7 @@ const CLI_PACKAGES: Record<AgentCliName, string> = {
   codex: "@openai/codex",
 };
 
+const ARISA_BUN_ENV = 'export BUN_INSTALL=/home/arisa/.bun && export PATH=/home/arisa/.bun/bin:$PATH';
 const INSTALL_TIMEOUT = 120_000; // 2min
 
 type NotifyFn = (text: string) => Promise<void>;
@@ -33,7 +34,12 @@ async function installCli(cli: AgentCliName): Promise<boolean> {
   log.info(`Auto-install: installing ${cli} (${pkg})...`);
 
   try {
-    const proc = Bun.spawn(["bun", "add", "-g", pkg], {
+    // When running as root, install into arisa user's bun (consistent with setup.ts)
+    const cmd = isRunningAsRoot()
+      ? ["su", "-", "arisa", "-c", `${ARISA_BUN_ENV} && bun add -g ${pkg}`]
+      : ["bun", "add", "-g", pkg];
+
+    const proc = Bun.spawn(cmd, {
       stdout: "pipe",
       stderr: "pipe",
       env: { ...process.env },
@@ -119,7 +125,7 @@ export async function probeCliAuth(): Promise<void> {
         : ["exec", "--dangerously-bypass-approvals-and-sandbox", "echo ok"];
 
       const cmd = buildBunWrappedAgentCliCommand(cli, args);
-      log.info(`Auth probe cmd: ${cmd.map(c => c.length > 80 ? c.slice(0, 80) + "..." : c).join(" ")}`);
+      log.info(`Auth probe cmd (${cmd.length} parts):\n${cmd.map((c, i) => `  [${i}] ${c}`).join("\n")}`);
 
       const proc = Bun.spawn(cmd, {
         stdout: "pipe",

package/src/shared/ai-cli.ts

@@ -100,7 +100,7 @@ export function buildBunWrappedAgentCliCommand(cli: AgentCliName, args: string[]
     // Run as arisa user — Claude CLI refuses to run as root
     const cliPath = resolveAgentCliPath(cli) || join(ARISA_USER_BUN, cli);
     const shimPath = existsSync(ARISA_INK_SHIM) ? ARISA_INK_SHIM : INK_SHIM;
-    const inner = ["bun", "--bun", "--preload", shimPath, cliPath, ...args].map(shellEscape).join(" ");
+    const inner = ["bun", "--bun", shimPath, cliPath, ...args].map(shellEscape).join(" ");
     // su without "-" preserves parent env (tokens, keys); explicit HOME/PATH for arisa
     return ["su", "arisa", "-s", "/bin/bash", "-c", `${ARISA_BUN_ENV} && ${buildEnvExports()}${inner}`];
   }
@@ -111,5 +111,5 @@ export function buildBunWrappedAgentCliCommand(cli: AgentCliName, args: string[]
   }
   // Preload shim that patches process.stdin.setRawMode to prevent Ink crash
   // when running without a TTY (systemd, su -c, etc.)
-  return ["bun", "--bun", "--preload", INK_SHIM, cliPath, ...args];
+  return ["bun", "--bun", INK_SHIM, cliPath, ...args];
 }