arisa 2.3.19 → 2.3.21

package/bin/arisa.js

@@ -11,7 +11,7 @@ const {
   writeFileSync,
 } = require("node:fs");
 const { homedir, platform } = require("node:os");
-const { join, resolve } = require("node:path");
+const { dirname, join, resolve } = require("node:path");
 
 const pkgRoot = resolve(__dirname, "..");
 const daemonEntry = join(pkgRoot, "src", "daemon", "index.ts");
@@ -403,9 +403,9 @@ function printForegroundNotice() {
   process.stdout.write("Use `arisa start` to run it as a background service.\n");
 }
 
-// ── Root: create arisa user for claude/codex execution ──────────────
-// Daemon runs as root. Only claude/codex CLI calls run as user arisa
-// (Claude CLI refuses to run as root). This avoids two heavy bun processes.
+// ── Root: create arisa user for Core process execution ──────────────
+// Daemon runs as root. Core runs as user arisa (Claude CLI refuses root).
+// This means Claude/Codex calls from Core are direct — no su wrapping.
 
 function isRoot() {
   return process.getuid?.() === 0;
@@ -457,20 +457,47 @@ function provisionArisaUser() {
   }
   step(true, "Bun installed for arisa");
 
-  // 4. Write ink-shim for non-TTY execution (prevents Ink setRawMode crash)
-  const shimPath = "/home/arisa/.arisa-ink-shim.js";
-  writeFileSync(shimPath, 'if(process.stdin&&!process.stdin.isTTY){process.stdin.setRawMode=()=>process.stdin;process.stdin.isTTY=true;}\n');
-  spawnSync("chown", ["arisa:arisa", shimPath], { stdio: "ignore" });
-  step(true, "Ink shim installed");
-
-  process.stdout.write("  Done. Claude/Codex will run as user arisa.\n\n");
+  process.stdout.write("  Done. Core will run as arisa; Claude/Codex calls are direct.\n\n");
 }
 
 // Provision arisa user if running as root and not yet done
 if (isRoot() && !isArisaUserProvisioned()) {
   provisionArisaUser();
 }
-// Then fall through to normal daemon startup (as root)
+
+// When root + arisa exists: route all runtime data through arisa's home
+// so Core (running as arisa) and Daemon (root) share the same data dir.
+if (isRoot() && arisaUserExists()) {
+  const arisaDataDir = "/home/arisa/.arisa";
+  const rootDataDir = join("/root", ".arisa");
+
+  // One-time migration from root's data dir
+  if (existsSync(rootDataDir) && !existsSync(arisaDataDir)) {
+    spawnSync("cp", ["-r", rootDataDir, arisaDataDir], { stdio: "ignore" });
+    spawnSync("chown", ["-R", "arisa:arisa", arisaDataDir], { stdio: "ignore" });
+  }
+
+  // Ensure arisa data dir exists with correct ownership
+  if (!existsSync(arisaDataDir)) {
+    mkdirSync(arisaDataDir, { recursive: true });
+    spawnSync("chown", ["-R", "arisa:arisa", arisaDataDir], { stdio: "ignore" });
+  }
+
+  // Ensure arisa can traverse to and read project files.
+  // When installed globally under /root/.bun/..., parent dirs are mode 700.
+  // Add o+x (traverse only, not read) on each ancestor so arisa can reach pkgRoot.
+  let traverseDir = pkgRoot;
+  while (traverseDir !== "/") {
+    spawnSync("chmod", ["o+x", traverseDir], { stdio: "ignore" });
+    traverseDir = dirname(traverseDir);
+  }
+  spawnSync("chmod", ["-R", "o+rX", pkgRoot], { stdio: "ignore" });
+
+  // All processes use arisa's data dir (inherited by Daemon → Core)
+  process.env.ARISA_DATA_DIR = arisaDataDir;
+}
+
+// Then fall through to normal daemon startup
 
 // ── Non-root flow (unchanged) ───────────────────────────────────────
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arisa",
-  "version": "2.3.19",
+  "version": "2.3.21",
   "description": "Arisa - dynamic agent runtime with daemon/core architecture that evolves through user interaction",
   "keywords": [
     "tinyclaw",

package/src/core/index.ts

@@ -84,6 +84,18 @@ const server = await serveWithRetry({
       return Response.json({ status: "ok", timestamp: Date.now() });
     }
 
+    // Save outgoing message records (called by Daemon after sending to Telegram)
+    if (url.pathname === "/record" && req.method === "POST") {
+      try {
+        const record = await req.json();
+        await saveMessageRecord(record);
+        return Response.json({ ok: true });
+      } catch (error) {
+        log.error(`Record save error: ${error}`);
+        return Response.json({ error: "Save failed" }, { status: 500 });
+      }
+    }
+
     if (url.pathname === "/message" && req.method === "POST") {
       try {
         const body = await req.json();

package/src/daemon/index.ts

@@ -38,7 +38,29 @@ const { maybeStartCodexDeviceAuth, setCodexLoginNotify } = await import("./codex
 const { maybeStartClaudeSetupToken, maybeFeedClaudeCode, setClaudeLoginNotify, isClaudeLoginPending } = await import("./claude-login");
 const { autoInstallMissingClis, setAutoInstallNotify, setAuthProbeCallback } = await import("./auto-install");
 const { chunkMessage, markdownToTelegramHtml } = await import("../core/format");
-const { saveMessageRecord } = await import("../shared/db");
+// Message records are saved via Core's /record endpoint to avoid dual-writer
+// conflicts (Daemon and Core sharing the same arisa.json through separate
+// in-memory DeepBase instances would cause one to overwrite the other's data).
+async function saveRecordViaCore(record: {
+  id: string;
+  chatId: string;
+  messageId: number;
+  direction: "in" | "out";
+  sender: string;
+  timestamp: number;
+  text: string;
+}) {
+  try {
+    await fetch("http://localhost/record", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(record),
+      unix: config.coreSocket,
+    } as any);
+  } catch (e) {
+    log.error(`Failed to save record via Core: ${e}`);
+  }
+}
 
 const log = createLogger("daemon");
 
@@ -148,7 +170,7 @@ telegram.onMessage(async (msg) => {
         log.debug(`Sending chunk (${chunk.length} chars) >>>>\n${chunk}\n<<<<`);
         const sentId = await telegram.send(msg.chatId, chunk);
         if (sentId) {
-          saveMessageRecord({
+          saveRecordViaCore({
             id: `${msg.chatId}_${sentId}`,
             chatId: msg.chatId,
             messageId: sentId,
@@ -156,7 +178,7 @@ telegram.onMessage(async (msg) => {
             sender: "Arisa",
             timestamp: Date.now(),
             text: chunk,
-          }).catch((e) => log.error(`Failed to save outgoing message record: ${e}`));
+          });
         }
       }
       sentText = true;
@@ -203,7 +225,7 @@ const pushServer = await serveWithRetry({
         for (const chunk of chunks) {
           const sentId = await telegram.send(body.chatId, chunk);
           if (sentId) {
-            saveMessageRecord({
+            saveRecordViaCore({
               id: `${body.chatId}_${sentId}`,
               chatId: body.chatId,
               messageId: sentId,
@@ -211,7 +233,7 @@ const pushServer = await serveWithRetry({
               sender: "Arisa",
               timestamp: Date.now(),
               text: chunk,
-            }).catch((e) => log.error(`Failed to save outgoing message record: ${e}`));
+            });
           }
         }
 

package/src/daemon/lifecycle.ts

@@ -14,6 +14,7 @@
 import { config } from "../shared/config";
 import { createLogger } from "../shared/logger";
 import { attemptAutoFix } from "./autofix";
+import { isRunningAsRoot } from "../shared/ai-cli";
 import { join } from "path";
 
 const log = createLogger("daemon");
@@ -119,7 +120,20 @@ export function startCore() {
   if (!shouldRun) return;
 
   const coreEntry = join(config.projectDir, "src", "core", "index.ts");
-  log.info(`Starting Core: bun --watch ${coreEntry}`);
+
+  // When root, spawn Core as arisa user so Claude CLI calls work directly
+  // (no su wrapper per invocation). su without "-" preserves parent env
+  // (tokens, ARISA_DATA_DIR, API keys). We only override HOME/BUN/PATH.
+  let cmd: string[];
+  if (isRunningAsRoot()) {
+    const bunEnv = "export HOME=/home/arisa && export BUN_INSTALL=/home/arisa/.bun && export PATH=/home/arisa/.bun/bin:$PATH";
+    const inner = `${bunEnv} && cd ${config.projectDir} && exec bun --watch ${coreEntry}`;
+    cmd = ["su", "arisa", "-s", "/bin/bash", "-c", inner];
+    log.info(`Starting Core as arisa user: bun --watch ${coreEntry}`);
+  } else {
+    cmd = ["bun", "--watch", coreEntry];
+    log.info(`Starting Core: bun --watch ${coreEntry}`);
+  }
 
   if (crashCount > 3) {
     coreState = "down";
@@ -149,7 +163,7 @@ export function startCore() {
     }, 3000);
   }
 
-  coreProcess = Bun.spawn(["bun", "--watch", coreEntry], {
+  coreProcess = Bun.spawn(cmd, {
     cwd: config.projectDir,
     stdout: "pipe",
     stderr: "pipe",

package/src/shared/ai-cli.ts

@@ -11,7 +11,6 @@ import { delimiter, dirname, join } from "path";
 export type AgentCliName = "claude" | "codex";
 
 const ARISA_USER_BUN = "/home/arisa/.bun/bin";
-const ARISA_INK_SHIM = "/home/arisa/.arisa-ink-shim.js";
 const ARISA_HOME = "/home/arisa";
 const ARISA_BUN_ENV = `export HOME=${ARISA_HOME} && export BUN_INSTALL=${ARISA_HOME}/.bun && export PATH=${ARISA_USER_BUN}:$PATH`;
 
@@ -97,10 +96,10 @@ function buildEnvExports(): string {
 
 export function buildBunWrappedAgentCliCommand(cli: AgentCliName, args: string[]): string[] {
   if (isRunningAsRoot()) {
-    // Run as arisa user — Claude CLI refuses to run as root
+    // Run as arisa user — Claude CLI refuses to run as root.
+    // This path is used by Daemon fallback calls; Core runs as arisa directly.
     const cliPath = resolveAgentCliPath(cli) || join(ARISA_USER_BUN, cli);
-    const shimPath = existsSync(ARISA_INK_SHIM) ? ARISA_INK_SHIM : INK_SHIM;
-    const inner = ["bun", "--bun", shimPath, cliPath, ...args].map(shellEscape).join(" ");
+    const inner = ["bun", "--bun", INK_SHIM, cliPath, ...args].map(shellEscape).join(" ");
     // su without "-" preserves parent env (tokens, keys); explicit HOME/PATH for arisa
     return ["su", "arisa", "-s", "/bin/bash", "-c", `${ARISA_BUN_ENV} && ${buildEnvExports()}${inner}`];
   }

package/src/shared/ports.ts

@@ -4,7 +4,7 @@
  * @effects Reads/writes runtime pid files, kills processes via SIGKILL
  */
 
-import { existsSync, readFileSync, readdirSync, writeFileSync, unlinkSync, mkdirSync } from "fs";
+import { existsSync, readFileSync, readdirSync, writeFileSync, unlinkSync, mkdirSync, chmodSync } from "fs";
 import { join, dirname } from "path";
 import { dataDir } from "./paths";
 
@@ -99,7 +99,11 @@ export async function serveWithRetry(
 
   for (let i = 0; i < retries; i++) {
     try {
-      return Bun.serve(options);
+      const server = Bun.serve(options);
+      // Make Unix sockets world-accessible so Core (arisa) and Daemon (root)
+      // can connect to each other's sockets regardless of ownership.
+      if (socketPath) try { chmodSync(socketPath, 0o777); } catch {}
+      return server;
     } catch (e: any) {
       if (e?.code !== "EADDRINUSE" || i === retries - 1) throw e;
       if (socketPath) {