arisa 2.3.2 → 2.3.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arisa",
-  "version": "2.3.2",
+  "version": "2.3.4",
   "description": "Arisa - dynamic agent runtime with daemon/core architecture that evolves through user interaction",
   "preferGlobal": true,
   "bin": {

package/src/shared/ai-cli.ts

@@ -1,7 +1,7 @@
 /**
  * @module shared/ai-cli
  * @role Resolve agent CLI binaries and execute them via Bun runtime.
- *       When running as root, wraps calls with su - arisa to satisfy
+ *       When running as root, wraps calls with su arisa to satisfy
  *       Claude CLI's non-root requirement.
  */
 
@@ -12,7 +12,8 @@ export type AgentCliName = "claude" | "codex";
 
 const ARISA_USER_BUN = "/home/arisa/.bun/bin";
 const ARISA_INK_SHIM = "/home/arisa/.arisa-ink-shim.js";
-const ARISA_BUN_ENV = `export BUN_INSTALL=/home/arisa/.bun && export PATH=${ARISA_USER_BUN}:$PATH`;
+const ARISA_HOME = "/home/arisa";
+const ARISA_BUN_ENV = `export HOME=${ARISA_HOME} && export BUN_INSTALL=${ARISA_HOME}/.bun && export PATH=${ARISA_USER_BUN}:$PATH`;
 
 export function isRunningAsRoot(): boolean {
   return process.getuid?.() === 0;
@@ -78,13 +79,30 @@ export function isAgentCliInstalled(cli: AgentCliName): boolean {
 
 const INK_SHIM = join(dirname(new URL(import.meta.url).pathname), "ink-shim.js");
 
+// Env vars that must survive the su - login shell reset
+const PASSTHROUGH_VARS = [
+  "CLAUDE_CODE_OAUTH_TOKEN",
+  "ANTHROPIC_API_KEY",
+  "OPENAI_API_KEY",
+];
+
+function buildEnvExports(): string {
+  const exports: string[] = [];
+  for (const key of PASSTHROUGH_VARS) {
+    const val = process.env[key];
+    if (val) exports.push(`export ${key}=${shellEscape(val)}`);
+  }
+  return exports.length > 0 ? exports.join(" && ") + " && " : "";
+}
+
 export function buildBunWrappedAgentCliCommand(cli: AgentCliName, args: string[]): string[] {
   if (isRunningAsRoot()) {
     // Run as arisa user — Claude CLI refuses to run as root
     const cliPath = resolveAgentCliPath(cli) || join(ARISA_USER_BUN, cli);
     const shimPath = existsSync(ARISA_INK_SHIM) ? ARISA_INK_SHIM : INK_SHIM;
     const inner = ["bun", "--preload", shimPath, cliPath, ...args].map(shellEscape).join(" ");
-    return ["su", "-", "arisa", "-c", `${ARISA_BUN_ENV} && ${inner}`];
+    // su without "-" preserves parent env (tokens, keys); explicit HOME/PATH for arisa
+    return ["su", "arisa", "-s", "/bin/bash", "-c", `${ARISA_BUN_ENV} && ${buildEnvExports()}${inner}`];
   }
 
   const cliPath = resolveAgentCliPath(cli);