arisa 2.3.52 → 2.3.53

package/bin/arisa.js

@@ -499,6 +499,45 @@ if (isRoot() && arisaUserExists()) {
   process.umask(0o000);
 }
 
+// Pre-flight: install missing CLIs while still root (before su arisa).
+// arisa user has read+execute but NOT write access to root's bun dir.
+function preflightInstallClis() {
+  const clis = {
+    claude: "@anthropic-ai/claude-code",
+    codex: "@openai/codex",
+  };
+
+  const bunBinDir = join(ROOT_BUN_INSTALL, "bin");
+  const missing = [];
+
+  for (const [name, pkg] of Object.entries(clis)) {
+    if (existsSync(join(bunBinDir, name))) continue;
+    missing.push({ name, pkg });
+  }
+
+  if (missing.length === 0) return;
+
+  process.stdout.write(`[preflight] Installing missing CLIs as root: ${missing.map((m) => m.name).join(", ")}\n`);
+  for (const { name, pkg } of missing) {
+    const result = spawnSync("bun", ["add", "-g", pkg], {
+      stdio: "inherit",
+      timeout: 180000,
+    });
+    if (result.status === 0) {
+      process.stdout.write(`[preflight] ✓ ${name} installed\n`);
+    } else {
+      process.stdout.write(`[preflight] ✗ ${name} install failed\n`);
+    }
+  }
+
+  // Re-grant read+execute access after installing new binaries
+  grantBunAccess();
+}
+
+if (isRoot() && arisaUserExists()) {
+  preflightInstallClis();
+}
+
 // Then fall through to normal daemon startup
 
 // ── Non-root flow (unchanged) ───────────────────────────────────────

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arisa",
-  "version": "2.3.52",
+  "version": "2.3.53",
   "description": "Arisa - dynamic agent runtime with daemon/core architecture that evolves through user interaction",
   "keywords": [
     "tinyclaw",

package/src/daemon/auto-install.ts

@@ -33,13 +33,20 @@ async function installCli(cli: AgentCliName): Promise<boolean> {
   log.info(`Auto-install: installing ${cli} (${pkg})...`);
 
   try {
-    // Install into root's bun (arisa has read+execute access)
     const cmd = ["bun", "add", "-g", pkg];
+    const env = { ...process.env };
+
+    // When not root, BUN_INSTALL may point to root's dir (read-only for us).
+    // Install to user's own bun dir instead.
+    if (!isRunningAsRoot()) {
+      const home = process.env.HOME || "/home/arisa";
+      env.BUN_INSTALL = `${home}/.bun`;
+    }
 
     const proc = Bun.spawn(cmd, {
       stdout: "pipe",
       stderr: "pipe",
-      env: { ...process.env },
+      env,
     });
 
     const timeout = setTimeout(() => proc.kill(), INSTALL_TIMEOUT);

package/src/daemon/setup.ts

@@ -15,7 +15,7 @@ import { existsSync, readFileSync, writeFileSync, mkdirSync } from "fs";
 import { dirname, join } from "path";
 import { dataDir } from "../shared/paths";
 import { secrets, setSecret } from "../shared/secrets";
-import { isAgentCliInstalled, buildBunWrappedAgentCliCommand, type AgentCliName } from "../shared/ai-cli";
+import { isAgentCliInstalled, isRunningAsRoot, buildBunWrappedAgentCliCommand, type AgentCliName } from "../shared/ai-cli";
 
 const ENV_PATH = join(dataDir, ".env");
 
@@ -249,11 +249,20 @@ async function isCliAuthenticated(cli: AgentCliName): Promise<boolean> {
 
 async function installCli(cli: AgentCliName): Promise<boolean> {
   try {
-    // Install into root's bun (arisa has read+execute access)
     const cmd = ["bun", "add", "-g", CLI_PACKAGES[cli]];
+    const env = { ...process.env };
+
+    // When not root, BUN_INSTALL may point to root's dir (read-only for us).
+    // Install to user's own bun dir instead.
+    if (!isRunningAsRoot()) {
+      const home = process.env.HOME || "/home/arisa";
+      env.BUN_INSTALL = `${home}/.bun`;
+    }
+
     const proc = Bun.spawn(cmd, {
       stdout: "inherit",
       stderr: "inherit",
+      env,
     });
     const timeout = setTimeout(() => proc.kill(), 180_000);
     const exitCode = await proc.exited;

package/src/shared/ai-cli.ts

@@ -41,11 +41,13 @@ function cliOverrideEnvVar(cli: AgentCliName): string | undefined {
 }
 
 function candidatePaths(cli: AgentCliName): string[] {
+  const arisaBunBin = `${ARISA_HOME}/.bun/bin`;
+
   if (isRunningAsRoot()) {
-    // When root, CLIs are installed under arisa user's bun
     return unique([
       cliOverrideEnvVar(cli),
       join(ROOT_BUN_BIN, cli),
+      join(arisaBunBin, cli),
     ]);
   }
 
@@ -61,6 +63,7 @@ function candidatePaths(cli: AgentCliName): string[] {
   return unique([
     cliOverrideEnvVar(cli),
     bunInstall ? join(bunInstall, "bin", cli) : null,
+    join(arisaBunBin, cli),
     join(bunDir, cli),
     fromPath,
     ...fromEnvPath,