arisa 5.1.9 → 5.1.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arisa",
-  "version": "5.1.9",
+  "version": "5.1.11",
   "description": "Telegram + Pi Agent modular assistant",
   "type": "module",
   "main": "src/index.js",

package/src/runtime/slave-cli.js

@@ -1,8 +1,6 @@
 import { spawn } from "node:child_process";
 import { access, mkdir, readFile, readdir, writeFile } from "node:fs/promises";
 import path from "node:path";
-import readline from "node:readline/promises";
-import { stdin, stdout } from "node:process";
 import { applyConfigDefaults } from "../core/config/config-defaults.js";
 import { installLockedOfficialTool } from "../core/tools/official-tool-installer.js";
 import { createHeadlessApp } from "./create-headless-app.js";
@@ -100,15 +98,6 @@ export async function invokeSlaveTool(paths, args, { run = runProcess } = {}) {
   });
 }
 
-async function askFromTerminal(prompt) {
-  const terminal = readline.createInterface({ input: stdin, output: stdout });
-  try {
-    return await terminal.question(`${prompt}: `);
-  } finally {
-    terminal.close();
-  }
-}
-
 async function listSlaveTools(paths) {
   const entries = await readdir(paths.toolsDir, { withFileTypes: true }).catch(() => []);
   const tools = [];
@@ -165,9 +154,16 @@ export function formatSlaveStatus({ systemd, diagnostic }) {
   ].join("\n");
 }
 
+function explainSlaveBootstrapError(error) {
+  if (error?.message !== "Socket closed before the protocol completed") return error;
+  return new Error(
+    "Master ended the pairing handshake before it completed. The bootstrap URL may be expired, rotated, already used, or invalid. Generate a new bootstrap URL on Master and retry before it expires.",
+    { cause: error }
+  );
+}
+
 export async function runSlaveBootstrap(url, {
   paths = getSlavePaths(resolveSlaveHome()),
-  ask = askFromTerminal,
   selectAccount = selectSlaveServiceAccount,
   ensureTool = ensureMasterSlaveTool,
   installService = installSlaveSystemdService,
@@ -178,14 +174,19 @@ export async function runSlaveBootstrap(url, {
 } = {}) {
   parseSlaveBootstrapUrl(url);
   if (platform !== "linux") throw new Error("Arisa Slave service installation currently requires Linux with systemd");
-  const account = await selectAccount({ ask });
+  const account = await selectAccount();
   await ensureSlaveConfig(paths);
   await ensureTool(paths);
-  const result = await withSecureRequestFile({
-    directory: paths.tmpDir,
-    prefix: "bootstrap",
-    value: { url }
-  }, (bootstrapFile) => invokeTool(paths, { action: "slave.bootstrap", bootstrapFile }));
+  let result;
+  try {
+    result = await withSecureRequestFile({
+      directory: paths.tmpDir,
+      prefix: "bootstrap",
+      value: { url }
+    }, (bootstrapFile) => invokeTool(paths, { action: "slave.bootstrap", bootstrapFile }));
+  } catch (error) {
+    throw explainSlaveBootstrapError(error);
+  }
   await installService({ account, slaveHome: paths.home, entryFile });
   await writeSlaveServiceDescriptor(paths, { version: 1, account, installedAt: new Date().toISOString() });
   output.log(`Arisa Slave paired and running as ${account.user}${account.root ? " (root)" : ""}.`);

package/src/runtime/slave-service.js

@@ -39,29 +39,13 @@ export function getSlavePaths(slaveHome) {
 export async function selectSlaveServiceAccount({
   euid = process.geteuid?.(),
   currentUser = os.userInfo().username,
-  ask
+  environment = process.env
 } = {}) {
   if (euid !== 0) {
     return { scope: "user", user: requireAccountName(currentUser), root: false, dedicated: false };
   }
-  if (typeof ask !== "function") throw new Error("Running Arisa Slave as UID 0 requires an explicit account selection");
-  const choice = String(await ask([
-    "Run Arisa Slave as:",
-    "1. dedicated user arisa-slave (recommended)",
-    "2. another existing user",
-    "3. root",
-    "Selection"
-  ].join("\n"))).trim();
-  if (choice === "1") return { scope: "system", user: "arisa-slave", root: false, dedicated: true };
-  if (choice === "2") {
-    return { scope: "system", user: requireAccountName(await ask("Existing service user")), root: false, dedicated: false };
-  }
-  if (choice === "3") {
-    const confirmation = String(await ask("Type RUN AS ROOT to confirm full root authority")).trim();
-    if (confirmation !== "RUN AS ROOT") throw new Error("Root execution was not confirmed");
-    return { scope: "system", user: "root", root: true, dedicated: false };
-  }
-  throw new Error("Invalid Arisa Slave service account selection");
+  const user = requireAccountName(environment.SUDO_USER || currentUser);
+  return { scope: "system", user, root: user === "root", dedicated: false };
 }
 
 function quoteSystemd(value) {
@@ -166,7 +150,8 @@ export async function installSlaveSystemdService({
   }
   const systemctlArgs = account.scope === "user" ? ["--user"] : [];
   await execute("systemctl", [...systemctlArgs, "daemon-reload"], { env: environment });
-  await execute("systemctl", [...systemctlArgs, "enable", "--now", slaveServiceName], { env: environment });
+  await execute("systemctl", [...systemctlArgs, "enable", slaveServiceName], { env: environment });
+  await execute("systemctl", [...systemctlArgs, "restart", slaveServiceName], { env: environment });
   return { unitFile, serviceName: slaveServiceName, account, paths };
 }
 

package/test/slave-cli.test.js

@@ -58,16 +58,21 @@ test("hands one-shot requests through a 0600 file and removes it", async (t) =>
   await assert.rejects(() => access(handedFile), { code: "ENOENT" });
 });
 
-test("never selects root without an explicit second confirmation", async () => {
-  await assert.rejects(() => selectSlaveServiceAccount({ euid: 0 }), /explicit account selection/);
-  const rejectedAnswers = ["3", "yes"];
-  await assert.rejects(
-    () => selectSlaveServiceAccount({ euid: 0, ask: async () => rejectedAnswers.shift() }),
-    /Root execution was not confirmed/
+test("selects the invoking service account without prompting", async () => {
+  assert.deepEqual(
+    await selectSlaveServiceAccount({ euid: 1000, currentUser: "storybot", environment: {} }),
+    { scope: "user", user: "storybot", root: false, dedicated: false }
+  );
+  assert.deepEqual(
+    await selectSlaveServiceAccount({
+      euid: 0,
+      currentUser: "root",
+      environment: { SUDO_USER: "storybot" }
+    }),
+    { scope: "system", user: "storybot", root: false, dedicated: false }
   );
-  const acceptedAnswers = ["3", "RUN AS ROOT"];
   assert.deepEqual(
-    await selectSlaveServiceAccount({ euid: 0, ask: async () => acceptedAnswers.shift() }),
+    await selectSlaveServiceAccount({ euid: 0, currentUser: "root", environment: {} }),
     { scope: "system", user: "root", root: true, dedicated: false }
   );
 });
@@ -109,7 +114,7 @@ test("refuses to replace the PID of an active Slave host", async (t) => {
   await assert.rejects(() => registerSlaveServiceProcess(paths), /already running/);
 });
 
-test("installs the dedicated Linux systemd target without silently selecting root", async (t) => {
+test("installs and restarts the Linux systemd target after pairing", async (t) => {
   const root = await mkdtemp(path.join(os.tmpdir(), "arisa-slave-systemd-"));
   t.after(() => rm(root, { recursive: true, force: true }));
   const calls = [];
@@ -132,7 +137,11 @@ test("installs the dedicated Linux systemd target without silently selecting roo
   assert.equal(result.account.root, false);
   assert.equal(await access(result.unitFile).then(() => true, () => false), true);
   assert.ok(calls.some(([command]) => command === "useradd"));
-  assert.ok(calls.some(([command, args]) => command === "systemctl" && args.includes("enable") && args.includes("--now")));
+  assert.deepEqual(calls.filter(([command]) => command === "systemctl"), [
+    ["systemctl", ["daemon-reload"]],
+    ["systemctl", ["enable", "arisa-slave.service"]],
+    ["systemctl", ["restart", "arisa-slave.service"]]
+  ]);
 });
 
 test("validates before effects and keeps the bootstrap secret out of service metadata", async (t) => {
@@ -144,7 +153,10 @@ test("validates before effects and keeps the bootstrap secret out of service met
     paths,
     entryFile: "/opt/arisa/src/index.js",
     platform: "linux",
-    selectAccount: async () => ({ scope: "user", user: "tester", root: false, dedicated: false }),
+    selectAccount: async (...args) => {
+      assert.deepEqual(args, []);
+      return { scope: "user", user: "tester", root: false, dedicated: false };
+    },
     ensureTool: async () => { calls.push("tool"); },
     installService: async () => { calls.push("service"); },
     invokeTool: async (_paths, args) => {
@@ -176,6 +188,26 @@ test("validates before effects and keeps the bootstrap secret out of service met
   assert.deepEqual(calls, []);
 });
 
+test("explains an incomplete Master pairing handshake", async (t) => {
+  const home = await mkdtemp(path.join(os.tmpdir(), "arisa-slave-handshake-"));
+  t.after(() => rm(home, { recursive: true, force: true }));
+  await assert.rejects(
+    () => runSlaveBootstrap(`tcp://198.51.100.12:4719/${secret}`, {
+      paths: getSlavePaths(home),
+      entryFile: "/opt/arisa/src/index.js",
+      platform: "linux",
+      selectAccount: async () => ({ scope: "user", user: "tester", root: false, dedicated: false }),
+      ensureTool: async () => {},
+      installService: async () => assert.fail("service must not be installed after a failed handshake"),
+      invokeTool: async () => {
+        throw new Error("Socket closed before the protocol completed");
+      },
+      output: { log: () => {} }
+    }),
+    /bootstrap URL may be expired, rotated, already used, or invalid.*before it expires/i
+  );
+});
+
 test("ships an immutable verified master-slave bootstrap lock", async (t) => {
   const home = await mkdtemp(path.join(os.tmpdir(), "arisa-slave-lock-"));
   t.after(() => rm(home, { recursive: true, force: true }));