ework-aio 0.1.11 → 0.1.13

package/bin/install.sh

@@ -38,7 +38,10 @@ BOT_NAME="ework-daemon"
 NO_START=0
 ASSUME_YES=0
 NO_RESTART=0
+AS_USER=""
+ALLOW_ROOT=0
 CFG_ARGS=()
+MODE_ARGS=()
 
 usage() {
   cat <<'EOF'
@@ -66,6 +69,10 @@ Install options:
   --bot-name <login>             Bot username (default: ework-daemon)
   --no-start                     Install units but don't start services
   --yes                          Skip all prompts (use generated defaults)
+  --as-user <login>              (sudo only) drop priv: re-exec install as <login>
+                                 after enabling linger. Data + opencode + npm
+                                 resolved under that user's HOME.
+  --allow-root                   (sudo only) override default refuse-on-root
 
 Global options:
   --no-restart                   With `config set`: edit .env but skip the restart
@@ -80,10 +87,19 @@ while [[ $# -gt 0 ]]; do
       MODE="config"
       shift
       # Consume remaining args as config subcommand + its positionals.
+      # Global flags (--data-dir, --user, --system, etc.) are still
+      # respected here so `config set K V --data-dir X` works as expected.
       while [[ $# -gt 0 ]]; do
         case "$1" in
           --no-restart) NO_RESTART=1; shift ;;
           -h|--help) CFG_ARGS=("help"); shift ;;
+          --user)   SCOPENAME="--user"; shift ;;
+          --system) SCOPENAME="--system"; shift ;;
+          --data-dir) DATA_DIR="$2"; shift 2 ;;
+          --port)   WORK_PORT="$2"; shift 2 ;;
+          --daemon-port) DAEMON_PORT="$2"; shift 2 ;;
+          --bot-name) BOT_NAME="$2"; shift 2 ;;
+          --yes|-y) ASSUME_YES=1; shift ;;
           *) CFG_ARGS+=("$1"); shift ;;
         esac
       done
@@ -97,11 +113,77 @@ while [[ $# -gt 0 ]]; do
     --no-start) NO_START=1; shift ;;
     --no-restart) NO_RESTART=1; shift ;;
     --yes|-y) ASSUME_YES=1; shift ;;
+    --as-user) AS_USER="$2"; shift 2 ;;
+    --allow-root) ALLOW_ROOT=1; shift ;;
     -h|--help) usage; exit 0 ;;
-    *) die "Unknown argument: $1 (try --help)" ;;
+    --*) die "Unknown option: $1 (try --help)" ;;
+    *) MODE_ARGS+=("$1"); shift ;;
   esac
 done
 
+# ─── Root guard: refuse install as root by default ──────────────────────────
+# Running install as root puts data under /root/.local/share/ework-aio, bakes
+# root-only paths into systemd units, and looks for opencode in root's PATH
+# (usually missing). The right answer is almost always: don't use sudo.
+# --as-user re-execs the script as the named user after enabling linger.
+# --allow-root is an explicit acknowledgement that you've set up root's
+# environment (opencode installed, npm prefix configured, etc.).
+if [[ "$MODE" == "install" && "${EUID:-$(id -u)}" == "0" ]]; then
+  if [[ -n "$AS_USER" ]]; then
+    AS_USER_HOME="$(getent passwd "$AS_USER" 2>/dev/null | cut -d: -f6 || true)"
+    AS_USER_UID="$(getent passwd "$AS_USER" 2>/dev/null | cut -d: -f3 || true)"
+    if [[ -z "$AS_USER_HOME" || -z "$AS_USER_UID" ]]; then
+      die "--as-user: user '$AS_USER' not found in passwd database"
+    fi
+    if [[ "$AS_USER_UID" == "0" ]]; then
+      die "--as-user: target user is root — just use --allow-root instead"
+    fi
+    log "Enable linger for '$AS_USER' so --user services survive logout..."
+    loginctl enable-linger "$AS_USER" \
+      || die "Failed to enable linger for '$AS_USER'. Try: sudo loginctl enable-linger $AS_USER"
+    ok "Linger enabled for '$AS_USER'"
+    log "Re-execing as '$AS_USER' (HOME=$AS_USER_HOME)..."
+    # Strip --as-user <name> from argv, preserve everything else.
+    new_args=()
+    skip=0
+    for a in "$@"; do
+      if [[ "$skip" == "1" ]]; then skip=0; continue; fi
+      if [[ "$a" == "--as-user" ]]; then skip=1; continue; fi
+      new_args+=("$a")
+    done
+    # Resolve our own path (can't rely on $0 after sudo changes PATH).
+    SELF="$(command -v ework-aio 2>/dev/null || true)"
+    [[ -n "$SELF" ]] || SELF="${BASH_SOURCE[0]:-$0}"
+    exec sudo -u "$AS_USER" --login -- "$SELF" "${new_args[@]}"
+  fi
+  if [[ "$ALLOW_ROOT" != "1" ]]; then
+    cat >&2 <<EOF
+${c_red}ework-aio install refuses to run as root by default.${c_reset}
+
+Why this matters:
+  - Data goes under /root/.local/share/ework-aio (unreadable by other users)
+  - opencode is searched in root's PATH (usually not installed there)
+  - npm packages install to system-wide prefix owned by root
+  - systemd units bake root-only paths that other users can't run
+
+${c_bold}Option A (recommended):${c_reset} run as a regular user.
+  npm config set prefix '~/.local'        # one-time, makes -g user-writable
+  npm install -g ework-aio                # no sudo needed
+  ework-aio install                       # uses --user systemd scope
+
+${c_bold}Option B:${c_reset} install with sudo but target a regular user.
+  sudo ework-aio install --as-user $(logname 2>/dev/null || echo '<your-user>')
+  # All data + opencode + npm resolved under that user's HOME.
+  # systemd --user scope (linger auto-enabled for the target user).
+
+${c_bold}Option C:${c_reset} really install as root (you've set up root's env).
+  sudo ework-aio install --allow-root
+EOF
+    exit 1
+  fi
+  warn "Running install as root with --allow-root — data will live under /root."
+fi
+
 # Resolve scope: default by uid
 if [[ "$SCOPENAME" == "--user" && "${EUID:-$(id -u)}" == "0" ]]; then
   SCOPENAME="--system"
@@ -144,12 +226,13 @@ ensure_user_session || true   # warn but don't hard-fail — let later steps rep
 need_cmd() {
   command -v "$1" >/dev/null 2>&1 || die "Missing required command: $1. $2"
 }
-# Commands every mode needs (status/logs/env/config/uninstall all use systemctl).
-need_cmd systemctl  "This installer requires systemd."
 need_cmd awk        "Should be present on any Linux."
 
-# Install-only deps. Other modes work even if these are missing.
+# install needs systemctl (to write unit files + reload). Other modes
+# (status/logs/env/config/uninstall) can fall back to PID-file mode via
+# the 'ework-aio' dispatcher if systemd is unreachable on this host.
 if [[ "$MODE" == "install" ]]; then
+  need_cmd systemctl  "Install requires systemd. For hosts without systemd, run 'npm install -g ework-aio' and use 'ework-aio start' directly (PID-file mode)."
   need_cmd bun        "Install from https://bun.sh"
   need_cmd npm        "Install Node.js or Bun (ships npm)"
   need_cmd opencode   "Install from https://opencode.ai"
@@ -158,6 +241,23 @@ if [[ "$MODE" == "install" ]]; then
   need_cmd jq         "Install jq (for opencode.json merge)."
 fi
 
+# EWORK_AIO_BIN: always resolvable (used by status/logs/config/uninstall
+# to delegate to PID-file mode operations when systemd is unreachable).
+EWORK_AIO_BIN="$(command -v ework-aio 2>/dev/null || true)"
+[[ -n "$EWORK_AIO_BIN" ]] || EWORK_AIO_BIN="$(npm root -g 2>/dev/null)/ework-aio/bin/ework-aio"
+
+# systemd_reachable: 0 if `systemctl $SCOPENAME` can talk to systemd, 1 if not.
+# Used by status/logs/config/uninstall to decide whether to use systemd
+# (preferred) or fall back to PID-file mode via the ework-aio dispatcher.
+# Hosts where this returns 1: containers without systemd PID 1, polkit
+# redirects under sudo that drop the bus, hosts where the user isn't
+# permissioned for the system bus.
+systemd_reachable() {
+  command -v systemctl >/dev/null 2>&1 || return 1
+  systemctl "$SCOPENAME" is-system-running >/dev/null 2>&1 \
+    || systemctl "$SCOPENAME" list-units --no-pager >/dev/null 2>&1
+}
+
 # Verify the 3 npm packages are reachable. If not, try to install them now.
 ensure_pkg() {
   local pkg="$1"
@@ -469,6 +569,19 @@ service_for_key() {
 restart_service() {
   local svc="$1"
   local rc=0
+  if ! systemd_reachable; then
+    log "systemd not reachable — using PID-file mode restart"
+    if [[ "$svc" == "both" ]]; then
+      "$EWORK_AIO_BIN" restart both && ok "Restarted ework-web + ework-daemon (PID-file mode)" || rc=$?
+    else
+      "$EWORK_AIO_BIN" restart "$svc" && ok "Restarted ework-$svc (PID-file mode)" || rc=$?
+    fi
+    if [[ $rc -ne 0 ]]; then
+      warn "PID-file restart of '$svc' failed (exit $rc)."
+      warn "The .env changes are saved; run 'ework-aio restart $svc' manually."
+    fi
+    return $rc
+  fi
   case "$svc" in
     web)    ctl restart ework-web.service    && ok "Restarted ework-web"    || rc=$? ;;
     daemon) ctl restart ework-daemon.service && ok "Restarted ework-daemon" || rc=$? ;;
@@ -622,7 +735,22 @@ config)
   ;;
 
 status)
-  hr; log "ework-aio status ($SCOPENAME)"; hr
+  hr; log "ework-aio status"; hr
+  if ! systemd_reachable; then
+    log "(systemd unreachable — showing PID-file mode status)"
+    "$EWORK_AIO_BIN" ps 2>/dev/null || warn "ework-aio ps failed"
+    hr
+    log "Port listeners:"
+    p=""
+    for p in $(grep -hE '^(WORK_PORT|DAEMON_PORT)=' "$WEB_ENV" "$DAEMON_ENV" 2>/dev/null | cut -d= -f2 | sort -u); do
+      if curl -sf -o /dev/null --max-time 1 "http://127.0.0.1:$p/login" 2>/dev/null; then
+        printf '  :%s  ✓ listening\n' "$p"
+      else
+        printf '  :%s  ✗ not responding\n' "$p"
+      fi
+    done
+    exit 0
+  fi
   ctl is-active ework-web.service    || true
   ctl is-active ework-daemon.service || true
   ctl status --no-pager --lines=0 ework-web.service    2>/dev/null || true
@@ -632,18 +760,34 @@ status)
   ;;
 
 logs)
-  svc="${1:-ework-web.service}"
+  svc="${MODE_ARGS[0]:-ework-web.service}"
   [[ "$svc" == "daemon" || "$svc" == "ework-daemon" ]] && svc="ework-daemon.service"
   [[ "$svc" == "web"     || "$svc" == "ework-web" ]]    && svc="ework-web.service"
+  if ! systemd_reachable; then
+    svc_short="${svc%.service}"
+    svc_short="${svc_short#ework-}"
+    log_file="$DATA_DIR/run/${svc_short}.log"
+    if [[ ! -f "$log_file" ]]; then
+      die "systemd unreachable and no PID-file log at $log_file. Start services with: ework-aio start $svc_short"
+    fi
+    log "(systemd unreachable — tailing PID-file log $log_file)"
+    exec tail -n 200 -f "$log_file"
+  fi
   exec journalctl "$SCOPENAME" -u "$svc" -f
   ;;
 
 uninstall)
   hr; log "Uninstalling ework-aio services (keeping data)"; hr
-  ctl stop    ework-web.service ework-daemon.service 2>/dev/null || true
-  ctl disable ework-web.service ework-daemon.service 2>/dev/null || true
-  rm -f "$UNIT_DIR/ework-web.service" "$UNIT_DIR/ework-daemon.service"
-  ctl daemon-reload
+  "$EWORK_AIO_BIN" stop both 2>/dev/null || true
+  if systemd_reachable; then
+    ctl stop    ework-web.service ework-daemon.service 2>/dev/null || true
+    ctl disable ework-web.service ework-daemon.service 2>/dev/null || true
+    rm -f "$UNIT_DIR/ework-web.service" "$UNIT_DIR/ework-daemon.service"
+    ctl daemon-reload 2>/dev/null || true
+  else
+    log "(systemd unreachable — skipped unit cleanup; PID-file mode services stopped above)"
+    rm -f "$UNIT_DIR/ework-web.service" "$UNIT_DIR/ework-daemon.service" 2>/dev/null || true
+  fi
   ok "Services removed. Data preserved at $DATA_DIR"
   warn "To fully remove: rm -rf $DATA_DIR && npm uninstall -g ework-aio ework-web ework-daemon opencode-ework"
   exit 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ework-aio",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "description": "All-in-one installer for ework (issue tracker) + ework-daemon (AI bridge) + opencode-ework (plugin). One command: npm i -g ework-aio && ework-aio install.",
   "type": "module",
   "license": "MIT",