failproofai 1.0.0-beta.1 → 1.0.0-beta.2

package/src/hooks/daemon-service.ts

@@ -8,7 +8,15 @@
  * `configure-wizard.ts` calls the functions here directly, the same
  * relationship it already has with `manager.ts`'s `installHooks()`.
  */
-import { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync, rmSync } from "node:fs";
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  writeFileSync,
+  unlinkSync,
+  rmSync,
+} from "node:fs";
 import { homedir, tmpdir, userInfo } from "node:os";
 import { resolve, dirname } from "node:path";
 import { execFileSync } from "node:child_process";
@@ -45,6 +53,14 @@ const SERVICE_START_POLL_MS = 100;
  */
 const SERVICE_SETTLE_MS = 750;
 
+/**
+ * How long `sudo -v` may sit at its password prompt. Unlike every other
+ * timeout here, this one is waiting on a human typing, not on a service
+ * manager — three attempts at a password is well inside two minutes, and
+ * sudo gives up on its own long before that.
+ */
+const SUDO_PROMPT_TIMEOUT_MS = 120_000;
+
 /**
  * Writes (or clears) the machine-wide `daemonConfigured` marker in
  * `~/.failproofai/policies-config.json`.
@@ -175,6 +191,14 @@ export function resolveWorkerCommand(): string | null {
   if (!packageRoot) return null;
   const workerScript = resolve(packageRoot, "dist", "worker.mjs");
   if (!existsSync(workerScript)) return null;
+  // Both paths are shell-quoted: the daemon runs this value through `sh -c`
+  // (`WorkerCommand::Shell` in crates/failproofaid/src/worker.rs), so an
+  // unquoted path splits on its spaces and the worker never starts. Not
+  // hypothetical on macOS, where `/Users/First Last/...` is ordinary — and
+  // more exposed since execPath replaced a bare `node`, because execPath is
+  // home-derived. systemd's own `Environment="..."` quoting does not help
+  // here; that protects the unit parse, not the later shell split.
+  //
   // `process.execPath`, not a bare `node`. A system-scope service does not
   // inherit a login environment, so its PATH is the system default — and the
   // single most common way to install Node is nvm, which puts it under
@@ -183,7 +207,13 @@ export function resolveWorkerCommand(): string | null {
   // silently, on exactly the machines least likely to notice. execPath is
   // whatever runtime is executing this CLI right now (node for the published
   // bin, bun in a source checkout), absolute either way.
-  return `${process.execPath} ${workerScript}`;
+  return `${shellQuote(process.execPath)} ${shellQuote(workerScript)}`;
+}
+
+/** POSIX single-quoting: everything is literal inside '…', and a literal
+ *  quote is closed, escaped and reopened. */
+function shellQuote(value: string): string {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 
 /**
@@ -224,15 +254,33 @@ function legacySystemdUserUnitPath(): string {
   return resolve(homedir(), ".config", "systemd", "user", "failproofaid.service");
 }
 
-const LAUNCHD_LABEL = "ai.failproof.failproofaid";
+/**
+ * Per user, for the same reason the systemd unit is: a LaunchDaemon's
+ * contents are entirely user-specific — `UserName`, the ExecStart path under
+ * that user's `~/.failproofai/bin`, the log paths under that user's home — so
+ * one shared label means the second user's install silently overwrites the
+ * first's daemon, and their uninstall deletes it.
+ */
+function launchdLabel(user: string = serviceUser()): string {
+  return `ai.failproof.failproofaid.${user}`;
+}
 
-function launchdPlistPath(): string {
-  return `/Library/LaunchDaemons/${LAUNCHD_LABEL}.plist`;
+function launchdPlistPath(user: string = serviceUser()): string {
+  return `/Library/LaunchDaemons/${launchdLabel(user)}.plist`;
 }
 
-/** The pre-1.0.0-beta.1 LaunchAgent — same migration problem as above. */
+/** The pre-1.0.0-beta.1 LaunchAgent. */
 function legacyLaunchAgentPlistPath(): string {
-  return resolve(homedir(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
+  return resolve(homedir(), "Library", "LaunchAgents", "ai.failproof.failproofaid.plist");
+}
+
+/**
+ * The 1.0.0-beta.1 LaunchDaemon, before the label was namespaced. Removed on
+ * install like the LaunchAgent is: it holds the same singleton flock, so
+ * leaving it would leave two daemons racing for one socket.
+ */
+function legacySharedLaunchDaemonPath(): string {
+  return "/Library/LaunchDaemons/ai.failproof.failproofaid.plist";
 }
 
 /**
@@ -255,7 +303,38 @@ export function daemonStatusCommand(): string | null {
   if (!isDaemonSupportedPlatform()) return null;
   return process.platform === "linux"
     ? `systemctl status ${systemdUnitName()}`
-    : `sudo launchctl print system/${LAUNCHD_LABEL}`;
+    : `sudo launchctl print system/${launchdLabel()}`;
+}
+
+/**
+ * Acquires sudo credentials up front, prompting in the terminal if needed.
+ *
+ * `sudo -v` refreshes the user's sudo timestamp and returns; every later
+ * `sudo -n` in this run then succeeds against that cached credential. Doing it
+ * here, once, at a known point in the wizard is what makes the rest of the
+ * install non-interactive — the alternative, an interactive sudo firing from
+ * underneath a half-drawn TUI screen, is a password prompt the user cannot
+ * see.
+ *
+ * NOT the same as running the whole CLI under sudo, which is actively wrong:
+ * `homedir()` would become /root, so the hooks, the policy config, the
+ * downloaded binary and the unit's own `User=` would all be root's rather
+ * than the user's, quietly configuring the wrong account.
+ *
+ * `stdio: "inherit"` so the prompt and the typed password go straight to the
+ * real terminal. The timeout is generous because a human is typing.
+ */
+export function primeElevation(): boolean {
+  if (typeof process.getuid === "function" && process.getuid() === 0) return true;
+  if (canElevate()) return true; // NOPASSWD, or already primed
+  try {
+    execFileSync("sudo", ["-v"], { stdio: "inherit", timeout: SUDO_PROMPT_TIMEOUT_MS });
+    return canElevate();
+  } catch {
+    // Wrong password, no sudo rights, or the user pressed ctrl-C. All of them
+    // mean the same thing here: carry on without a daemon.
+    return false;
+  }
 }
 
 /** True when privileged commands can run without prompting for a password. */
@@ -289,12 +368,19 @@ function runPrivileged(command: string, args: string[]): void {
  * mode in the same step, so the file is never briefly world-writable.
  */
 function writePrivilegedFile(destination: string, contents: string, mode = "0644"): void {
-  const staging = resolve(tmpdir(), `failproofaid-${process.pid}-${Date.now()}.tmp`);
+  // mkdtempSync, not a name built from pid + timestamp in the shared tmpdir.
+  // That name is guessable, and `writeFileSync` follows a symlink already
+  // sitting at the path — so on a multi-user box another local user could
+  // pre-create it and have `install` copy content they control into
+  // /etc/systemd/system as root. mkdtemp gives a 0700 directory with a name
+  // they cannot predict, so there is nothing to pre-create.
+  const stagingDir = mkdtempSync(resolve(tmpdir(), "failproofaid-stage-"));
+  const staging = resolve(stagingDir, "service-definition");
   try {
     writeFileSync(staging, contents, "utf8");
     runPrivileged("install", ["-m", mode, staging, destination]);
   } finally {
-    rmSync(staging, { force: true });
+    rmSync(stagingDir, { recursive: true, force: true });
   }
 }
 
@@ -326,17 +412,30 @@ function removeLegacyUserService(): void {
         /* best-effort */
       }
     } else {
-      const legacy = legacyLaunchAgentPlistPath();
-      if (!existsSync(legacy)) return;
-      try {
-        execFileSync("launchctl", ["unload", "-w", legacy], {
-          stdio: "ignore",
-          timeout: SERVICE_CMD_TIMEOUT_MS,
-        });
-      } catch {
-        /* not loaded */
+      const legacyAgent = legacyLaunchAgentPlistPath();
+      if (existsSync(legacyAgent)) {
+        try {
+          execFileSync("launchctl", ["unload", "-w", legacyAgent], {
+            stdio: "ignore",
+            timeout: SERVICE_CMD_TIMEOUT_MS,
+          });
+        } catch {
+          /* not loaded */
+        }
+        unlinkSync(legacyAgent);
+      }
+
+      // The 1.0.0-beta.1 daemon, before the label was per-user. Privileged,
+      // and only reachable on a path that has already elevated.
+      const legacyDaemon = legacySharedLaunchDaemonPath();
+      if (existsSync(legacyDaemon)) {
+        try {
+          runPrivileged("launchctl", ["unload", "-w", legacyDaemon]);
+        } catch {
+          /* not loaded */
+        }
+        runPrivileged("rm", ["-f", legacyDaemon]);
       }
-      unlinkSync(legacy);
     }
   } catch (err) {
     hookLogWarn(`could not remove the legacy user-scope daemon: ${err instanceof Error ? err.message : String(err)}`);
@@ -390,7 +489,7 @@ function launchdPlistContents(binaryPath: string, logDir: string, workerCmd: str
 <plist version="1.0">
 <dict>
     <key>Label</key>
-    <string>${LAUNCHD_LABEL}</string>
+    <string>${escapeXml(launchdLabel())}</string>
     <key>ProgramArguments</key>
     <array>
         <string>${escapeXml(binaryPath)}</string>
@@ -471,8 +570,10 @@ export async function installDaemonService(): Promise<DaemonInstallResult> {
     return {
       installed: false,
       reason:
-        "root privileges are required to install the failproofaid system service, and sudo is not available without a password. " +
-        `Run: sudo failproofai config  (or install manually: ${daemonInstallCommands(binaryPath, workerCmd).join(" && ")})`,
+        "root privileges are required to install the failproofaid system service, and sudo credentials were not available. " +
+        "Re-run `failproofai config` and approve the sudo prompt — do NOT run the CLI itself under sudo, which would " +
+        "configure root's account instead of yours. To install by hand: " +
+        daemonInstallCommands(binaryPath, workerCmd).join(" && "),
     };
   }
 
@@ -631,7 +732,7 @@ export function daemonServiceStatus(): DaemonServiceStatus {
     // `launchctl list` cannot see — unlike systemd, reading the state needs
     // the same elevation installing it did.
     const root = typeof process.getuid === "function" && process.getuid() === 0;
-    const args = ["print", `system/${LAUNCHD_LABEL}`];
+    const args = ["print", `system/${launchdLabel()}`];
     const out = root
       ? execFileSync("launchctl", args, {
           stdio: ["ignore", "pipe", "ignore"],