jishushell 0.6.5 → 0.7.3

package/dist/utils/service-user.js

@@ -0,0 +1,129 @@
+import { execFileSync } from "child_process";
+import { existsSync, statSync } from "fs";
+import { homedir, userInfo } from "os";
+import { join, resolve } from "path";
+function parsePasswdEntry(entry) {
+    const cols = entry.trim().split(":");
+    if (cols.length < 7)
+        return null;
+    const uid = Number.parseInt(cols[2] ?? "", 10);
+    const gid = Number.parseInt(cols[3] ?? "", 10);
+    if (!cols[0] || !Number.isFinite(uid) || !Number.isFinite(gid))
+        return null;
+    return {
+        username: cols[0],
+        uid,
+        gid,
+        home: cols[5] || undefined,
+        shell: cols[6] || undefined,
+    };
+}
+function lookupPasswdByUid(uid) {
+    try {
+        const entry = execFileSync("getent", ["passwd", String(uid)], {
+            encoding: "utf8",
+            timeout: 3000,
+        }).trim();
+        const user = parsePasswdEntry(entry);
+        return user?.uid === uid ? user : null;
+    }
+    catch {
+        try {
+            const username = execFileSync("id", ["-un", String(uid)], {
+                encoding: "utf8",
+                timeout: 3000,
+            }).trim();
+            const gid = Number.parseInt(execFileSync("id", ["-g", username], {
+                encoding: "utf8",
+                timeout: 3000,
+            }).trim(), 10);
+            return username && Number.isFinite(gid) ? { username, uid, gid } : null;
+        }
+        catch {
+            return null;
+        }
+    }
+}
+function lookupPasswdByName(username) {
+    try {
+        const uid = Number.parseInt(execFileSync("id", ["-u", username], {
+            encoding: "utf8",
+            timeout: 3000,
+        }).trim(), 10);
+        const gid = Number.parseInt(execFileSync("id", ["-g", username], {
+            encoding: "utf8",
+            timeout: 3000,
+        }).trim(), 10);
+        if (!Number.isFinite(uid) || !Number.isFinite(gid))
+            return null;
+        return { username, uid, gid };
+    }
+    catch {
+        return null;
+    }
+}
+function firstRealPasswdUser() {
+    try {
+        const entry = execFileSync("getent", ["passwd"], {
+            encoding: "utf8",
+            timeout: 3000,
+        })
+            .split("\n")
+            .map(parsePasswdEntry)
+            .find((user) => {
+            if (!user || user.uid < 1000 || user.uid >= 65534)
+                return false;
+            return !/(?:nologin|false)$/.test(user.shell ?? "");
+        });
+        return entry ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+export function resolveServiceUser(options = {}) {
+    const current = userInfo();
+    if (current.uid !== 0) {
+        return {
+            username: current.username,
+            uid: current.uid,
+            gid: current.gid,
+            home: current.homedir,
+        };
+    }
+    const sudoUid = Number.parseInt(process.env.SUDO_UID || "", 10);
+    if (Number.isFinite(sudoUid) && sudoUid >= 1000 && sudoUid < 65534) {
+        const byUid = lookupPasswdByUid(sudoUid);
+        if (byUid)
+            return byUid;
+    }
+    const sudoUser = (process.env.SUDO_USER || "").trim();
+    if (sudoUser && sudoUser !== "root") {
+        const byName = lookupPasswdByName(sudoUser);
+        if (byName && byName.uid >= 1000 && byName.uid < 65534)
+            return byName;
+    }
+    const jishuHome = resolve(options.jishuHome || process.env.JISHUSHELL_HOME || join(homedir(), ".jishushell"));
+    try {
+        if (existsSync(jishuHome)) {
+            const stat = statSync(jishuHome);
+            if (stat.uid !== 0) {
+                const user = lookupPasswdByUid(stat.uid);
+                if (user)
+                    return { ...user, gid: stat.gid };
+            }
+        }
+    }
+    catch {
+        // Ignore and fall back to /etc/passwd scan.
+    }
+    return firstRealPasswdUser();
+}
+export function requireServiceUser(options = {}) {
+    const user = resolveServiceUser(options);
+    if (!user) {
+        throw new Error("Cannot determine service user. Run as a non-root user or through sudo with SUDO_UID/SUDO_USER set.");
+    }
+    return user;
+}
+//# sourceMappingURL=service-user.js.map

package/dist/utils/service-user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-user.js","sourceRoot":"","sources":["../../src/utils/service-user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAUrC,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;QACjB,GAAG;QACH,GAAG;QACH,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,SAAS;QAC1B,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE;YAC5D,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,IAAI;SACd,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACrC,OAAO,IAAI,EAAE,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE;gBACxD,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,IAAI;aACd,CAAC,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE;gBAC/D,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,IAAI;aACd,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACf,OAAO,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE;YAC/D,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,IAAI;SACd,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACf,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE;YAC/D,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,IAAI;SACd,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAChE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB;IAC1B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;YAC/C,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,IAAI;SACd,CAAC;aACC,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,gBAAgB,CAAC;aACrB,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YACb,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;YAChE,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QACL,OAAO,KAAK,IAAI,IAAI,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,UAAkC,EAAE;IACrE,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,IAAI,EAAE,OAAO,CAAC,OAAO;SACtB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,GAAG,KAAK,EAAE,CAAC;QACnE,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,QAAQ,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,MAAM,IAAI,MAAM,CAAC,GAAG,IAAI,IAAI,IAAI,MAAM,CAAC,GAAG,GAAG,KAAK;YAAE,OAAO,MAAM,CAAC;IACxE,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;IAC9G,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;YACjC,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC;gBACnB,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACzC,IAAI,IAAI;oBAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;YAC9C,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;IAED,OAAO,mBAAmB,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,UAAkC,EAAE;IACrE,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,oGAAoG,CAAC,CAAC;IACxH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/install/jishu-install.sh

@@ -2298,9 +2298,8 @@ install_nomad_systemd() {
     _ensure_nomad_hcl
 
     # Nomad 1.6.5's docker driver fingerprint requires euid==0 (PR #18197 lifted
-    # the root requirement only in 1.7+, which is BSL). The panel stays as the
-    # installing user via a separate unit; it talks to this agent over HTTP so
-    # ~/.jishushell/nomad/data/ can be root-owned without breaking anything.
+    # the root requirement only in 1.7+, which is BSL). Core/Panel stay as the
+    # installing user via separate units and talk to this agent over HTTP.
     local service_content="[Unit]
 Description=Nomad Agent
 After=network-online.target docker.service
@@ -2309,7 +2308,6 @@ Wants=network-online.target
 [Service]
 User=root
 Type=simple
-EnvironmentFile=-/etc/jishushell/nomad.env
 ExecStart=${nomad_bin} agent -config=${config_file}
 Restart=on-failure
 RestartSec=3
@@ -2332,12 +2330,9 @@ WantedBy=multi-user.target"
     ${SUDO} chown root:root "$svc_path" 2>/dev/null || true
     ${SUDO} chmod 644 "$svc_path" 2>/dev/null || true
 
-    # Keep the real user owning ~/.jishushell except for Nomad's own state,
-    # which must be root-owned because the agent runs as root for driver fingerprinting.
+    # Keep ~/.jishushell user-owned. Nomad runs as root, but root can write
+    # user-owned state; app and Core files must remain writable by REAL_USER.
     chown -R "${REAL_USER}:${REAL_GID:-${REAL_USER}}" "${JISHUSHELL_HOME}" 2>/dev/null || true
-    if [[ -d "${nomad_config_dir}/data" ]]; then
-        ${SUDO} chown -R root:root "${nomad_config_dir}/data" 2>/dev/null || true
-    fi
 
     if [[ $need_reload -eq 1 ]]; then
         ${SUDO} systemctl daemon-reload
@@ -3104,14 +3099,15 @@ install_jishushell() {
     if [[ "$DRY_RUN" == "1" ]]; then
         local jishushell_pkg_spec
         jishushell_pkg_spec="$(jishushell_package_spec)"
+        local jishushell_npm_prefix="${JISHUSHELL_NPM_PREFIX:-${JISHUSHELL_HOME}/npm-global}"
         local _dry_reg=""
         [[ -n "${NPM_REGISTRY:-}" ]] && _dry_reg=" --registry ${NPM_REGISTRY}"
         local _dry_tgz=""
         _dry_tgz="$(find_local_jishushell_tgz 2>/dev/null || true)"
         if [[ -n "$_dry_tgz" ]]; then
-            ui_info "[dry-run] Would: npm install -g ${_dry_tgz}  (local package)"
+            ui_info "[dry-run] Would: npm install -g --prefix ${jishushell_npm_prefix} ${_dry_tgz}  (local package)"
         else
-            ui_info "[dry-run] Would: npm install -g ${jishushell_pkg_spec}${_dry_reg}"
+            ui_info "[dry-run] Would: npm install -g --prefix ${jishushell_npm_prefix} ${jishushell_pkg_spec}${_dry_reg}"
         fi
         ui_info "[dry-run] Would write wrapper: ${JISHUSHELL_BIN_DIR}/jishushell-core-start"
         if jishushell_panel_bundled || [[ "$(basename "${_dry_tgz:-}")" == jishushell-gui-*.tgz ]]; then
@@ -3147,6 +3143,7 @@ install_jishushell() {
 
     local jishushell_pkg_spec
     jishushell_pkg_spec="$(jishushell_package_spec)"
+    local jishushell_npm_prefix="${JISHUSHELL_NPM_PREFIX:-${JISHUSHELL_HOME}/npm-global}"
     local npm_registry_args=()
     if [[ -n "${NPM_REGISTRY:-}" ]]; then
         if [[ ! "$NPM_REGISTRY" =~ ^https?:// ]]; then
@@ -3164,6 +3161,7 @@ install_jishushell() {
     local tgz_path=""
     local expected_pkg_name
     if [[ "${JISHUSHELL_SKIP_NPM_INSTALL:-0}" != "1" ]]; then
+        mkdir -p "$jishushell_npm_prefix"
         # Prefer a local .tgz package in the same directory as this script.
         tgz_path="$(find_local_jishushell_tgz 2>/dev/null || true)"
         expected_pkg_name="$(jishushell_package_name_from_spec "${tgz_path:-$jishushell_pkg_spec}")"
@@ -3176,21 +3174,21 @@ install_jishushell() {
 
         if [[ -n "$tgz_path" ]]; then
             ui_info "Found local package: ${tgz_path} — installing offline..."
-            log_detail "[$(date '+%H:%M:%S')] ${npm_bin} install -g ${tgz_path}"
-            if ! log_cmd "$npm_bin" install -g "${tgz_path}"; then
+            log_detail "[$(date '+%H:%M:%S')] ${npm_bin} install -g --prefix ${jishushell_npm_prefix} ${tgz_path}"
+            if ! log_cmd "$npm_bin" install -g --prefix "$jishushell_npm_prefix" "${tgz_path}"; then
                 unset JISHU_RUNNING_IN_INSTALLER
                 ui_error "npm install -g ${tgz_path} failed"
                 return 1
             fi
         else
-            log_detail "[$(date '+%H:%M:%S')] ${npm_bin} install -g ${jishushell_pkg_spec} ${npm_registry_args[*]:-}"
+            log_detail "[$(date '+%H:%M:%S')] ${npm_bin} install -g --prefix ${jishushell_npm_prefix} ${jishushell_pkg_spec} ${npm_registry_args[*]:-}"
             if [[ ${#npm_registry_args[@]} -gt 0 ]]; then
-                if ! log_cmd "$npm_bin" install -g "${jishushell_pkg_spec}" "${npm_registry_args[@]}"; then
+                if ! log_cmd "$npm_bin" install -g --prefix "$jishushell_npm_prefix" "${jishushell_pkg_spec}" "${npm_registry_args[@]}"; then
                     unset JISHU_RUNNING_IN_INSTALLER
                     ui_error "npm install -g ${jishushell_pkg_spec} failed"
                     return 1
                 fi
-            elif ! log_cmd "$npm_bin" install -g "${jishushell_pkg_spec}"; then
+            elif ! log_cmd "$npm_bin" install -g --prefix "$jishushell_npm_prefix" "${jishushell_pkg_spec}"; then
                 unset JISHU_RUNNING_IN_INSTALLER
                 ui_error "npm install -g ${jishushell_pkg_spec} failed"
                 return 1
@@ -3207,7 +3205,11 @@ install_jishushell() {
 
     # Resolve the installed cli.js path via the npm that did the install
     local npm_root
-    npm_root="$("$npm_bin" root -g 2>/dev/null || true)"
+    if [[ "${JISHUSHELL_SKIP_NPM_INSTALL:-0}" == "1" ]]; then
+        npm_root="$("$npm_bin" root -g 2>/dev/null || true)"
+    else
+        npm_root="$("$npm_bin" root -g --prefix "$jishushell_npm_prefix" 2>/dev/null || true)"
+    fi
     if [[ -z "$npm_root" ]]; then
         ui_error "Cannot locate npm root — wrapper cannot be written"
         return 1
@@ -3244,9 +3246,8 @@ set -euo pipefail
 _WRAPPER_PATH="\${BASH_SOURCE[0]:-\$0}"
 _WRAPPER_DIR="\$(cd "\$(dirname "\$_WRAPPER_PATH")" && pwd)"
 _DEFAULT_JISHUSHELL_HOME="\$(cd "\${_WRAPPER_DIR}/.." && pwd)"
-JISHUSHELL_HOME="\${JISHUSHELL_HOME:-\$_DEFAULT_JISHUSHELL_HOME}"
 
-_resolve_home() {
+_resolve_sudo_home() {
     if [ -n "\${SUDO_UID:-}" ] && command -v getent >/dev/null 2>&1; then
         local _entry
         _entry="\$(getent passwd "\$SUDO_UID" 2>/dev/null || true)"
@@ -3255,6 +3256,27 @@ _resolve_home() {
             return
         fi
     fi
+}
+
+_SUDO_HOME="\$(_resolve_sudo_home || true)"
+if [ -z "\${JISHUSHELL_HOME:-}" ]; then
+    case "\$_DEFAULT_JISHUSHELL_HOME" in
+        /usr|/usr/local|/opt/homebrew|/opt/local)
+            if [ -n "\$_SUDO_HOME" ]; then
+                JISHUSHELL_HOME="\${_SUDO_HOME}/.jishushell"
+            else
+                JISHUSHELL_HOME="\$_DEFAULT_JISHUSHELL_HOME"
+            fi
+            ;;
+        *) JISHUSHELL_HOME="\$_DEFAULT_JISHUSHELL_HOME" ;;
+    esac
+fi
+
+_resolve_home() {
+    if [ -n "\$_SUDO_HOME" ]; then
+        printf '%s\n' "\$_SUDO_HOME"
+        return
+    fi
     case "\$JISHUSHELL_HOME" in
         */.jishushell) printf '%s\n' "\${JISHUSHELL_HOME%/.jishushell}" ;;
         *) printf '%s\n' "\${HOME:-\$PWD}" ;;
@@ -3307,9 +3329,8 @@ set -euo pipefail
 _WRAPPER_PATH="\${BASH_SOURCE[0]:-\$0}"
 _WRAPPER_DIR="\$(cd "\$(dirname "\$_WRAPPER_PATH")" && pwd)"
 _DEFAULT_JISHUSHELL_HOME="\$(cd "\${_WRAPPER_DIR}/.." && pwd)"
-JISHUSHELL_HOME="\${JISHUSHELL_HOME:-\$_DEFAULT_JISHUSHELL_HOME}"
 
-_resolve_home() {
+_resolve_sudo_home() {
     if [ -n "\${SUDO_UID:-}" ] && command -v getent >/dev/null 2>&1; then
         local _entry
         _entry="\$(getent passwd "\$SUDO_UID" 2>/dev/null || true)"
@@ -3318,6 +3339,27 @@ _resolve_home() {
             return
         fi
     fi
+}
+
+_SUDO_HOME="\$(_resolve_sudo_home || true)"
+if [ -z "\${JISHUSHELL_HOME:-}" ]; then
+    case "\$_DEFAULT_JISHUSHELL_HOME" in
+        /usr|/usr/local|/opt/homebrew|/opt/local)
+            if [ -n "\$_SUDO_HOME" ]; then
+                JISHUSHELL_HOME="\${_SUDO_HOME}/.jishushell"
+            else
+                JISHUSHELL_HOME="\$_DEFAULT_JISHUSHELL_HOME"
+            fi
+            ;;
+        *) JISHUSHELL_HOME="\$_DEFAULT_JISHUSHELL_HOME" ;;
+    esac
+fi
+
+_resolve_home() {
+    if [ -n "\$_SUDO_HOME" ]; then
+        printf '%s\n' "\$_SUDO_HOME"
+        return
+    fi
     case "\$JISHUSHELL_HOME" in
         */.jishushell) printf '%s\n' "\${JISHUSHELL_HOME%/.jishushell}" ;;
         *) printf '%s\n' "\${HOME:-\$PWD}" ;;
@@ -3378,9 +3420,8 @@ set -euo pipefail
 _WRAPPER_PATH="\${BASH_SOURCE[0]:-\$0}"
 _WRAPPER_DIR="\$(cd "\$(dirname "\$_WRAPPER_PATH")" && pwd)"
 _DEFAULT_JISHUSHELL_HOME="\$(cd "\${_WRAPPER_DIR}/.." && pwd)"
-JISHUSHELL_HOME="\${JISHUSHELL_HOME:-\$_DEFAULT_JISHUSHELL_HOME}"
 
-_resolve_home() {
+_resolve_sudo_home() {
     if [ -n "\${SUDO_UID:-}" ] && command -v getent >/dev/null 2>&1; then
         local _entry
         _entry="\$(getent passwd "\$SUDO_UID" 2>/dev/null || true)"
@@ -3389,6 +3430,27 @@ _resolve_home() {
             return
         fi
     fi
+}
+
+_SUDO_HOME="\$(_resolve_sudo_home || true)"
+if [ -z "\${JISHUSHELL_HOME:-}" ]; then
+    case "\$_DEFAULT_JISHUSHELL_HOME" in
+        /usr|/usr/local|/opt/homebrew|/opt/local)
+            if [ -n "\$_SUDO_HOME" ]; then
+                JISHUSHELL_HOME="\${_SUDO_HOME}/.jishushell"
+            else
+                JISHUSHELL_HOME="\$_DEFAULT_JISHUSHELL_HOME"
+            fi
+            ;;
+        *) JISHUSHELL_HOME="\$_DEFAULT_JISHUSHELL_HOME" ;;
+    esac
+fi
+
+_resolve_home() {
+    if [ -n "\$_SUDO_HOME" ]; then
+        printf '%s\n' "\$_SUDO_HOME"
+        return
+    fi
     case "\$JISHUSHELL_HOME" in
         */.jishushell) printf '%s\n' "\${JISHUSHELL_HOME%/.jishushell}" ;;
         *) printf '%s\n' "\${HOME:-\$PWD}" ;;
@@ -3728,6 +3790,21 @@ WantedBy=multi-user.target"
     fi
 
     install_jishushell_panel_service || true
+
+    # The shell installer still has some legacy inline wrapper/unit templates.
+    # Run the Node-side system reload once at the end so the currently
+    # installed Core code rewrites host files to the same canonical templates
+    # that `system-reconciler` validates on the next startup.
+    local cli_wrapper="${JISHUSHELL_BIN_DIR}/jishushell"
+    if [[ -x "$cli_wrapper" ]]; then
+        if ${SUDO} env JISHUSHELL_HOME="${JISHUSHELL_HOME}" HOME="${REAL_HOME}" "$cli_wrapper" system reload; then
+            ui_success "System components reloaded with canonical templates"
+        else
+            ui_warn "System reload did not complete during install; run 'sudo ${cli_wrapper} system reload'"
+        fi
+    else
+        ui_warn "JishuShell CLI wrapper not found for final system reload; run 'sudo ${JISHUSHELL_BIN_DIR}/jishushell system reload'"
+    fi
 }
 
 # ─── run_install_components ───────────────────────────────────────────────────
@@ -3831,12 +3908,11 @@ run_install_components() {
     fi
 
     # ── Fix .jishushell ownership & permissions ───────────────────────────────
-    # Ensure the data dir is readable/writable by both root and the real user.
-    # - Root owns the dir (service runs as root)
-    # - REAL_USER is in the owning group; dirs are g+rwx so normal-user tools work
+    # Ensure the data dir is owned by the real user that runs Core/Panel.
+    # On Linux, Nomad itself still runs as root, but root can write user-owned
+    # state; keeping ~/.jishushell user-owned avoids app/Core permission drift.
     if [[ -d "${JISHUSHELL_HOME}" && -n "${REAL_USER}" ]]; then
         ui_info "Fixing ${JISHUSHELL_HOME} ownership for ${REAL_USER}..."
-        # Both Nomad and JishuShell now run as REAL_USER — make REAL_USER own everything
         ${SUDO} chown -R "${REAL_USER}:${REAL_GID:-${REAL_USER}}" "${JISHUSHELL_HOME}" 2>/dev/null || true
         # Dirs: rwxr-xr-x
         ${SUDO} find "${JISHUSHELL_HOME}" -type d -exec chmod 755 {} + 2>/dev/null || true
@@ -3856,6 +3932,10 @@ run_install_components() {
             local fp="${JISHUSHELL_HOME}/${f}"
             [[ -f "$fp" ]] && ${SUDO} chmod 600 "$fp" 2>/dev/null || true
         done
+        if [[ -d "${JISHUSHELL_HOME}/provider-credentials" ]]; then
+            ${SUDO} find "${JISHUSHELL_HOME}/provider-credentials" -mindepth 2 -maxdepth 2 \
+                -type f -name credentials.json -exec chmod 600 {} + 2>/dev/null || true
+        fi
         # Sync nomad.env from /etc/jishushell if missing in JISHUSHELL_HOME
         if [[ ! -f "${JISHUSHELL_HOME}/nomad.env" && -f /etc/jishushell/nomad.env ]]; then
             if [[ -n "${SUDO}" || -r /etc/jishushell/nomad.env ]]; then

package/install/jishu-uninstall.sh

@@ -443,6 +443,14 @@ stop_services() {
                 fi
                 ${SUDO} rm -f "/etc/systemd/system/${svc}.service" 2>/dev/null || true
             done
+            if [[ -L "/usr/local/bin/jishushell" ]]; then
+                local _jishu_link_target
+                _jishu_link_target="$(readlink "/usr/local/bin/jishushell" 2>/dev/null || true)"
+                if [[ "$_jishu_link_target" == "${JISHUSHELL_HOME}/bin/jishushell" ]]; then
+                    ${SUDO} rm -f "/usr/local/bin/jishushell" 2>/dev/null || true
+                    ui_success "Removed: /usr/local/bin/jishushell"
+                fi
+            fi
             ${SUDO} systemctl daemon-reload 2>/dev/null || true
             ui_success "Services stopped and removed from auto-start"
         fi