Skip to content

install-skills.sh installs skills for root and misreports Claude Code registration when run under sudo #750

Description

@ptr727

Running host-setup/linux/install-skills.sh under sudo operates as root rather than as the invoking user, and nothing in the script or the installer it drives detects or guards against that.

scripts/skills_install.py:54 resolves the target directory with Path.home() / ".agents". Under sudo, $HOME is root's home by default, so the skills land in /root/.agents/skills instead of the invoking user's ~/.agents/skills, silently, since the run still exits 0.

scripts/skills_install.py:157, claude_available(), checks shutil.which("claude") against $PATH. sudo replaces $PATH with its own secure_path by default, so a claude CLI installed on the invoking user's own PATH (an npm global, nvm, or similar user-local install) is invisible to the sudo'd process. The run reports "Claude Code marketplace registered: False" even on a host where claude is on PATH for the actual user, and a re-run as that user reports True for the identical tree.

host-setup/linux/install-skills.sh never checks EUID, $SUDO_USER, or otherwise guards against this, despite its own docstring and --help text both saying "Installs the fleet skills for the current user" (install-skills.sh:3, install-skills.sh:31-34). Nothing else in host-setup/ needs sudo for this step: install-tools.sh and upgrade-host.sh are the ones that touch system package state, and install-skills.sh writes only under the user's home.

What this looks like in practice

$ sudo host-setup/linux/install-skills.sh
`claude` not found on PATH, skipping Claude Code marketplace registration (Codex/opencode global skills were still installed).
Installed to /root/.agents/skills. Claude Code marketplace registered: False.
$ host-setup/linux/install-skills.sh
Installed to /home/<user>/.agents/skills. Claude Code marketplace registered: True.

Both runs exit 0, so nothing marks the first one as wrong. A user who runs the sudo-prefixed form out of habit, since the two sibling scripts in the same stand-up flow, install-tools.sh and upgrade-host.sh, both need sudo, gets an apparently successful install that the report step (install-skills.sh --report, run as themselves) still calls missing.

Shapes that would close it

Not a recommendation, just what seems available:

  1. Refuse under sudo/root. install-skills.sh checks EUID (or $SUDO_USER) up front and dies with a message pointing at running it as the normal user instead, matching what its own docs already promise.
  2. Accept it and target the invoking user. Resolve the real target home from $SUDO_USER (via getent passwd or similar) when running under sudo, and read claude_available() against that user's PATH rather than root's, so the sudo'd and non-sudo'd runs agree.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions