cli: attach to pi sessions by name/id + doctor non-root clarity

[benvinegar]

Summary

Improve baudbot doctor UX when run without root privileges.

Previously, running baudbot doctor as a non-root user could show misleading failures/warnings (for example around runtime files or firewall state) that looked like actual system breakage. This PR makes those cases explicit as permission-limited / inconclusive checks with clear guidance to run sudo baudbot doctor for authoritative results.

Changes

• bin/doctor.sh
  • Detects non-root execution (IS_ROOT flag).
  • Prints a top-level note when not root:
    • "Running without root: some checks may be inconclusive"
    • "For full accuracy, run: sudo baudbot doctor"
  • Converts several false-negative-prone checks to actionable non-root warnings when appropriate:
    • extensions/skills presence checks
    • agent .env visibility edge case
    • tool-guard.ts verification
    • firewall (iptables) verification
    • runtime file checks where access can be permission-limited
  • Keeps true failures intact when root (or when a check is genuinely failed).

Why

This reduces operator confusion during normal non-root usage while preserving strict diagnostics for root/admin runs.

Validation

• bash -n bin/doctor.sh
• bash bin/test.sh shell (all pass)
• Manual run confirms clearer messaging:
  • ./bin/doctor.sh now explains non-root inconclusive checks instead of implying system inactivity/breakage.

[greptile-apps]

Greptile Summary

This PR improves baudbot doctor UX for non-root users by detecting privilege level and converting permission-gated checks into clear "inconclusive" warnings instead of misleading failures. It also ensures release directories under /opt/baudbot are world-traversable so the /usr/local/bin/baudbot symlink works for non-root users.

• bin/doctor.sh: Adds IS_ROOT detection, prints a top-level advisory, and converts checks for .env, runtime files, extensions/skills, firewall, tool-guard, and systemd state into warnings when the check failure is likely caused by insufficient permissions rather than a genuine misconfiguration.
• bin/update-release.sh: Adds chmod a+rx to release directories (both new publishes and re-used existing releases) so non-root users can resolve the global CLI symlink.
• bin/update-release.test.sh: Adds a stat -c '%a' assertion to verify release directories get 755 permissions.

Confidence Score: 4/5

• This PR is safe to merge — the changes are defensive and don't alter behavior for root runs.
• Changes are well-scoped UX improvements that only affect non-root diagnostic output. The non-root guards use reasonable heuristics (checking parent directory existence). The systemd section is slightly more complex with string-matching on error output, but handles edge cases gracefully. No security regressions — the chmod a+rx only applies to release directories that contain immutable read-only files.
• No files require special attention. bin/doctor.sh has the most changes but the logic is straightforward.

Important Files Changed

Filename	Overview
bin/doctor.sh	Adds IS_ROOT detection and converts permission-sensitive checks to warnings when run as non-root. Logic is sound for the primary use case (admin user in baudbot_agent group). No functional regressions.
bin/update-release.sh	Adds chmod a+rx to release directories (both new and existing) so non-root users can traverse the symlink chain to /usr/local/bin/baudbot. Minimal, well-scoped change.
bin/update-release.test.sh	Adds assertion that published release directory has 755 permissions, validating the chmod a+rx change in update-release.sh.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[baudbot doctor] --> B{id -u == 0?}
    B -->|Yes| C[IS_ROOT=1]
    B -->|No| D[IS_ROOT=0]
    D --> E["Print: Running without root advisory"]
    C --> F[Run checks]
    E --> F
    F --> G{Check succeeds?}
    G -->|Yes| H[pass]
    G -->|No| I{IS_ROOT == 0?}
    I -->|Yes| J{Parent dir exists?}
    I -->|No root run| K[fail - genuine failure]
    J -->|Yes| L["warn: cannot verify as non-root"]
    J -->|No| K
    F --> M{Firewall check}
    M -->|iptables succeeds| N[pass]
    M -->|Fails| O{iptables exists AND not root?}
    O -->|Yes| P["warn: cannot verify firewall as non-root"]
    O -->|No| Q["warn: firewall not active"]
    F --> R{systemctl checks}
    R --> S{Capture enabled_state}
    S -->|enabled| T{Capture active_state}
    S -->|auth error + non-root| U["warn: cannot verify unit state"]
    S -->|other| V["warn: unit not installed"]
    T -->|active| W[pass]
    T -->|auth error + non-root| X["warn: cannot verify runtime"]
    T -->|other| Y["warn: agent not running"]

Loading

_{Last reviewed commit: 2e49b68}