diff --git a/mkfile b/mkfile index 4c2b922..1bf0947 100755 --- a/mkfile +++ b/mkfile @@ -38,8 +38,7 @@ data:V: scripts:V: echo === Installing scripts === - mkdir -p $HOME/.config/ollie/scripts/s $HOME/.config/ollie/scripts/b $HOME/.config/ollie/scripts/u - chmod 755 $HOME/.config/ollie/scripts/u + mkdir -p $HOME/.config/ollie/scripts/s $HOME/.config/ollie/scripts/b $HOME/.config/ollie/scripts/u $HOME/.config/ollie/scripts/x cp -f scripts/s/sh $HOME/.config/ollie/scripts/s/sh cp -f scripts/s/ls $HOME/.config/ollie/scripts/s/ls cp -f scripts/s/kill $HOME/.config/ollie/scripts/s/kill @@ -48,7 +47,8 @@ scripts:V: cp -f scripts/b/sched $HOME/.config/ollie/scripts/b/sched cp -f scripts/b/cleanup $HOME/.config/ollie/scripts/b/cleanup cp -f scripts/u/optimize $HOME/.config/ollie/scripts/u/optimize - chmod 755 $HOME/.config/ollie/scripts/u/optimize + cp -f scripts/x/elevate $HOME/.config/ollie/scripts/x/elevate + chmod 755 $HOME/.config/ollie/scripts/u/optimize $HOME/.config/ollie/scripts/x/elevate help:V: echo 'Ollie monorepo build targets:' diff --git a/prompts/08_tool-elevate.md b/prompts/08_tool-elevate.md index 7408f17..f293867 100644 --- a/prompts/08_tool-elevate.md +++ b/prompts/08_tool-elevate.md @@ -1,6 +1,6 @@ # Elevation -**Purpose**: run a bash command outside the sandbox with user approval, via the configured elevation backend (e.g. superpowers). +**Purpose**: run a bash command outside the sandbox with user approval. **Trigger condition**: any time a task requires privileges unavailable inside the sandbox — installing packages, writing to protected paths, managing system services, etc. @@ -11,7 +11,7 @@ execute_code: steps=[{code: "systemctl restart nginx", elevated: true}] ``` **Constraints**: -- `elevated: true` is a per-step flag — apply it only to steps that actually need it. Other steps in the same pipeline run normally inside the sandbox. +- `elevated: true` is a per-step flag — apply it only to steps that actually need it; other steps in the same pipeline run normally inside the sandbox. - Only bash is supported for elevated steps. -- The elevation backend must be available; if not, the step fails with "elevation not available". Do not assume elevation is always present. -- Elevated steps block until the user approves or denies the request — this is expected behavior, not an error. Use elevation whenever the task requires it; the approval prompt is the user's opportunity to review and allow the action. +- Elevation may not be available on all systems; if absent, the step fails with "elevation not available". Do not assume it is always present. +- Elevated steps block until the user approves or denies the request — this is expected, not an error. Use elevation whenever the task requires it; the prompt is the user's opportunity to review the action. diff --git a/tools/elevate_superpowers b/scripts/x/elevate similarity index 68% rename from tools/elevate_superpowers rename to scripts/x/elevate index 895b7c0..8bb6eac 100755 --- a/tools/elevate_superpowers +++ b/scripts/x/elevate @@ -1,10 +1,9 @@ #!/usr/bin/env python3 -"""Run a command elevated via superpowerd IPC (buffered output). +"""Elevation plugin: run a command outside the sandbox via superpowers. -Usage: elevate_superpowers +Usage: elevate -- -Requires SUPERPOWERD_SESSION_TOKEN in environment (set by superpowers run-session). -Exits with the elevated command's exit code. +Replace this script to use a different elevation mechanism. """ import json import os @@ -23,24 +22,25 @@ def _socket_path(): def main(): - token = os.environ.get("SUPERPOWERD_SESSION_TOKEN") - if not token: - print("elevate_superpowers: SUPERPOWERD_SESSION_TOKEN not set", file=sys.stderr) + if "SUPERPOWERD_SESSION_TOKEN" not in os.environ: + os.execvp("superpowers", ["superpowers", "run-session", "--", + sys.executable, __file__] + sys.argv[1:]) + + # sys.argv: ['elevate', '--', ''] + if len(sys.argv) < 3: + print("usage: elevate -- ", file=sys.stderr) sys.exit(1) - if len(sys.argv) < 2: - print("usage: elevate_superpowers ", file=sys.stderr) - sys.exit(1) - - cmd = sys.argv[1] + cmd = sys.argv[2] cwd = os.getcwd() + token = os.environ["SUPERPOWERD_SESSION_TOKEN"] sock_path = _socket_path() sock = socket.socket(socket.AF_UNIX, socket.SOCK_SEQPACKET) try: sock.connect(sock_path) except OSError as e: - print(f"elevate_superpowers: connect {sock_path}: {e}", file=sys.stderr) + print(f"elevate: connect {sock_path}: {e}", file=sys.stderr) sys.exit(1) req = json.dumps({ @@ -63,7 +63,7 @@ def main(): rpc_err = resp.get("error") if rpc_err: msg = rpc_err.get("message", str(rpc_err)) if isinstance(rpc_err, dict) else str(rpc_err) - print(f"elevate_superpowers: {msg}", file=sys.stderr) + print(f"elevate: {msg}", file=sys.stderr) sys.exit(1) result = resp.get("result", {})