From f293bcf85e1745ab283c83beff1e280e4b550160 Mon Sep 17 00:00:00 2001
From: Clawdie Operator <clawdie@usb.clawdie.home.arpa>
Date: Thu, 4 Jun 2026 17:34:18 +0000
Subject: [PATCH] =?UTF-8?q?Fix=20colibri=20CLI=20for=20clawdie=20user=20?=
 =?UTF-8?q?=E2=80=94=20socket=20permissions=20+=20env?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two fixes so 'colibri status' works without root:

1. Socket chmod 660 in rc.d poststart — Unix socket connect()
   requires write permission on the socket file. The default 0755
   gives only owner write; group members (clawdie in colibri)
   need 0660 to connect.

2. COLIBRI_DAEMON_SOCKET in /etc/profile.d/clawdie.sh — the
   colibri binary looks for this env var. Without it, falls back
   to ~/.local/share/colibri-daemon/colibri-daemon.sock (wrong).
   Now set globally for all clawdie shell sessions.
---
 build.sh                     | 4 ++++
 scripts/stage-colibri-iso.sh | 4 +++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/build.sh b/build.sh
index 07a52112..4c9d8737 100755
--- a/build.sh
+++ b/build.sh
@@ -1257,6 +1257,10 @@ else
 fi
 _clawdie_path_has "${_clawdie_npm_prefix}/bin" || PATH="${_clawdie_npm_prefix}/bin:${PATH}"
 export PATH
+
+# Colibri daemon socket — needed for 'colibri' CLI without --socket
+export COLIBRI_DAEMON_SOCKET="/var/run/colibri/colibri.sock"
+
 unset _clawdie_npm_prefix
 unset _clawdie_base_path
 unset -f _clawdie_path_has 2>/dev/null || true
diff --git a/scripts/stage-colibri-iso.sh b/scripts/stage-colibri-iso.sh
index acd9d9b2..fa85c372 100755
--- a/scripts/stage-colibri-iso.sh
+++ b/scripts/stage-colibri-iso.sh
@@ -100,7 +100,9 @@ sed -i '' 's/ -u \${colibri_daemon_user} //' \
 # owned by the target user, which blocks non-root users (clawdie) from
 # running 'service colibri_daemon status'. Chmod in poststart.
 sed -i '' '/socket ready/a\
-    chmod 644 "${pidfile}" 2>/dev/null || true' \
+    chmod 644 "${pidfile}" 2>/dev/null || true
+a\
+    chmod 660 "${colibri_daemon_socket}" 2>/dev/null || true' \
     "${RC_DIR}/colibri_daemon"
 
 # Add DeepSeek API key and cache warming to daemon environment.
-- 
2.45.3