sudo and the user-space toolbox¶
angel has full sudo with a password; agent shells have no tty, so sudo fails in tool calls. Everything root-level is either pre-authorised by a scoped grant, done by the user with ! sudo …, or done by a tool that "handles sudo itself" (it prompts in the user's terminal).
Shape¶
No grant is live — /etc/sudoers.d/90-claude-maintenance (NOPASSWD snapraid + systemctl, installed 09-03 for the hardening items) was removed by the user on 2026-09-08. sudo -n now fails for everything; root work goes through a fresh scoped grant or a root-run installer/timer. Pattern for a new one is in processes/root-maintenance.
Operator tools in ~/.local/bin (all say "handles sudo itself — no prefix"):
| Tool | Does |
|---|---|
rk |
rescue kit: status · run · test · log -f · set K V · update · setup |
sr |
run the SnapRAID sync unit and report (the safe way to sync) |
gf |
fix gluetun's permanently-red healthcheck, with leak rollback |
mf |
fix swap thrashing (swappiness) |
sf |
turn off SSH password auth safely |
fbpass |
reset the Filebrowser password (stops/starts the container) |
newkey <device> |
make + authorise an SSH key, serve it via Filebrowser once. No --help: any argument, even --help, creates and authorises a key (happened 2026-10-16; revoked). Read the script instead of probing it |
training-sync <mode> |
the Garmin→Calendar scheduler wrapper |
vpn-check |
VPN egress check for the Homepage VPN tile (Homer retired 2026-10-18) |
history-backup <mode> |
restic history job: backup · weekly · drill · check · status |
restic |
0.19.1 static binary (source ~/.config/restic/env first) |
notes-sync |
commit + push the ~/Notes vault |
kicad-cli |
runs ~/Applications/KiCad.AppImage kicad-cli (10.0.7, same as the GUI); KICAD_IMAGE=kicad/kicad:<tag> forces the container |
~/eeroute/bench/run.py |
eeroute routing bench (private repo EmbeddedEra/eeroute, kicad-autorouter): replays rusefi-sti-2004 stages through kicad-autoroute and KiCadRoutingTools (venv /tmp/autorouter-research/krt), rows in bench/results/runs.jsonl. Long runs go in a transient user unit (systemd-run --user --unit=eeroute-bench-matrix …), log ~/eeroute/work/matrix.log; boards only in ~/eeroute/work (gitignored) |
*craft, *craft-cli |
storytold Craft apps (below) |
claude → ~/.local/share/claude/versions/2.1.263 · codex · gh uv uvx rg fd bat fzf delta cloudflared tunnel-client |
binaries, no apt |
Desktop apps and installs since 09-08 (verified 2026-10-14):
| What | Where | Source of truth |
|---|---|---|
| KiCad 10.0.7 AppImage | ~/Applications/kicad-10.0.7-x86_64.AppImage, symlink KiCad.AppImage, menu entry ~/.local/share/applications/kicad.desktop; upgrade = drop a new AppImage, repoint the symlink (also upgrades kicad-cli) |
ls -l ~/Applications; kicad-cli --version → 10.0.7 |
| Google Chrome 155.0.8059.39 | system .deb (dpkg, no apt); Claude extension, see claude-tooling |
google-chrome --version |
| storytold Craft apps (13: photo, vector, word, grid, pdf, deck, design, light, film, effect, sound, cad, fig) | ~/.local/opt/<app> → current version dir, CLIs ~/.local/bin/<app> and <app>-cli; user MCP servers in ~/.claude.json. craft-update.timer runs craft-setup daily 05:00 (prunes to current+previous) |
~/Notes/bin/craft-setup, systemctl --user list-timers craft-update.timer, <app>-cli --version |
Craft verification (2026-11-06): all 13 apps upgraded through craft-update.service to latest GitHub release tags, SHA256 verified; active symlinks and CLI --version / --help checked for all 13. Service succeeded; daily timer enabled and active. Details: ~/Notes/projects/craft-apps.md.
Shell (~/.bashrc managed block): cat is aliased to bat — use catp (or command cat) for plain output; dps = docker ps table; ports = ss -tulpn; git aliases gs gd gl gco gp gpl. Node via nvm (24 LTS), never set NPM_CONFIG_PREFIX.
Home-dir one-off scripts (not scheduled): fix-snapraid-sync.sh (item 06 exclusion), fix-arr-remove-completed.sh (09-03 incident remediation), cron-report.sh, torrentvpn-backup.sh (older backup; superseded by docker-backup.sh), finish-private-apps.sh, claude-start.sh, claude-kill.sh. Leftovers: docker-backup.sh.new, daemon.json.new, snapraid-sync-*.log (Feb), fsck-* (Feb).
Why this shape¶
The user wants agents to do the work with a human holding the root key. Scoped grants make the blast radius explicit and revocable; the "handles sudo itself" tools keep day-to-day operations one word long.
If you change this¶
- Hits: any new grant must pass
visudo -cfand be 0440 · the auto-mode classifier blocks root writes from subagents and firmware writes (idle3ctl -d) even from the main session — plan those as user-run lines. - Does not hit: container operations (angel is in the
dockergroup; no sudo needed).
See¶
- Source:
sudo -n -l·ls -l /etc/sudoers.d/·~/.local/bin/*headers · memorydev-env-user-space-installs.md