#120 fix(npm): stop `sudo meridian update` breaking launchd; elevate only the npm step

[Anonymous]

Originally created by: adityaharishch

Bug (found during the npm install test)

meridian update install per-user launchd agents (gui/$UID) and write ~/.meridian — they must run as the user. But update also runs npm install -g, which needs root on a /usr/local npm prefix. So users reach for sudo meridian update, which runs the whole thing as root:

• launchd bootstrap fails: Bootstrap failed: 125: Domain does not support specified action
• pip can't use the user cache
• ~/.meridian fills with root-owned files → broken, half-installed state (exactly what happened in testing)

Fix — never run setup/update as root; elevate only the step that needs it

• bin/meridian.js (launcher): refuse to run as root (any command) with a clear, actionable message — every Meridian command is per-user. In update, install the global package via plain npm when the prefix is user-writable, else via sudo npm install -g for just that step (one password prompt), then run setup as the user so launchd succeeds.
• install-from-bundle.sh: refuse root as a safety net (direct invocation), and elevate the lone npm install -g screenpipe step the same way — so a no-sudo fresh install still works on a /usr/local prefix.

Verification

• node --check + bash -n: clean
• Simulated getuid()===0 → launcher prints the refusal and exits 1 instead of proceeding (no more broken half-install).

Note

The remaining open finding from the install test is [#4] (screenpipe launched via the node-wrapper, so macOS attaches Screen Recording to node instead of screenpipe). Tracked separately.

🤖 Generated with Claude Code

[Anonymous]

Ticket changed by: adityaharishch

• status: open --> closed

[Anonymous]

Originally posted by: adityaharishch

🎉 This PR is included in version 1.9.2 🎉

The release is available on:

• v1.9.2
• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀