feat(install): run dispatch service as user, not root

systemd service: User= and Group= patched by bin/install from SUDO_USER.
bin/setup-env: chowns data dirs to the real user. Since the service runs
as the user, os.homedir() resolves correctly for skills discovery —
no separate HOME env var needed.

3 files changed, 16 insertions, 7 deletions

diff --git a/bin/install b/bin/install
index 57d0684..99421f1 100755
--- a/bin/install
+++ b/bin/install
@@ -82,19 +82,24 @@ fi
 
 # ─── Install systemd service ─────────────────────────────────────────────────
 echo "[install] systemd service → /etc/systemd/system/"
-install -Dm644 "$ROOT/systemd/dispatch.service" /etc/systemd/system/dispatch.service
+# Patch User=/Group= with the real user (so it doesn't run as root)
+REAL_USER="${SUDO_USER:-$USER}"
+REAL_GROUP=$(id -gn "$REAL_USER" 2>/dev/null || echo "$REAL_USER")
+sed "s/# User\/Group are set by bin/install (patched from SUDO_USER)/User=$REAL_USER\nGroup=$REAL_GROUP/" \
+	"$ROOT/systemd/dispatch.service" > /etc/systemd/system/dispatch.service
+chmod 644 /etc/systemd/system/dispatch.service
 
 # ─── Config (don't overwrite if it exists) ───────────────────────────────────
 if [[ ! -f /etc/dispatch/env ]]; then
-	echo "[install] config → /etc/dispatch/env (edit with your API key)"
+	echo "[install] config → /etc/dispatch/env (run sudo bin/setup-env to populate)"
 	install -Dm600 "$ROOT/systemd/dispatch.env" /etc/dispatch/env
-	echo "  ⚠️  Edit /etc/dispatch/env and set DISPATCH_API_KEY before starting!"
 else
 	echo "[install] config /etc/dispatch/env already exists — keeping"
 fi
 
 # ─── Data + log directories ──────────────────────────────────────────────────
 mkdir -p /var/lib/dispatch /var/log/dispatch
+chown -R "$REAL_USER:$REAL_GROUP" /var/lib/dispatch /var/log/dispatch
 
 # ─── Enable + start ──────────────────────────────────────────────────────────
 systemctl daemon-reload
diff --git a/bin/setup-env b/bin/setup-env
index 8baf326..aeeda10 100755
--- a/bin/setup-env
+++ b/bin/setup-env
@@ -26,22 +26,26 @@ fi
 # Extract values from .env
 source "$ENV_FILE"
 
-# Resolve the real user's home dir (for skills discovery — the skills extension
-# scans ~/.skills/ via os.homedir(); under systemd as root this would be /root)
+# Resolve the real user's home dir (the service runs as this user — see bin/install)
 REAL_USER="${SUDO_USER:-$USER}"
+REAL_GROUP=$(id -gn "$REAL_USER" 2>/dev/null || echo "$REAL_USER")
 REAL_HOME=$(getent passwd "$REAL_USER" | cut -d: -f6)
 if [[ -z "$REAL_HOME" ]]; then
 	echo "setup-env: could not resolve home for user '$REAL_USER'" >&2
 	exit 1
 fi
 
+# Ensure data dirs are owned by the real user (the service runs as them)
+mkdir -p /var/lib/dispatch /var/log/dispatch
+chown -R "$REAL_USER:$REAL_GROUP" /var/lib/dispatch /var/log/dispatch
+
 # Write the system env file
 tee /etc/dispatch/env > /dev/null << EOF
 # /etc/dispatch/env — Dispatch server configuration (systemd EnvironmentFile)
 # Generated by bin/setup-env from $ENV_FILE
 # Edit manually, then: systemctl restart dispatch
 
-# ─── User environment (skills discovery uses \$HOME/.skills/) ────────────────
+# ─── User environment (service runs as $REAL_USER, homedir is correct) ───────
 HOME=$REAL_HOME
 
 # ─── Ports ───────────────────────────────────────────────────────────────────
diff --git a/systemd/dispatch.service b/systemd/dispatch.service
index 88e8352..e651fa7 100644
--- a/systemd/dispatch.service
+++ b/systemd/dispatch.service
@@ -4,12 +4,12 @@ After=network.target
 
 [Service]
 Type=simple
+# User/Group are set by bin/install (patched from SUDO_USER)
 ExecStart=/usr/bin/dispatch-server
 EnvironmentFile=/etc/dispatch/env
 WorkingDirectory=/var/lib/dispatch
 Restart=on-failure
 RestartSec=5
-# Journal the output
 StandardOutput=journal
 StandardError=journal