[DEBUG] Phase 4: Investigate Installation Behavior - Tools Already Present vs Failed Install

[pierreribeiro]

Phase 4 Debug Session - Installation Investigation

Problem Statement

User reports Phase 4 playbook execution "completed but nothing installed". Need to determine if:

1. Tools were already installed (idempotency working correctly)
2. Actual installation failure occurred

Evidence Gathered

Test Case Output Analysis

File: phase4-test-case-output.txt

Pre-flight checks: ✅ PASS

• Homebrew installed: /home/linuxbrew/.linuxbrew/bin/brew
• Repository state: feature/phase-4-language-runtimes branch
• Files exist: All role task files present
• Feature flags: All enabled (install_python_stack: true, etc.)

Check Mode Results: ALL tasks skipped due to existing installations

skipping: [localhost] => {"false_condition": "python_check.rc != 0"}
skipping: [localhost] => {"false_condition": "rust_check.rc != 0"}
skipping: [localhost] => {"false_condition": "bun_check.rc != 0"}
skipping: [localhost] => {"false_condition": "fnm_check.rc != 0"}

Hypothesis

Primary: Tools already installed from previous manual setup

• Idempotency checks: brew list python@3.12, brew list rust, etc.
• All return rc=0 (found) → installation tasks skip
• This is expected behavior for idempotent playbooks

Alternative: False positive from check mode

• Need actual execution (--check removed) to confirm

Required Actions

1. Verify Current Tool Status

# Check if tools actually exist
python3 --version
uv --version
rustc --version
cargo --version
bun --version
fnm --version
node --version  # May require fnm env initialization
pnpm --version

2. Run Actual Installation (Not Check Mode)

cd ~/claude-code-dev-box
ansible-playbook playbooks/main.yml --tags phase4 -vv

Expected Outcomes:

• If tools exist: All tasks show "ok: [localhost]" (skipped, idempotent)
• If missing: Tasks show "changed: [localhost]" (installed)
• If error: Actual error message appears

3. Capture Full Log

ansible-playbook playbooks/main.yml --tags phase4 -vvvv > phase4-actual-run.log 2>&1

Decision Tree

Tool verification (`which python3`, etc.)
    |
    ├─ All tools found → Issue: False alarm, idempotency working
    |   └─ Resolution: Document expected behavior, close issue
    |
    └─ Tools missing → Issue: Real installation failure
        |
        ├─ Run actual playbook (no --check)
        |   |
        |   ├─ Installs successfully → Issue: Check mode confusion
        |   |   └─ Resolution: Document check mode behavior
        |   |
        |   └─ Fails with error → Issue: Real bug
        |       └─ Action: Debug specific task failure

Migration Context

• Previous Session: Phase 4 implementation complete (8 commits)
• Token Usage: 103.5K/190K (54.5%)
• Files Created: All role files present and validated
• Git State: feature/phase-4-language-runtimes (clean)

Next Steps

1. User provides tool verification output
2. Execute actual playbook (not check mode)
3. Analyze results
4. Update issue with findings
5. Proceed based on decision tree

Related Artifacts

• Migration Doc: phase-4-debug-migration.md
• Test Output: phase4-test-case-output.txt
• Control Doc: docs/control/phase-4-control.md

---

Status: Investigation in progress
Priority: P1 - Blocking Phase 5+
Assignee: @pierreribeiro
Labels: debug, phase-4, investigation

[pierreribeiro]

🔴 ROOT CAUSE IDENTIFIED - Permission Escalation Issue

Critical Finding

Problem: Ansible is running as ROOT user, not as pierrecr

Evidence from actions-output.txt:

TASK [Display environment information]
ok: [localhost] => {
    "msg": [
        "Setting up development environment for root",  ← WRONG USER!
        "Home directory: /root",                         ← WRONG HOME!
        "Ubuntu version: 24.04"
    ]
}

Fatal Error:

PermissionError: [Errno 13] Permission denied: b'/root/.bashrc'
fatal: [localhost]: FAILED! => {
    "msg": "The destination directory (/root) is not writable by the current user."
}

Why This Happened

User's Questions Answered:

Q1: "Why is it switching to root?"

• Ansible playbook has become: yes at play level
• This elevates ALL tasks to root (sudo)
• Correct for system packages, WRONG for Homebrew

Q2: "Why is it trying to write to /root directory?"

• Running as root → ansible_env.HOME = /root
• Should be: pierrecr user → /home/pierrecr
• Homebrew is USER-level tool, not system-level

Q3: "Why add Homebrew config again?"

• Task is idempotent (checks if line exists first)
• BUT target directory is wrong (root vs pierrecr)

Technical Analysis

Current Playbook Structure (BROKEN)

# playbooks/main.yml
- name: WSL2 Ubuntu Development Environment Setup
  hosts: localhost
  become: yes  ← PROBLEM: All tasks run as root

What Should Happen

• Phase 1-2 (System packages, Homebrew): Run as ROOT ✅
• Phase 3+ (User tools): Run as PIERRECR ❌

Why Tools Not Installed

1. Homebrew role fails at shell config → playbook stops
2. Never reaches language_runtimes role
3. No tools installed

The Fix

Strategy: Task-Level Privilege Control

BAD (Current):

- name: Play
  become: yes  # All tasks root - breaks Homebrew
  roles:
    - homebrew
    - language_runtimes

GOOD (Fixed):

- name: Play
  become: no   # Default to user
  roles:
    - role: homebrew
      become: no  # Homebrew as user
    - role: language_runtimes
      become: no  # Language tools as user

Required Changes

1. Fix Playbook (playbooks/main.yml)

---
- name: WSL2 Ubuntu Development Environment Setup
  hosts: localhost
  gather_facts: yes
  become: no  # CHANGED: Default to user context
  
  vars_files:
    - ../inventory/group_vars/all.yml
  
  pre_tasks:
    - name: Display environment information
      debug:
        msg:
          - "Setting up development environment for {{ ansible_user_id }}"
          - "Home directory: {{ ansible_env.HOME }}"
          - "Ubuntu version: {{ ubuntu_version }}"
      tags: [always]
    
    - name: Verify Ubuntu version
      assert:
        that:
          - ansible_distribution == "Ubuntu"
          - ansible_distribution_version == ubuntu_version
        fail_msg: "This playbook requires Ubuntu {{ ubuntu_version }}"
        success_msg: "Ubuntu version check passed"
      tags: [always]
  
  roles:
    - role: system_preparation
      become: yes  # EXPLICIT: System packages need root
      when: install_system_packages | bool
      tags: [phase1, system]
    
    - role: homebrew
      become: no   # EXPLICIT: Homebrew as user
      when: install_homebrew | bool
      tags: [phase2, homebrew]
    
    - role: core_tools
      become: no   # EXPLICIT: User tools
      when: install_core_tools | bool
      tags: [phase3, core-tools]
    
    - role: language_runtimes
      become: no   # EXPLICIT: User tools
      when: install_python_stack | bool or install_nodejs_stack | bool or install_rust_stack | bool or install_bun | bool
      tags: [phase4, languages, runtimes]

2. Fix Homebrew Role (Safety)

Add explicit become: no to tasks that must run as user:

# roles/homebrew/tasks/main.yml
---
- name: Check if Homebrew is already installed
  stat:
    path: "{{ homebrew_bin }}/brew"
  register: homebrew_check
  become: no  # EXPLICIT: Check as user

- name: Install Homebrew
  shell: |
    NONINTERACTIVE=1 /bin/bash /tmp/homebrew-install.sh
  args:
    creates: "{{ homebrew_bin }}/brew"
  when: not homebrew_check.stat.exists
  become: no  # EXPLICIT: Install as user

3. Verify Variable Resolution

# inventory/group_vars/all.yml
# Current (BROKEN):
dev_user: "{{ ansible_user_id }}"  # Returns 'root' when become=yes
dev_home: "{{ ansible_env.HOME }}"  # Returns '/root' when become=yes

# Fixed (EXPLICIT):
dev_user: "pierrecr"                 # Hardcoded actual user
dev_home: "/home/pierrecr"           # Hardcoded actual home

Validation Plan

After Fix Applied:

# Should show 'pierrecr', not 'root'
ansible-playbook playbooks/main.yml --tags phase2 -vv | grep "Setting up"

# Should complete without permission errors
ansible-playbook playbooks/main.yml --tags phase2,phase4

# Verify installations
which uv rustc cargo bun fnm pnpm

Lessons Learned

1. Privilege Principle: Only elevate when truly needed (system packages)
2. User Tools: Homebrew, language managers are USER-level, not ROOT
3. Variable Context: ansible_user_id changes based on become state
4. Early Detection: Should have caught this in Phase 2 (Homebrew)

Next Actions

1. Create hotfix branch: hotfix/privilege-escalation-fix
2. Apply playbook + role fixes
3. Test Phase 2 + 4 together
4. Verify all tools install correctly
5. Document privilege strategy in PRD

---

Status: Root cause identified, fix designed
Impact: All future phases affected
Priority: P0 - Must fix before continuing

[pierreribeiro]

✅ HOTFIX IMPLEMENTED

Implementation Complete

Branch: hotfix/privilege-escalation-fix
Commit: 27533ae
PR: #7

Changes Applied

1. Playbook Fixed (playbooks/main.yml)

- become: yes  # All tasks as root (BROKEN)
+ become: no   # Default to user (FIXED)

  roles:
    - role: system_preparation
+     become: yes  # Explicit: needs root
    
    - role: homebrew
+     become: no   # Explicit: user tool
    
    - role: language_runtimes
+     become: no   # Explicit: user tool

2. Variables Fixed (inventory/group_vars/all.yml)

- dev_user: "{{ ansible_user_id }}"  # Dynamic (breaks with become: yes)
- dev_home: "{{ ansible_env.HOME }}"  # Dynamic (breaks with become: yes)
+ dev_user: "pierrecr"                # Explicit (always correct)
+ dev_home: "/home/pierrecr"          # Explicit (always correct)

3. Shell Detection

- shell_type: "zsh"  # Assumed
+ shell_type: "bash" # User's actual shell

Validation Instructions

Local Testing

cd ~/claude-code-dev-box

# Pull hotfix branch
git fetch origin
git checkout hotfix/privilege-escalation-fix
git pull origin hotfix/privilege-escalation-fix

# Run validation script
chmod +x scripts/validate-hotfix.sh
./scripts/validate-hotfix.sh

Manual Verification

# Should show 'pierrecr' NOT 'root'
ansible-playbook playbooks/main.yml --tags phase2 -vv | grep "Setting up"

# Should complete without errors
ansible-playbook playbooks/main.yml --tags phase2,phase4

# Verify all tools installed
python3 --version
uv --version
rustc --version
cargo --version
bun --version
fnm --version
node --version
pnpm --version

Expected Results

✅ Success Indicators

• Environment info shows "pierrecr" not "root"
• HOME shows "/home/pierrecr" not "/root"
• No "Permission denied" errors
• All 8 tools install successfully
• Idempotence test passes (re-run = no changes)

❌ Failure Indicators (Debug Needed)

• Still shows "root" in output
• Permission denied errors
• Tools not installed
• Playbook fatal errors

Next Actions

1. User validates locally (run validation script)
2. If tests pass: Approve PR fix(privilege): Fix privilege escalation bug - run as user not root #7
3. Merge PR: Squash merge to develop
4. Clean up: Delete hotfix branch
5. Continue: Phase 5 can proceed

Files for Download

Validation Script: Available in PR or download from:

# In repository after merge
scripts/validate-hotfix.sh

---

Status: Implementation complete, awaiting user validation
Blocker Removed: Phase 4 can now proceed
Phase 5+: Unblocked after validation passes