office: refuse to run as root, and write the wrapper with the real home path so sudo cannot hide it

bin/office

@@ -228,10 +228,25 @@ def is_this_machine(name):
 
 
 def install_wrapper(addr, remote_bin):
-    """Leave a short `office` on the other machine's PATH, pointing at the copy."""
+    """Leave a short `office` on the other machine's PATH, pointing at the copy.
+
+    The path is written out in full rather than using $HOME, because $HOME is
+    /root under sudo and the wrapper then looks for a copy that is not there.
+    """
+    home = subprocess.run(["ssh", "-o", "BatchMode=yes", addr, 'printf %s "$HOME"'],
+                          capture_output=True, text=True, timeout=60).stdout.strip()
+    if not home:
+        return
     script = ("#!/bin/sh\n"
               "# Written by office on another machine. Runs the copy it keeps here.\n"
-              'exec "$HOME/.local/share/paperclip-harness/bin/office" "$@"\n')
+              "#\n"
+              "# Run this as your own user, never with sudo: it talks to your TUIOS\n"
+              "# daemon and to your Paperclip key, and neither exists for root.\n"
+              'if [ "$(id -u)" = "0" ]; then\n'
+              '  echo "office: run this as your own user, not with sudo." >&2\n'
+              '  exit 2\n'
+              'fi\n'
+              'exec "%s/office" "$@"\n' % (home + "/.local/share/paperclip-harness/bin"))
     subprocess.run(["ssh", "-o", "BatchMode=yes", addr,
                     "mkdir -p \"$HOME/.local/bin\" && cat > \"$HOME/.local/bin/office\" && chmod +x \"$HOME/.local/bin/office\""],
                    input=script, text=True, capture_output=True, timeout=60)
@@ -575,6 +590,11 @@ def note_ignore(folder, opts):
 
 
 def main():
+    if os.geteuid() == 0:
+        h.say("office: run this as your own user, not with sudo.")
+        h.say("  it reads your Paperclip key and asks your TUIOS daemon to make panes;")
+        h.say("  neither of those exists for root, and files it wrote would belong to root.")
+        return 2
     argv = sys.argv[1:]
     if not argv or "-h" in argv or "--help" in argv:
         h.say(USAGE.strip())