fix: improve privilege handling and worker environment configuration

1. Enhanced sudo credential caching in install.sh and uninstall.sh
   - Added sudo -v refresh calls before each operation requiring privileges
   - Prevents multiple password prompts during installation/uninstallation

2. Fixed TF_CONNECTION_INFO_PATH environment variable handling
   - Removed incorrect global directory setting from agent Start() method
   - Variable now correctly set per-worker as file path (not directory)
   - Each worker gets its own connection file: {connectionsDir}/{workerID}.txt

3. Added TF_LOG_PATH environment variable for tensor-fusion-worker
   - Workers now log to: {stateDir}/logs/worker-{workerID}.log
   - Added TF_LOG_LEVEL environment variable (defaults to "info")
   - Ensures worker logs are saved to specific files as required

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: andystime

internal/agent/agent.go

@@ -231,14 +231,9 @@ func (a *Agent) Start() error {
 		klog.Warningf("Failed to create connections directory: path=%s error=%v", a.connectionsDir, err)
 	}
 
-	// Set TF_CONNECTION_INFO_PATH environment variable for worker processes
+	// Note: TF_CONNECTION_INFO_PATH is set per-worker in convertToWorkerInfos() as worker-specific file path
 	// Each worker gets its own file: {connectionsDir}/{workerID}.txt
 	// Workers write connection info to their file, one line per connection (format: clientIP,clientPort,clientPID)
-	if err := os.Setenv(EnvConnectionInfoPath, a.connectionsDir); err != nil {
-		klog.Warningf("Failed to set %s env var: error=%v", EnvConnectionInfoPath, err)
-	} else {
-		klog.V(4).Infof("Set %s=%s (base dir, workers get {workerID}.txt)", EnvConnectionInfoPath, a.connectionsDir)
-	}
 
 	// Write PID file
 	if err := a.writePIDFile(); err != nil {
@@ -448,6 +443,16 @@ func (a *Agent) convertToWorkerInfos(apiWorkers []api.WorkerConfig) ([]*hvApi.Wo
 		envVars["TF_ENABLE_LOG"] = "1"
 		envVars[EnvURLAuth] = "1"
 		envVars[EnvAuthorizedKeyPath] = filepath.Join(a.paths.ConfigDir(), w.WorkerID+"_share_codes")
+
+		// Set TF_LOG_PATH for tensor-fusion-worker to save logs to a specific file
+		logsDir := filepath.Join(a.config.StateDir(), "logs")
+		if err := os.MkdirAll(logsDir, 0755); err != nil {
+			klog.Warningf("Failed to create logs directory: path=%s error=%v", logsDir, err)
+		}
+		workerLogPath := filepath.Join(logsDir, "worker-"+w.WorkerID+".log")
+		envVars["TF_LOG_PATH"] = workerLogPath
+		envVars["TF_LOG_LEVEL"] = getEnvWithDefault("TF_LOG_LEVEL", "info")
+
 		// Set TF_CONNECTION_INFO_PATH to the worker's specific connection file (not directory)
 		// Worker will write connection info to this file, one line per connection
 		envVars[EnvConnectionInfoPath] = filepath.Join(a.connectionsDir, w.WorkerID+".txt")
@@ -1425,3 +1430,11 @@ func GetLocalStatus(paths *platform.Paths) LocalStatus {
 
 	return LocalStatus{Running: true, PID: pid}
 }
+
+// getEnvWithDefault gets an environment variable or returns a default value
+func getEnvWithDefault(key, defaultValue string) string {
+	if value := os.Getenv(key); value != "" {
+		return value
+	}
+	return defaultValue
+}

scripts/install.sh

@@ -200,8 +200,13 @@ setup_systemd_service() {
 
     # Require sudo for systemd operations
     require_sudo_for_systemd
-    
+
     SUDO=$(get_sudo)
+
+    # Refresh sudo timestamp to prevent password prompts during installation
+    if [ -n "${SUDO}" ]; then
+        ${SUDO} -v || fatal "Failed to refresh sudo credentials"
+    fi
 
     # Build environment variables section
     ENV_VARS=""
@@ -301,6 +306,11 @@ register_agent() {
 
     # Get sudo command (empty if already root)
     SUDO=$(get_sudo)
+
+    # Refresh sudo timestamp to prevent password prompts during registration
+    if [ -n "${SUDO}" ]; then
+        ${SUDO} -v || fatal "Failed to refresh sudo credentials"
+    fi
 
     # Build register command
     # Use sudo to ensure config is saved to root's home directory (~/.gpugo/config)
@@ -393,6 +403,11 @@ main() {
 
     # Check if we need sudo
     SUDO=$(get_sudo)
+
+    # Refresh sudo timestamp to prevent password prompts during installation
+    if [ -n "${SUDO}" ]; then
+        ${SUDO} -v || fatal "Failed to refresh sudo credentials"
+    fi
 
     # Create install directory if needed
     if [ ! -d "${INSTALL_DIR}" ]; then

scripts/uninstall.sh

@@ -71,6 +71,16 @@ remove_systemd_service() {
 
     info "Stopping systemd service..."
     SUDO=$(get_sudo)
+
+    # Refresh sudo timestamp to prevent password prompts during removal
+    if [ -n "${SUDO}" ]; then
+        ${SUDO} -v 2>/dev/null || true
+    fi
+
+    # Refresh sudo timestamp to prevent password prompts during removal
+    if [ -n "${SUDO}" ]; then
+        ${SUDO} -v 2>/dev/null || true
+    fi
 
     # Stop service
     ${SUDO} systemctl stop "${SYSTEMD_SERVICE_NAME}" 2>/dev/null || true
@@ -107,6 +117,11 @@ remove_launchd_service() {
     if [ -f "${PLIST_FILE_SYSTEM}" ]; then
         info "Stopping launchd system daemon..."
         SUDO=$(get_sudo)
+
+    # Refresh sudo timestamp to prevent password prompts during removal
+    if [ -n "${SUDO}" ]; then
+        ${SUDO} -v 2>/dev/null || true
+    fi
         ${SUDO} launchctl unload "${PLIST_FILE_SYSTEM}" 2>/dev/null || true
         ${SUDO} rm -f "${PLIST_FILE_SYSTEM}"
         info "System launch daemon removed!"
@@ -138,6 +153,11 @@ remove_binary() {
     info "Removing binary at ${BINARY_PATH}..."
 
     SUDO=$(get_sudo)
+
+    # Refresh sudo timestamp to prevent password prompts during removal
+    if [ -n "${SUDO}" ]; then
+        ${SUDO} -v 2>/dev/null || true
+    fi
 
     # Check if we need sudo
     if [ -w "$(dirname "${BINARY_PATH}")" ]; then
@@ -165,6 +185,11 @@ remove_config() {
 
     # System config (Linux)
     SUDO=$(get_sudo)
+
+    # Refresh sudo timestamp to prevent password prompts during removal
+    if [ -n "${SUDO}" ]; then
+        ${SUDO} -v 2>/dev/null || true
+    fi
     SYSTEM_DIRS="/var/lib/ggo /etc/ggo"
 
     for dir in ${SYSTEM_DIRS}; do
@@ -273,6 +298,11 @@ unregister_from_server() {
     local unregister_result=0
     if [ "${needs_sudo}" = "true" ]; then
         SUDO=$(get_sudo)
+
+    # Refresh sudo timestamp to prevent password prompts during removal
+    if [ -n "${SUDO}" ]; then
+        ${SUDO} -v 2>/dev/null || true
+    fi
         if [ -n "${SUDO}" ]; then
             ${SUDO} "${binary_path}" agent unregister --force 2>/dev/null || unregister_result=$?
         else