Fix mcp logs permission error for rootless podman journald driver

Rootless podman writes container logs to the user journal, but
journalctl without --user only reads the system journal. Add --user
when the agent is running as a non-root user.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cmd/mcp/edit.go

@@ -0,0 +1,12 @@
+package main
+
+import "github.com/spf13/cobra"
+
+func editCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "edit <service>",
+		Short: "Open service definition in $EDITOR",
+		Args:  cobra.ExactArgs(1),
+		RunE:  runServiceEdit,
+	}
+}

cmd/mcp/main.go

@@ -51,6 +51,7 @@ func main() {
 	root.AddCommand(nodeCmd())
 	root.AddCommand(purgeCmd())
 	root.AddCommand(logsCmd())
+	root.AddCommand(editCmd())
 
 	if err := root.Execute(); err != nil {
 		log.Fatal(err)

flake.nix

@@ -10,7 +10,7 @@
     let
       system = "x86_64-linux";
       pkgs = nixpkgs.legacyPackages.${system};
-      version = "0.6.0";
+      version = pkgs.lib.removePrefix "v" (self.gitDescribe or self.shortRev or self.dirtyShortRev or "unknown");
     in
     {
       packages.${system} = {

internal/runtime/podman.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"os"
 	"os/exec"
 	"strings"
 	"time"
@@ -207,8 +208,14 @@ func (p *Podman) Logs(ctx context.Context, containerName string, tail int, follo
 }
 
 // journalLogs returns a journalctl command filtered by container name.
+// For rootless podman, container logs go to the user journal, so we
+// need --user to read them.
 func (p *Podman) journalLogs(ctx context.Context, containerName string, tail int, follow bool, since string) *exec.Cmd {
-	args := []string{"--no-pager", "--output", "cat", "CONTAINER_NAME=" + containerName}
+	args := []string{"--no-pager", "--output", "cat"}
+	if os.Getuid() != 0 {
+		args = append(args, "--user")
+	}
+	args = append(args, "CONTAINER_NAME="+containerName)
 	if tail > 0 {
 		args = append(args, "--lines", fmt.Sprintf("%d", tail))
 	}