feat(cli): route privileged provisioning through graphical sudo (askpass)#56
Merged
Conversation
…ass) Implements the "Shared graphical sudo (askpass) security contract — locked v1" (#27, shared with pickforge/pickforge#215/#258): a pure four-state capability detector (available/no-helper/headless/ unsupported-platform) gated to Linux, wired into the provisioning executor so privileged steps run `sudo -A` with an explicit SUDO_ASKPASS — the only env var this feature injects — instead of the prior ad hoc `sudo -n`. Missing capability fails preflight, before any mutation, with an actionable error naming the manual `sudo ...` fallback; sudo-level denial/cancellation at runtime (detected from sudo's own `sudo:`-prefixed diagnostics, never prompt text) surfaces as a distinct `cancelled` status with no retry. Reconciled with the existing no-sudo policy: MCP tools still never import provisioning code or touch sudo (unchanged, still enforced by test/security/security-no-sudo.test.ts); the CLI's privileged-step path remains the sole, explicit, consent-gated sudo entry point. Also fixes a section-level privilegeUnavailable.reason override (written only for the pre-existing "sudo missing" case) from masking the new, correct askpass-unavailable message with a stale "sudo not found" one.
…refix Add status (mirrors ExecuteProvisioningResult.status) to SetupLabUserReport, InitReport, and the doctor --fix report, so --json consumers can tell a sudo-cancelled run apart from declined/failed without string-matching. Fix prepareSections dropping a section's "lab-user: "/"avd: " skip-reason context for an askpass-unavailable failure (it only ever applied to the older sudo-missing case). Sections can now supply an optional privilegeUnavailable.context prefix that askpass-unavailable reasons honor too, restoring parity with sibling skip reasons in doctor --fix.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements #27 per the locked v1 shared askpass contract (pinned on the issue), mirroring the pickforge#215/#258 sibling semantics:
provision/askpass.ts): graphical session + userSUDO_ASKPASSif executable else the fixed probe list; Linux-only, fail-closedProvisioningStep.privilegednow materializes as arg-arraysudo -AwithSUDO_ASKPASSas the only injected env key (hostile config values structurally cannot become sudo options — argv-position verified in review); oldsudo -npath removedcancelledstate via sudo's own diagnostics, no retry, redactedstatusfor machine consumersRefs #27 — issue stays open for the formally-signed-off hardware smoke (real
sudo -A -vsuccess + cancellation on Elberte-PC, RC phase; sign-off recorded on the issue). No feature flag: self-contained.Validation
Local review: serious security class — Opus 4.8 (security/trust: clean), Sonnet 5 (correctness: clean + the smoke-deferral P2 resolved by explicit sign-off), Sonnet 5 (conformance: clean, clause-by-clause table on the issue's contract); 2 accepted P3s fixed in
b6e3a87. KISS keep ×3.