ask-local 0.1.1 → 0.2.1

data/lib/ask/local/cli/system.rb

@@ -41,6 +41,15 @@ module Ask
             hostnames = ctx.store.load_routes.map { |r| r["hostname"] }
             if Hosts.sync(hostnames)
               puts "Synced #{hostnames.length} hostname(s) to /etc/hosts."
+            elsif !ProxyControl.root? && !hostnames.empty?
+              # /etc/hosts is root-owned; once the root service is
+              # installed the guidance is "run ask-local hosts sync" — so
+              # make that command work by re-running it elevated.
+              puts "Writing /etc/hosts needs root — re-running elevated..."
+              state = Certs.state_dir
+              cmd = ["env", "ASK_LOCAL_STATE_DIR=#{state}", RbConfig.ruby,
+                ProxyControl.bin_path, "hosts", "sync"]
+              exit(elevate(cmd) ? 0 : 1)
             else
               $stderr.puts "Could not write /etc/hosts (try sudo)."
               exit 1
@@ -136,31 +145,111 @@ module Ask
         def service(ctx, args)
           sub = args.first
           case sub
-          when "install" then service_install(ctx, args)
-          when "uninstall" then service_uninstall
+          when "install" then exit(service_install(ctx, args) ? 0 : 1)
+          when "uninstall" then exit(service_uninstall(ctx) ? 0 : 1)
           when "status" then service_status(ctx)
           else raise Error, "Usage: ask-local service [install|uninstall|status]"
           end
         end
 
+        # Print the scoped passwordless-sudo rules that let `service install`
+        # (and only it) run without a prompt. The service re-execs the whole
+        # gem under sudo, so the safe NOPASSWD grants exactly the gem path +
+        # subcommand for the current user — never a bare interpreter. This is
+        # how agents and repeat machines get clean :443 without a TTY.
+        #
+        #   macOS: sudo install -o root -g wheel -m 440 <(ask-local sudoers) /etc/sudoers.d/ask-local
+        #   Linux: sudo install -o root -g root -m 440 <(ask-local sudoers) /etc/sudoers.d/ask-local
+        def sudoers(_ctx, _args)
+          require "etc"
+          ruby = RbConfig.ruby
+          bin = ProxyControl.bin_path
+          user = ENV.fetch("USER", Etc.getlogin)
+          puts <<~SUDOERS
+            # ask-local: let #{user} install/run the privileged proxy on port 443
+            # without a password prompt. Scoped to ask-local's own service
+            # re-exec — the gem path above, not a bare interpreter.
+            #{user} ALL=(root) NOPASSWD: #{ruby} #{bin} service install --internal
+            #{user} ALL=(root) NOPASSWD: #{ruby} #{bin} service uninstall --internal
+          SUDOERS
+        end
+
         # Root-owned LaunchDaemon binding 80/443 at boot (puma-dev model).
-        # Re-execs under sudo; the proxy runs with the invoking user's state
-        # dir so routes registered by unprivileged CLIs are shared
-        # (portless pattern). A root proxy can also write /etc/hosts.
+        # Non-root runs re-exec under sudo once (--internal marks the root
+        # half); the proxy runs with the invoking user's state dir so
+        # routes registered by unprivileged CLIs are shared. The root half
+        # can also write /etc/hosts.
+        #
+        # Non-interactive runs (agents, CI) use `sudo -n`: never prompts,
+        # succeeds only when the scoped NOPASSWD grant from `ask-local
+        # sudoers` is installed, and fails fast with guidance otherwise.
+        # Interactive runs use plain sudo (one password, then the service
+        # is installed for good).
+        #
+        # Returns true when the service is installed. No exit here: the
+        # bare `service install` CLI exits in `service`, while `setup`
+        # keeps going (hosts sync, doctor) after a successful install.
         def service_install(ctx, args)
-          if !ProxyControl.root? && !args.include?("--internal")
+          if ProxyControl.root?
+            install_service!(ctx)
+          elsif args.include?("--internal")
+            raise Error, "`service install --internal` is the root half of the sudo re-exec — run `ask-local service install`"
+          else
             puts "Installing system service (sudo required)..."
             state = Certs.state_dir
-            ok = system("sudo", "env", "ASK_LOCAL_STATE_DIR=#{state}",
+            cmd = ["env", "ASK_LOCAL_STATE_DIR=#{state}",
               RbConfig.ruby, ProxyControl.bin_path,
-              "service", "install", "--internal")
-            exit(ok ? 0 : 1)
+              "service", "install", "--internal"]
+            elevate(cmd)
           end
+        end
+
+        def install_service!(ctx)
           case RUBY_PLATFORM
           when /darwin/ then install_launchd(ctx)
-          when /linux/ then print_linux_unit
+          when /linux/ then install_systemd
           else raise Error, "Service install not supported on #{RUBY_PLATFORM}"
           end
+          # Root can write /etc/hosts, so sync the routes registered so
+          # far while elevated — Safari works the moment setup finishes
+          # (Chrome resolves *.localhost natively).
+          sync_hosts_from_routes(ctx)
+          true
+        end
+
+        def sync_hosts_from_routes(ctx)
+          hostnames = ctx.store.load_routes.map { |r| r["hostname"] }
+          if hostnames.empty?
+            puts "    No routes registered yet — hosts sync will happen on the next boot."
+          elsif Ask::Local::Hosts.sync(hostnames)
+            puts "    Synced #{hostnames.length} hostname(s) to /etc/hosts."
+          else
+            warn "    could not write /etc/hosts (run `sudo ask-local hosts sync` later)"
+          end
+        end
+
+        # Run a privileged command via sudo. Interactive: plain sudo (one
+        # prompt). Non-interactive: `sudo -n` — no prompt ever; requires the
+        # NOPASSWD grant from `ask-local sudoers`. On failure prints the
+        # provisioning hint so agents/CI know exactly what to install.
+        def elevate(cmd)
+          interactive = $stdin.tty? && ENV["CI"].nil?
+          sudo_args = interactive ? ["sudo"] : ["sudo", "-n"]
+          ok = Command.run(*sudo_args, *cmd)
+          return true if ok
+
+          # An interactive sudo failure is auth or the elevated command
+          # itself (whose error is already on screen) — re-run and read it.
+          # The scoped-grant hint only helps passwordless non-interactive
+          # runs, where a missing NOPASSWD rule is the usual cause.
+          if interactive
+            $stderr.puts "sudo failed — re-run `ask-local setup` to try again."
+          else
+            $stderr.puts "sudo failed — install the scoped grant once:"
+            $stderr.puts "  ask-local sudoers > /tmp/ask-local.sudoers"
+            $stderr.puts "  sudo install -o root -g wheel -m 440 /tmp/ask-local.sudoers /etc/sudoers.d/ask-local"
+          end
+          false
         end
 
         def user_home_for_service
@@ -206,17 +295,62 @@ module Ask
           path = File.join(dir, "dev.ask.local.plist")
           File.write(path, plist)
           File.chmod(0o644, path)
-          Ownership.chown_service_files(path)
-          system("launchctl", "unload", path) rescue nil
-          system("launchctl", "load", path) or raise Error, "launchctl load failed"
+          # launchd requires /Library/LaunchDaemons plists to be
+          # root-owned; we are root here (sudo re-exec). Enforce it
+          # explicitly: File.write keeps an existing file's owner, so a
+          # stale user-owned plist from an older version would otherwise
+          # survive the overwrite and bootstrap fails with error 5.
+          # Trust the CA into the System keychain while elevated: silent
+          # (no GUI popup) and trusted for every user on the machine.
+          File.chown(0, 0, path) if Process.uid.zero?
+          ensure_system_ca_trust
+          puts "    Registering the launchd service on port 443..."
+          launchctl_bootstrap(path)
           puts "Installed root LaunchDaemon on port 443 (state: #{state_dir})."
-          puts "Restart your machine or run: sudo launchctl load #{path}"
         end
 
-        def print_linux_unit
+        # Root-only CA trust: the System keychain (all users, no prompt).
+        # Safe to call repeatedly — once the marker is set it is a no-op.
+        # Prints before doing work: the System keychain add can take a few
+        # seconds, and this runs in the root half of setup where silence
+        # reads as a hang.
+        def ensure_system_ca_trust
+          return if Certs.trusted?(Certs.state_dir)
+
+          puts "    Trusting the CA into the System keychain..."
+          result = Trust.trust
+          warn "    CA trust warning: #{result[:error]}" unless result[:trusted]
+        end
+
+        # Modern launchctl system-domain verbs. The legacy `launchctl load`
+        # is rejected by current macOS with error 5 (Input/output error) —
+        # and worse, it can print that error while still exiting 0, so the
+        # old code "succeeded" without the service actually running.
+        # bootstrap/bootout are the supported verbs (same as puma-dev and
+        # portless); extracted so the command sequence is unit-testable.
+        def launchctl_bootstrap(path)
+          # Best-effort: booting out a service that was never loaded prints
+          # "Boot-out failed: 5" — nothing to clear then, so keep it quiet.
+          # Any real leftover is removed silently; bootstrap errors below
+          # stay loud.
+          Command.run("launchctl", "bootout", "system", path, out: File::NULL, err: File::NULL)
+          unless Command.run("launchctl", "bootstrap", "system", path)
+            raise Error, "launchctl bootstrap failed — check the plist at #{path}"
+          end
+          Command.run("launchctl", "enable", "system/dev.ask.local")
+          Command.run("launchctl", "kickstart", "-k", "system/dev.ask.local")
+        end
+
+        def launchctl_bootout(path)
+          Command.run("launchctl", "bootout", "system", path)
+        end
+
+        # Pure unit-file builder (testable without root). Binds 80/443 at
+        # boot; the proxy runs with the invoking user's state dir.
+        def systemd_unit
           home = user_home_for_service
           state_dir = ENV["ASK_LOCAL_STATE_DIR"] || File.join(home, ".ask-local")
-          puts <<~UNIT
+          <<~UNIT
             # /etc/systemd/system/ask-local.service  (binds 80/443 at boot)
             [Unit]
             After=network.target
@@ -228,28 +362,46 @@ module Ask
 
             [Install]
             WantedBy=multi-user.target
-
-            Install with: sudo cp ask-local.service /etc/systemd/system/ && sudo systemctl enable --now ask-local
-            (Run that install command with sudo so the service is root-owned.)
           UNIT
         end
 
-        def service_uninstall(_ctx)
+        # Install + start the systemd unit (mirrors portless). We are root
+        # here (sudo re-exec). The unit is written root-owned, then enabled
+        # and started.
+        def install_systemd
+          unit_path = "/etc/systemd/system/ask-local.service"
+          File.write(unit_path, systemd_unit)
+          File.chmod(0o644, unit_path)
+          File.chown(0, 0, unit_path) if Process.uid.zero?
+          puts "    Registering the systemd service on port 443..."
+          Command.run("systemctl", "daemon-reload") or raise Error, "systemctl daemon-reload failed"
+          Command.run("systemctl", "enable", "--now", "ask-local") or raise Error, "systemctl enable failed"
+          puts "Installed systemd service ask-local on port 443."
+        end
+
+        def service_uninstall(ctx)
           if !ProxyControl.root?
+            puts "Removing system service (sudo required)..."
             state = Certs.state_dir
-            ok = system("sudo", "env", "ASK_LOCAL_STATE_DIR=#{state}",
-              RbConfig.ruby, ProxyControl.bin_path, "service", "uninstall", "--internal")
-            exit(ok ? 0 : 1)
+            cmd = ["env", "ASK_LOCAL_STATE_DIR=#{state}",
+              RbConfig.ruby, ProxyControl.bin_path, "service", "uninstall", "--internal"]
+            return elevate(cmd)
           end
           case RUBY_PLATFORM
           when /darwin/
             path = "/Library/LaunchDaemons/dev.ask.local.plist"
-            system("launchctl", "unload", path) rescue nil
+            launchctl_bootout(path)
             FileUtils.rm_f(path)
             puts "Removed root LaunchDaemon."
+          when /linux/
+            Command.run("systemctl", "disable", "--now", "ask-local")
+            Command.run("systemctl", "daemon-reload")
+            FileUtils.rm_f("/etc/systemd/system/ask-local.service")
+            puts "Removed systemd service ask-local."
           else
-            puts "Remove /etc/systemd/system/ask-local.service, then: sudo systemctl disable --now ask-local"
+            raise Error, "Service uninstall not supported on #{RUBY_PLATFORM}"
           end
+          true
         end
 
         def service_status(ctx)
@@ -263,16 +415,72 @@ module Ask
           end
         end
 
-        # One-shot workstation setup: everything needed for clean
-        # https://<app>.localhost URLs, in order, with a clear fix-it
-        # message on the first failure. Run this once per machine:
-        #
-        #   ask-local setup
-        #
-        # Steps: trust the local CA -> ensure the proxy serves port 443
-        # (root service when possible, sudo daemon otherwise) -> sync
-        # /etc/hosts -> verify with doctor. After this, plain `ask-local`
-        # in any app dir just works with no :port suffix, ever.
+
+        def init(ctx, _args)
+          config_path = File.join(Dir.pwd, Config::RELATIVE_PATH)
+          if File.file?(config_path)
+            $stderr.puts "config/local.yml already exists at #{config_path}"
+            return
+          end
+          FileUtils.mkdir_p(File.join(Dir.pwd, Config::RELATIVE_DIR))
+
+          # Migrate Procfile.dev / Procfile if present.
+          procfile = Ask::Local::Procfile.find_file(Dir.pwd)
+          service = Ask::Local::Sanitize.hostname_label(File.basename(Dir.pwd))
+
+          process_lines = []
+          if procfile
+            lines = Ask::Local::Procfile.parse_file(procfile)
+            lines.each do |l|
+              type = Ask::Local::Procfile.classify(l.name) == :background ? "false" : "true"
+              process_lines << "    #{l.name}:"
+              process_lines << "      cmd: #{l.command}"
+              process_lines << "      proxy: #{type}"
+              process_lines << "      # NOTE: compound line - run explicitly" if l.compound
+            end
+          else
+            # Default: a single web process. Detect Rails (Gemfile with
+            # rails) vs plain Rack (config.ru) and pick the right boot.
+            has_rails = File.file?(File.join(Dir.pwd, "Gemfile")) &&
+              File.read(File.join(Dir.pwd, "Gemfile")).match?(/gem ["']rails["']/)
+            cmd =
+              if has_rails
+                "bundle exec puma -b tcp://127.0.0.1:$PORT config.ru"
+              elsif File.file?(File.join(Dir.pwd, "config.ru"))
+                "puma -b tcp://127.0.0.1:$PORT config.ru"
+              else
+                "bin/rails server -p $PORT"
+              end
+            process_lines << "    web:"
+            process_lines << "      cmd: #{cmd}"
+            process_lines << "      proxy: true"
+          end
+
+          content = <<~YAML
+            # config/local.yml — ask-local configuration (Kamal-style).
+            # This is the only source of truth. Run `ask-local` to boot everything.
+            # Overlay variants with config/local.<variant>.yml.
+
+            service: #{service}
+
+            proxy:
+              tld: localhost
+
+            processes:
+          #{process_lines.join("\n")}
+
+            env:
+              clear:
+                RAILS_ENV: development
+          YAML
+          File.write(config_path, content)
+          puts "Created #{config_path}"
+          puts "  service: #{service}"
+          puts "  processes from: #{procfile || 'defaults'}"
+          puts "Run `ask-local start` to boot."
+        end
+
+
         def setup(ctx, args)
           if args.include?("--help") || args.include?("-h")
             puts <<~HELP
@@ -280,52 +488,64 @@ module Ask
 
               One-shot workstation setup for clean https://<app>.localhost URLs:
 
-                1. Trust the local CA (no more browser warnings)
-                2. Serve port 443 (root service at boot, or sudo daemon now)
-                3. Sync /etc/hosts (Safari + custom TLDs)
-                4. Verify everything with doctor
+                Default: install the root proxy service on 443 — runs under
+                sudo ONCE, trusting the CA system-wide in the same step
+                (no separate GUI authorization popup).
+                --no-service: trust the CA at user level, then run a sudo
+                daemon instead (no boot persistence; ephemeral machines).
 
-              --no-service skips the root service and starts a sudo daemon
-              instead (no boot persistence; good for ephemeral machines).
+              Both finish by syncing /etc/hosts and verifying with doctor.
             HELP
             return
           end
 
-          step("1/4 Trusting local CA") do
-            result = Ask::Local::Trust.trust
-            unless result[:trusted]
-              abort_setup("CA trust failed: #{result[:error]}",
-                "Run `ask-local trust` manually to see the underlying error,",
-                "then re-run `ask-local setup`.")
-            end
-          end
+          puts "Note: setup takes a few seconds while the 443 service installs and starts."
 
-          unless args.include?("--no-service")
-            step("2/4 Installing proxy service on port 443") do
-              unless ensure_root_service(ctx)
-                abort_setup("Could not install the proxy service.",
-                  "Fallback: `ask-local setup --no-service` for a sudo daemon",
-                  "without boot persistence.")
+          no_service = args.include?("--no-service")
+          steps = no_service ? 4 : 3
+
+          if no_service
+            step("1/#{steps} Trusting local CA") do
+              result = Ask::Local::Trust.trust
+              unless result[:trusted]
+                abort_setup("CA trust failed: #{result[:error]}",
+                  "Run `ask-local trust` manually to see the underlying error,",
+                  "then re-run `ask-local setup`.")
               end
             end
-          else
-            step("2/4 Starting proxy sudo daemon on port 443") do
+            step("2/#{steps} Starting proxy sudo daemon on port 443") do
               unless ensure_sudo_daemon(ctx)
                 abort_setup("Could not start the proxy daemon on port 443.",
                   "Check the log, then re-run `ask-local setup`.")
               end
             end
+          else
+            step("1/#{steps} Installing proxy service on port 443 (trusts CA)") do
+              # Runs under sudo once; inside, the CA is trusted into the
+              # System keychain silently (no GUI popup) and the launchd
+              # service is bootstrapped. One password entry, that's all.
+              unless ensure_root_service(ctx)
+                abort_setup("Could not install the proxy service.",
+                  "Fallback: `ask-local setup --no-service` for a sudo daemon",
+                  "without boot persistence.")
+              end
+            end
           end
 
-          step("3/4 Syncing /etc/hosts") do
+          step("#{no_service ? 3 : 2}/#{steps} Syncing /etc/hosts") do
             hostnames = ctx.store.load_routes.map { |r| r["hostname"] }
-            unless Ask::Local::Hosts.sync(hostnames)
+            next if hostnames.empty?
+
+            # The root service install already synced under elevation; a
+            # plain re-run must not fail rewriting /etc/hosts unprivileged
+            # when the block is already in place.
+            unless Ask::Local::Hosts.synced?(hostnames) || Ask::Local::Hosts.sync(hostnames)
               abort_setup("Could not write /etc/hosts.",
                 "Run `sudo ask-local hosts sync`, then re-run `ask-local setup`.")
             end
           end
 
-          step("4/4 Verifying with doctor") do
+          step("#{no_service ? 4 : 3}/#{steps} Verifying with doctor") do
             failed = Doctor.print(Doctor.run(store: ctx.store), out: $stdout)
             if failed.zero?
               puts "\nSetup complete: https://<app>.localhost URLs are ready."
@@ -349,12 +569,24 @@ module Ask
           exit 1
         end
 
+        # The two ways to get a privileged proxy on 443: a human runs setup
+        # once (interactive sudo), or an agent/CI image is pre-provisioned
+        # with the scoped NOPASSWD rules from `ask-local sudoers`.
+        def privileged_port_hint
+          [
+            "Human: run this once — ask-local setup",
+            "Agent/CI: pre-provision passwordless sudo once —",
+            "  ask-local sudoers > /tmp/ask-local.sudoers",
+            "  sudo install -o root -g wheel -m 440 /tmp/ask-local.sudoers /etc/sudoers.d/ask-local"
+          ]
+        end
+
         # Install the root service (boot-persistent). Returns true when a
         # proxy is up on 443 afterwards, false otherwise. Never falls back
         # to a high port silently: a :port suffix in URLs would corrupt the
         # stable-URL promise, so failure here is a hard error with guidance.
         def ensure_root_service(ctx)
-          service_install(ctx, [])
+          return false unless service_install(ctx, [])
           wait_for_ours(ctx, 443, tls: true)
         rescue Error, SystemCallError => e
           warn "    service install failed: #{e.message}"
@@ -366,6 +598,9 @@ module Ask
           port, tls = 443, true
           unless ctx.interactive?
             warn "    no TTY available for the sudo prompt."
+            warn "    Agent/CI: pre-provision passwordless sudo once —"
+            warn "      ask-local sudoers > /tmp/ask-local.sudoers"
+            warn "      sudo install -o root -g wheel -m 440 /tmp/ask-local.sudoers /etc/sudoers.d/ask-local"
             return false
           end
           ProxyControl.spawn_daemon(store: ctx.store, port: port, tls: tls, sudo: true)
@@ -375,14 +610,44 @@ module Ask
           false
         end
 
+        # Poll until our proxy answers on the port. The freshly installed
+        # service takes a few seconds to boot, so show motion instead of a
+        # frozen prompt: a spinner on a terminal, dots elsewhere. Silent
+        # when the proxy is already up.
         def wait_for_ours(ctx, port, tls:, timeout: 20)
           deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + timeout
-          until ProxyControl.ours?(port, tls: tls)
-            return false if Process.clock_gettime(Process::CLOCK_MONOTONIC) > deadline
+          terminal = $stdout.respond_to?(:tty?) && $stdout.tty?
+          waiting = false
+          frame = 0
+          ok = false
+          loop do
+            if ProxyControl.ours?(port, tls: tls)
+              ok = true
+              break
+            end
+            break if Process.clock_gettime(Process::CLOCK_MONOTONIC) > deadline
 
+            unless waiting
+              print terminal ? "    starting the proxy on port #{port} " : "    (starting the proxy on port #{port}"
+              waiting = true
+            end
+            if terminal
+              print %w[| / - \\][frame % 4], "\b"
+            else
+              print "."
+            end
+            $stdout.flush
+            frame += 1
             sleep 0.5
           end
-          true
+          if waiting
+            if terminal
+              puts(ok ? "\r    proxy is up on port #{port}." : "\r    still not up on port #{port}.")
+            else
+              puts ")"
+            end
+          end
+          ok
         end
 
         # ask-local start — one-setup-and-go: idempotent workstation setup
@@ -445,8 +710,7 @@ module Ask
           tls = true
           unless Ask::Local::ProxyControl.listening?(port) && ProxyControl.ours?(port, tls: tls)
             if port < 1024 && !Ask::Local::ProxyControl.root? && !ctx.interactive?
-              abort_setup("Proxy is not running and port 443 needs root to bind.",
-                "Run this once in a terminal: ask-local setup")
+              abort_setup("Proxy is not running and port 443 needs root to bind.", *privileged_port_hint)
             end
             ok =
               if ProxyControl.root?
@@ -463,9 +727,7 @@ module Ask
                 false
               end
             unless ok
-              abort_setup("Proxy is not running and could not be started on port 443.",
-                "Run `ask-local setup` in a terminal (it handles trust + service + hosts),",
-                "then re-run `ask-local start`.")
+              abort_setup("Proxy is not running and could not be started on port 443.", *privileged_port_hint)
             end
           end
 
@@ -492,7 +754,7 @@ module Ask
           raise Error, "Usage: ask-local kamal <variant> [--app myapp] [--domain preview.example.com] [--tld <tld>]" unless variant
           tld = opts[:tld] || ENV["ASK_LOCAL_TLD"]&.split(",")&.first || "localhost"
 
-          app = opts[:app] || Resolver.resolve(Dir.pwd, use_branch: false).app
+          app = opts[:app] || Resolver.resolve(Dir.pwd).app
           domain = opts[:domain] || ENV["ASK_LOCAL_KAMAL_DOMAIN"] || "preview.example.com"
           slug = Sanitize.hostname_label(variant)
           puts "# Paste into deploy.yml proxy section for a preview of variant #{slug}:"

data/lib/ask/local/cli.rb

@@ -11,7 +11,7 @@ module Ask
     # In non-interactive environments (no TTY or CI=1) we fail early with
     # a clear message instead of prompting (portless lesson).
     class CLI
-      SUBCOMMANDS = %w[run get alias hosts list doctor trust clean prune proxy service kamal stop restart log status open setup start].freeze
+      SUBCOMMANDS = %w[run get alias hosts list doctor trust clean prune proxy service sudoers kamal stop restart log status open setup start init].freeze
 
       def self.run(argv)
         new.run(argv)
@@ -44,7 +44,9 @@ module Ask
         when "prune" then RoutesCommand.prune(ctx, args)
         when "proxy" then SystemCommand.proxy(ctx, args)
         when "service" then SystemCommand.service(ctx, args)
+        when "sudoers" then SystemCommand.sudoers(ctx, args)
         when "setup" then SystemCommand.setup(ctx, args)
+        when "init" then SystemCommand.init(ctx, args)
         when "start" then SystemCommand.start(ctx, args)
         when "kamal" then SystemCommand.kamal(ctx, args)
         when "stop"
@@ -82,6 +84,7 @@ module Ask
             ask-local prune                  Remove stale routes
             ask-local proxy start|stop       Control the proxy
             ask-local service install|status|uninstall   OS startup service
+            ask-local sudoers                Print scoped passwordless-sudo rules for port 443
             ask-local hosts sync|clean       Manage /etc/hosts entries
             ask-local kamal <variant>        Preview-deploy snippet for Kamal
             ask-local stop                   Stop this app's backend + routes
@@ -99,7 +102,6 @@ module Ask
       def inject_port_flags(command, port)
         BootCommand.inject_port_flags(command, port)
       end
-
       def procfile_command(process = nil)
         BootCommand.procfile_command(process)
       end

data/lib/ask/local/command.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+require "open3"
+
+module Ask
+  module Local
+    # Injectable command runner for privileged/child-process work.
+    #
+    # Every system()/Open3 call that tests must control goes through here
+    # (elevation re-exec, launchctl, systemctl, security). Unit tests stub
+    # Command.run / Command.capture2 so they never shell out — no real
+    # sudo prompt, no keychain mutation, hermetic and CI-safe. The real
+    # implementations are the thin wrappers below.
+    #
+    # A plain class (not module_function): Mocha stubs class methods
+    # reliably, whereas module_function singletons dodge the stub and the
+    # real command would run.
+    class Command
+      # True when the command exited 0. Mirrors Kernel#system semantics.
+      def self.run(*args)
+        system(*args)
+      end
+
+      # [stdout, Process::Status] — mirrors Open3.capture2.
+      def self.capture2(*args)
+        Open3.capture2(*args)
+      end
+    end
+  end
+end