@dahch/heimdall 1.0.1 → 1.2.0

package/README.md

@@ -20,7 +20,7 @@
   2. **Aggregated Review & Confirmation**: Shows an interactive tabular overview comparing current and latest package versions across all managers, prompting for confirmation before modifying the system.
 - 🧪 **True Simulated Dry-Run (`--dry-run`)**: Traverses the full engine lifecycle, formats outdated packages, and executes mock update routines step-by-step with real-time feedback without touching system files.
 - ⚡ **High-Speed Registry Queries**: Yarn and pipx bypass heavy CLI subprocess spawning by querying the npm Registry and PyPI JSON APIs directly over HTTP with strict 3-second abort timeouts.
-- 🔐 **Non-Interactive Sudo Pre-Checks**: Privileged managers (MacPorts, Linux APT) verify cached credentials using `sudo -n true` beforehand, preventing terminal lockups and password prompt hangs.
+- 🔐 **Interactive Sudo Acquisition**: When a selected manager requires elevation (`requiresSudo`), `hmd` verifies the cached ticket with `sudo -n true` and, if missing, prompts for the password exactly once through `sudo -v` on the controlling terminal before any spinner takes over the TTY. A background keep-alive refreshes the ticket during long upgrades, and every privileged step re-verifies non-interactive credentials so subprocesses can never hang on a hidden password prompt. Running `sudo hmd` is neither required nor supported (the CLI lives under the user's `PATH`, which root's `secure_path` does not include).
 - 🎨 **Modern Minimalist UX**: Terminal interface powered by `@clack/prompts`, micro-border tabular layouts with directional version transitions (`current → latest`), persistent real-time step progression with elapsed durations, and actionable error extraction.
 - 🏷 **Dynamic Version Resolution**: Reads package name and version dynamically from `package.json` at runtime via `import.meta.url`, ensuring banners and `--version` flags remain in sync with repository releases.
 - ⚙ **Flexible Targeting**: Run interactively, execute non-interactively with `--yes`, or filter target managers using `--only` and `--exclude`.
@@ -29,7 +29,7 @@
 
 ## 📦 Supported Package Managers
 
-Heimdall (`hmd`) supports 13 package managers across system, runtime, language, and application store categories:
+Heimdall (`hmd`) supports 14 package managers across system, runtime, language, and application store categories:
 
 | Manager | Icon | Category | Detection Strategy | Update Routine & Resilience Rules |
 | :--- | :---: | :---: | :--- | :--- |
@@ -44,8 +44,9 @@ Heimdall (`hmd`) supports 13 package managers across system, runtime, language,
 | **[Ruby Gem](https://rubygems.org)** | 💎 | `language` | `gem outdated` (skips deprecated Apple System Ruby `/usr/bin/gem`) | 1. `gem update --user-install`<br>2. `gem cleanup` |
 | **[MacPorts](https://www.macports.org)** | ⚓ | `system` | `port outdated` + non-interactive `sudo -n true` verification | 1. `sudo port selfupdate`<br>2. `sudo port upgrade outdated` |
 | **[Mac App Store (mas)](https://github.com/mas-cli/mas)** | 🍎 | `appstore` | `mas outdated` | `mas upgrade` |
-| **[APT (Debian/Ubuntu)](https://wiki.debian.org/Apt)** | 🐧 | `system` | `apt list --upgradable` + non-interactive `sudo -n true` check | 1. `sudo apt-get update -y`<br>2. `sudo apt-get upgrade -y`<br>3. `sudo apt-get autoremove -y` |
-| **[Flatpak](https://flatpak.org)** | 📦 | `system` | `flatpak remote-ls --updates` | `flatpak update -y --noninteractive` |
+| **[APT (Debian/Ubuntu)](https://wiki.debian.org/Apt)** | 🐧 | `system` | `apt list --upgradable` + non-interactive `sudo -n true` check | 1. `sudo apt-get update -y`<br>2. `sudo apt-get upgrade -y --with-new-pkgs` (avoids leaving dependency-gaining upgrades `kept back`)<br>3. `sudo apt-get autoremove -y` (prompted interactively with confirmation prompt, auto-approved with `--yes` or `--dry-run`, skipped when declined or after a failed upgrade) |
+| **[DNF (Fedora/RHEL)](https://docs.fedoraproject.org/en-US/quick-docs/dnf/)** | 📦 | `system` | `dnf check-update -y` (exit code 100 signals updates) + `sudo -n true` check | 1. `sudo dnf upgrade -y --refresh`<br>2. `sudo dnf autoremove -y` (prompted interactively with confirmation prompt, auto-approved with `--yes` or `--dry-run`) |
+| **[Flatpak](https://flatpak.org)** | 📦 | `system` | `flatpak remote-ls --user --updates` + `flatpak remote-ls --system --updates` (both scopes, deduplicated) | 1. `flatpak update --user -y --noninteractive`<br>2. `sudo flatpak update --system -y --noninteractive` (marked `failed` with sudo guidance when system apps exist but privileges are unavailable, `skipped` when no system-scope apps are installed) |
 
 ---
 
@@ -156,7 +157,9 @@ Test coverage includes:
 - Concurrency pool bounds and error isolation in [`UpdaterEngine`](src/core/engine.ts).
 - `NpmManager` targeted batch installation, fallback trigger handling, and `--ignore-scripts` resilience.
 - `HomebrewManager` selective formula vs. cask execution branches.
-- Pre-check behaviors (skipping `/usr/bin/gem`, sudo privilege checks for MacPorts and APT).
+- Pre-check behaviors (skipping `/usr/bin/gem`, sudo privilege checks for MacPorts, APT and DNF, interactive sudo acquisition with ticket keep-alive).
+- `FlatpakManager` dual-scope querying (user + system installations) and system-step sudo gating.
+- `AptManager` upgradable parsing (epochs, architecture-qualified names, header/warning lines) and its consent-gated autoremove branch.
 - HTTP registry lookup error handling for Yarn and pipx.
 - Formatting renderers (micro-border table, directional version diffs, execution summary metrics).
 
@@ -178,7 +181,7 @@ Heimdall employs an automated GitHub Actions CI/CD workflow ([`.github/workflows
 
 - [SPEC.md](SPEC.md): Technical specification, CLI contract, data models, and exit codes.
 - [DESIGN.md](DESIGN.md): System architecture, Two-Phase workflow, Engine concurrency pool, and Mermaid diagrams.
-- [ADR.md](ADR.md): Architectural Decision Records (ADR-001 through ADR-009) documenting key engineering decisions.
+- [ADR.md](ADR.md): Architectural Decision Records (ADR-001 through ADR-010) documenting key engineering decisions.
 - [AGENTS.md](AGENTS.md): Developer and AI agent reference manual for maintaining and extending the codebase.
 
 ---

package/dist/cli.js

@@ -18,6 +18,26 @@ async function commandExists(command) {
     return false;
   }
 }
+var SUDO_REQUIRED_HINT = `Run "sudo -v" in this terminal and retry ("sudo hmd" will not work: hmd is not in root's PATH).`;
+async function ensureSudo() {
+  if (process.getuid?.() === 0) return true;
+  const cachedTicket = await safeExec("sudo", ["-n", "true"], { timeoutMs: 5e3 });
+  if (cachedTicket.success) return true;
+  if (!process.stdin.isTTY || !await commandExists("sudo")) return false;
+  try {
+    const result = await execa("sudo", ["-v"], { stdio: "inherit", reject: false });
+    return result.exitCode === 0;
+  } catch {
+    return false;
+  }
+}
+function startSudoKeepAlive(intervalMs = 6e4) {
+  const timer = setInterval(() => {
+    void safeExec("sudo", ["-n", "-v"], { timeoutMs: 1e4 });
+  }, intervalMs);
+  timer.unref();
+  return () => clearInterval(timer);
+}
 async function safeExec(file, args = [], options = {}) {
   const timeout = options.timeoutMs ?? 3e4;
   try {
@@ -140,6 +160,14 @@ var BasePackageManager = class {
   async isAvailable() {
     return commandExists(this.binary);
   }
+  /**
+   * Verifies that sudo can run without a password prompt (cached ticket or NOPASSWD rule),
+   * so privileged steps fail fast instead of hanging inside a stdin-less subprocess.
+   */
+  async hasPasswordlessSudo() {
+    const result = await safeExec("sudo", ["-n", "true"], { timeoutMs: 3e3 });
+    return result.success;
+  }
   async executeStep(stepName, file, args, options, extraExecOptions) {
     const startTime = Date.now();
     options.onStepStart?.(stepName);
@@ -1311,6 +1339,7 @@ var MacPortsManager = class extends BasePackageManager {
   name = "MacPorts";
   icon = "\u2693";
   category = "system";
+  requiresSudo = true;
   binary = "port";
   async checkUpdates(options) {
     const startTime = Date.now();
@@ -1376,8 +1405,8 @@ var MacPortsManager = class extends BasePackageManager {
     const startTime = Date.now();
     const steps = [];
     if (!options.dryRun && process.getuid?.() !== 0) {
-      const sudoCheck = await safeExec("sudo", ["-n", "true"], { timeoutMs: 3e3 });
-      if (!sudoCheck.success) {
+      if (!await this.hasPasswordlessSudo()) {
+        const error = `MacPorts requires sudo privileges. ${SUDO_REQUIRED_HINT}`;
         return {
           managerId: this.id,
           managerName: this.name,
@@ -1390,10 +1419,10 @@ var MacPortsManager = class extends BasePackageManager {
               name: "sudo privileges",
               command: "sudo -n true",
               status: "failed",
-              error: 'MacPorts requires sudo privileges. Run "sudo -v" in your terminal before hmd.'
+              error
             }
           ],
-          error: 'MacPorts requires sudo privileges. Run "sudo -v" before running hmd.'
+          error
         };
       }
     }
@@ -1513,12 +1542,108 @@ var MacAppStoreManager = class extends BasePackageManager {
   }
 };
 
+// src/utils/formatting.ts
+import pc from "picocolors";
+import Table from "cli-table3";
+function formatDuration(ms) {
+  if (ms < 1e3) return `${ms}ms`;
+  const seconds = (ms / 1e3).toFixed(1);
+  return `${seconds}s`;
+}
+function renderUpdatesTable(items) {
+  if (items.length === 0) {
+    return pc.dim("  No updates pending.");
+  }
+  const table = new Table({
+    head: [
+      pc.dim("Manager"),
+      pc.dim("Package"),
+      pc.dim("Type"),
+      pc.dim("Version Transition")
+    ],
+    style: {
+      head: [],
+      border: ["dim"]
+    },
+    chars: {
+      top: "\u2500",
+      "top-mid": "\u2500",
+      "top-left": "\u250C",
+      "top-right": "\u2510",
+      bottom: "\u2500",
+      "bottom-mid": "\u2500",
+      "bottom-left": "\u2514",
+      "bottom-right": "\u2518",
+      left: "\u2502",
+      "left-mid": "\u251C",
+      mid: "\u2500",
+      "mid-mid": "\u253C",
+      right: "\u2502",
+      "right-mid": "\u2524",
+      middle: "\u2502"
+    }
+  });
+  for (const item of items) {
+    const typeLabel = item.type ? pc.dim(`[${item.type}]`) : pc.dim("-");
+    const currentVer = pc.yellow(item.currentVersion || "?");
+    const arrow = pc.dim(" \u2192 ");
+    const latestVer = pc.green(pc.bold(item.latestVersion || "?"));
+    table.push([
+      pc.cyan(item.managerName),
+      pc.bold(pc.white(item.name)),
+      typeLabel,
+      `${currentVer}${arrow}${latestVer}`
+    ]);
+  }
+  return table.toString();
+}
+function renderExecutionSummary(results) {
+  const total = results.length;
+  const successful = results.filter((r) => r.success).length;
+  const failed = results.filter((r) => !r.success).length;
+  const totalUpdated = results.reduce((acc, r) => acc + r.updatedCount, 0);
+  const lines = [];
+  lines.push("");
+  lines.push(pc.dim("\u2500".repeat(60)));
+  lines.push(`  ${pc.bold(pc.cyan("Heimdall"))} ${pc.dim("\u2022 Execution Summary")}`);
+  lines.push(pc.dim("\u2500".repeat(60)));
+  for (const res of results) {
+    const icon = res.icon || "\u{1F4E6}";
+    const status = res.success ? pc.green("\u2714 SUCCESS") : pc.red("\u2716 FAILED");
+    const time = pc.dim(`(${formatDuration(res.durationMs)})`);
+    const count = res.success ? pc.dim(`\u2022 ${res.updatedCount} updated`) : pc.dim(`\u2022 ${res.updatedCount} updated, ${res.steps.filter((s) => s.status === "failed").length} issue(s)`);
+    lines.push(`  ${icon} ${pc.bold(res.managerName)} ${status} ${count} ${time}`);
+    if (!res.success && res.error) {
+      lines.push(`     ${pc.red("\u21B3 Error:")} ${pc.dim(res.error.trim().split("\n")[0])}`);
+    }
+    if (res.steps.length > 0) {
+      for (const step of res.steps) {
+        if (step.status === "skipped") continue;
+        const stepStatus = step.status === "success" ? pc.green("\u2714") : step.status === "failed" ? pc.red("\u2716") : pc.dim("\u25CB");
+        const stepDuration = step.durationMs ? pc.dim(`[${formatDuration(step.durationMs)}]`) : "";
+        const stepError = step.error && step.status === "failed" ? pc.red(` (${step.error.split("\n")[0]})`) : "";
+        lines.push(`       ${stepStatus} ${pc.dim(step.name)} ${stepDuration}${stepError}`);
+      }
+    }
+  }
+  lines.push(pc.dim("\u2500".repeat(60)));
+  const summaryParts = [
+    pc.green(`${successful}/${total} managers succeeded`),
+    failed > 0 ? pc.red(`${failed} failed`) : null,
+    pc.cyan(`${totalUpdated} package(s) updated`)
+  ].filter(Boolean);
+  lines.push(`  ${summaryParts.join(" \u2022 ")}`);
+  lines.push(pc.dim("\u2500".repeat(60)));
+  return lines.join("\n");
+}
+
 // src/managers/linux.ts
 var AptManager = class extends BasePackageManager {
   id = "apt";
   name = "APT (Debian/Ubuntu)";
   icon = "\u{1F427}";
   category = "system";
+  requiresSudo = true;
   binary = "apt-get";
   async checkUpdates(options) {
     const startTime = Date.now();
@@ -1581,8 +1706,8 @@ var AptManager = class extends BasePackageManager {
     const startTime = Date.now();
     const steps = [];
     if (!options.dryRun && process.getuid?.() !== 0) {
-      const sudoCheck = await safeExec("sudo", ["-n", "true"], { timeoutMs: 3e3 });
-      if (!sudoCheck.success) {
+      if (!await this.hasPasswordlessSudo()) {
+        const error = `APT requires sudo privileges. ${SUDO_REQUIRED_HINT}`;
         return {
           managerId: this.id,
           managerName: this.name,
@@ -1595,10 +1720,10 @@ var AptManager = class extends BasePackageManager {
               name: "sudo privileges",
               command: "sudo -n true",
               status: "failed",
-              error: 'APT requires sudo privileges. Run "sudo -v" in your terminal before hmd.'
+              error
             }
           ],
-          error: 'APT requires sudo privileges. Run "sudo -v" before running hmd.'
+          error
         };
       }
     }
@@ -1612,18 +1737,54 @@ var AptManager = class extends BasePackageManager {
     const upgradeStep = await this.executeStep(
       "sudo apt-get upgrade",
       "sudo",
-      ["apt-get", "upgrade", "-y"],
+      ["apt-get", "upgrade", "-y", "--with-new-pkgs"],
       options
     );
     steps.push(upgradeStep);
-    const cleanupStep = await this.executeStep(
-      "sudo apt-get autoremove",
-      "sudo",
-      ["apt-get", "autoremove", "-y"],
-      options
-    );
-    steps.push(cleanupStep);
-    const success = steps.every((s) => s.status === "success");
+    if (upgradeStep.status === "success") {
+      if (options.dryRun) {
+        const autoremoveStep = await this.executeStep(
+          "sudo apt-get autoremove",
+          "sudo",
+          ["apt-get", "autoremove", "-y"],
+          options
+        );
+        steps.push(autoremoveStep);
+      } else if (options.confirmAction) {
+        const shouldAutoremove = await options.confirmAction(
+          "Do you want to run sudo apt-get autoremove to clean up orphaned packages?"
+        );
+        if (shouldAutoremove) {
+          const autoremoveStep = await this.executeStep(
+            "sudo apt-get autoremove",
+            "sudo",
+            ["apt-get", "autoremove", "-y"],
+            options
+          );
+          steps.push(autoremoveStep);
+        } else {
+          steps.push({
+            name: "sudo apt-get autoremove",
+            command: "sudo apt-get autoremove -y",
+            status: "skipped"
+          });
+        }
+      } else {
+        steps.push({
+          name: "sudo apt-get autoremove",
+          command: "sudo apt-get autoremove -y",
+          status: "skipped"
+        });
+      }
+    } else {
+      steps.push({
+        name: "sudo apt-get autoremove",
+        command: "sudo apt-get autoremove -y",
+        status: "skipped"
+      });
+    }
+    const executedSteps = steps.filter((s) => s.status !== "skipped");
+    const success = executedSteps.length > 0 && executedSteps.every((s) => s.status === "success");
     return {
       managerId: this.id,
       managerName: this.name,
@@ -1641,6 +1802,7 @@ var FlatpakManager = class extends BasePackageManager {
   name = "Flatpak";
   icon = "\u{1F4E6}";
   category = "system";
+  requiresSudo = true;
   binary = "flatpak";
   async checkUpdates(options) {
     const startTime = Date.now();
@@ -1657,23 +1819,43 @@ var FlatpakManager = class extends BasePackageManager {
       };
     }
     try {
-      const execRes = await safeExec("flatpak", ["remote-ls", "--updates"], {
-        timeoutMs: options?.timeoutMs ?? 2e4
-      });
-      const updates = [];
-      const lines = execRes.stdout.split("\n");
-      for (const line of lines) {
-        const trimmed = line.trim();
-        if (!trimmed) continue;
-        const parts = trimmed.split(/\s+/);
-        updates.push({
+      const timeoutMs = options?.timeoutMs ?? 2e4;
+      const [userRes, systemRes] = await Promise.all([
+        safeExec("flatpak", ["remote-ls", "--user", "--updates"], { timeoutMs }),
+        safeExec("flatpak", ["remote-ls", "--system", "--updates"], { timeoutMs })
+      ]);
+      if (!userRes.success && !systemRes.success) {
+        const raw = (systemRes.stderr || userRes.stderr).trim();
+        return {
           managerId: this.id,
           managerName: this.name,
-          name: parts[0],
-          currentVersion: "installed",
-          latestVersion: parts[1] ?? "latest",
-          type: "flatpak"
-        });
+          icon: this.icon,
+          category: this.category,
+          available: true,
+          updates: [],
+          durationMs: Date.now() - startTime,
+          error: raw ? extractErrorMessage(raw) : void 0
+        };
+      }
+      const updates = [];
+      const seen = /* @__PURE__ */ new Set();
+      for (const execRes of [userRes, systemRes]) {
+        for (const line of execRes.stdout.split("\n")) {
+          const trimmed = line.trim();
+          if (!trimmed) continue;
+          const parts = trimmed.split(/\s+/);
+          const name = parts[0];
+          if (seen.has(name)) continue;
+          seen.add(name);
+          updates.push({
+            managerId: this.id,
+            managerName: this.name,
+            name,
+            currentVersion: "installed",
+            latestVersion: parts[1] ?? "latest",
+            type: "flatpak"
+          });
+        }
       }
       return {
         managerId: this.id,
@@ -1697,17 +1879,243 @@ var FlatpakManager = class extends BasePackageManager {
       };
     }
   }
+  async hasSystemScopeApps() {
+    const result = await safeExec("flatpak", ["list", "--system", "--columns=application"], {
+      timeoutMs: 1e4
+    });
+    return result.success && result.stdout.trim().length > 0;
+  }
   async executeUpdate(items, options) {
     const startTime = Date.now();
     const steps = [];
-    const updateStep = await this.executeStep(
-      "flatpak update -y",
+    const userStep = await this.executeStep(
+      "flatpak update --user",
       "flatpak",
-      ["update", "-y", "--noninteractive"],
+      ["update", "--user", "-y", "--noninteractive"],
       options
     );
-    steps.push(updateStep);
-    const success = steps.every((s) => s.status === "success");
+    steps.push(userStep);
+    const sudoStepName = "sudo flatpak update --system";
+    const sudoStepCommand = "sudo flatpak update --system -y --noninteractive";
+    if (options.dryRun) {
+      const systemStep = await this.executeStep(
+        sudoStepName,
+        "sudo",
+        ["flatpak", "update", "--system", "-y", "--noninteractive"],
+        options
+      );
+      steps.push(systemStep);
+    } else if (process.getuid?.() === 0 || await this.hasPasswordlessSudo()) {
+      const systemStep = await this.executeStep(
+        sudoStepName,
+        "sudo",
+        ["flatpak", "update", "--system", "-y", "--noninteractive"],
+        options
+      );
+      steps.push(systemStep);
+    } else if (await this.hasSystemScopeApps()) {
+      steps.push({
+        name: sudoStepName,
+        command: sudoStepCommand,
+        status: "failed",
+        error: `System-wide Flatpak updates require sudo privileges. ${SUDO_REQUIRED_HINT}`
+      });
+    } else {
+      steps.push({
+        name: sudoStepName,
+        command: sudoStepCommand,
+        status: "skipped"
+      });
+    }
+    const executedSteps = steps.filter((s) => s.status !== "skipped");
+    const success = executedSteps.length > 0 && executedSteps.every((s) => s.status === "success");
+    return {
+      managerId: this.id,
+      managerName: this.name,
+      icon: this.icon,
+      success,
+      updatedCount: success ? items.length : 0,
+      durationMs: Date.now() - startTime,
+      steps,
+      error: !success ? steps.find((s) => s.status === "failed")?.error : void 0
+    };
+  }
+};
+var DnfManager = class extends BasePackageManager {
+  id = "dnf";
+  name = "DNF (Fedora/RHEL)";
+  icon = "\u{1F4E6}";
+  category = "system";
+  requiresSudo = true;
+  binary = "dnf";
+  async checkUpdates(options) {
+    const startTime = Date.now();
+    const isAvail = await this.isAvailable();
+    if (!isAvail) {
+      return {
+        managerId: this.id,
+        managerName: this.name,
+        icon: this.icon,
+        category: this.category,
+        available: false,
+        updates: [],
+        durationMs: 0
+      };
+    }
+    try {
+      const execRes = await safeExec(this.binary, ["check-update", "-y"], {
+        timeoutMs: options?.timeoutMs ?? 25e3
+      });
+      if (execRes.exitCode !== 0 && execRes.exitCode !== 100) {
+        return {
+          managerId: this.id,
+          managerName: this.name,
+          icon: this.icon,
+          category: this.category,
+          available: true,
+          updates: [],
+          durationMs: Date.now() - startTime,
+          error: (execRes.stderr || execRes.stdout).trim() ? extractErrorMessage(execRes.stderr || execRes.stdout) : `dnf check-update failed with code ${execRes.exitCode}`
+        };
+      }
+      if (execRes.exitCode === 0) {
+        return {
+          managerId: this.id,
+          managerName: this.name,
+          icon: this.icon,
+          category: this.category,
+          available: true,
+          updates: [],
+          durationMs: Date.now() - startTime
+        };
+      }
+      const updates = [];
+      const lines = execRes.stdout.split("\n");
+      let pendingPkg = null;
+      for (const rawLine of lines) {
+        const line = rawLine.trim();
+        if (!line) continue;
+        if (line.startsWith("Updating and loading repositories") || line.startsWith("Repositories loaded") || line.startsWith("Last metadata expiration check") || line.startsWith("Obsoleting Packages") || line.startsWith("Loaded plugins") || line.startsWith("Security:")) {
+          continue;
+        }
+        const combinedLine = pendingPkg ? `${pendingPkg} ${line}` : line;
+        const match = combinedLine.match(/^(\S+?)\.([a-zA-Z0-9_]+)\s+(\S+)\s+(\S+)/);
+        if (match) {
+          const [, name, arch, latestVersion, repo] = match;
+          updates.push({
+            managerId: this.id,
+            managerName: this.name,
+            name,
+            currentVersion: "installed",
+            latestVersion,
+            type: "rpm",
+            extra: `${repo} (${arch})`
+          });
+          pendingPkg = null;
+        } else if (!pendingPkg && /^\S+?\.[a-zA-Z0-9_]+$/.test(line)) {
+          pendingPkg = line;
+        } else {
+          pendingPkg = null;
+        }
+      }
+      return {
+        managerId: this.id,
+        managerName: this.name,
+        icon: this.icon,
+        category: this.category,
+        available: true,
+        updates,
+        durationMs: Date.now() - startTime
+      };
+    } catch (err) {
+      return {
+        managerId: this.id,
+        managerName: this.name,
+        icon: this.icon,
+        category: this.category,
+        available: true,
+        updates: [],
+        durationMs: Date.now() - startTime,
+        error: err instanceof Error ? err.message : String(err)
+      };
+    }
+  }
+  async executeUpdate(items, options) {
+    const startTime = Date.now();
+    const steps = [];
+    if (!options.dryRun && process.getuid?.() !== 0) {
+      if (!await this.hasPasswordlessSudo()) {
+        const error = `DNF requires sudo privileges. ${SUDO_REQUIRED_HINT}`;
+        return {
+          managerId: this.id,
+          managerName: this.name,
+          icon: this.icon,
+          success: false,
+          updatedCount: 0,
+          durationMs: Date.now() - startTime,
+          steps: [
+            {
+              name: "sudo privileges",
+              command: "sudo -n true",
+              status: "failed",
+              error
+            }
+          ],
+          error
+        };
+      }
+    }
+    const upgradeStep = await this.executeStep(
+      "sudo dnf upgrade --refresh",
+      "sudo",
+      ["dnf", "upgrade", "-y", "--refresh"],
+      options
+    );
+    steps.push(upgradeStep);
+    if (upgradeStep.status === "success") {
+      if (options.dryRun) {
+        const autoremoveStep = await this.executeStep(
+          "sudo dnf autoremove",
+          "sudo",
+          ["dnf", "autoremove", "-y"],
+          options
+        );
+        steps.push(autoremoveStep);
+      } else if (options.confirmAction) {
+        const shouldAutoremove = await options.confirmAction(
+          "Do you want to run sudo dnf autoremove to clean up orphaned packages?"
+        );
+        if (shouldAutoremove) {
+          const autoremoveStep = await this.executeStep(
+            "sudo dnf autoremove",
+            "sudo",
+            ["dnf", "autoremove", "-y"],
+            options
+          );
+          steps.push(autoremoveStep);
+        } else {
+          steps.push({
+            name: "sudo dnf autoremove",
+            command: "sudo dnf autoremove -y",
+            status: "skipped"
+          });
+        }
+      } else {
+        steps.push({
+          name: "sudo dnf autoremove",
+          command: "sudo dnf autoremove -y",
+          status: "skipped"
+        });
+      }
+    } else {
+      steps.push({
+        name: "sudo dnf autoremove",
+        command: "sudo dnf autoremove -y",
+        status: "skipped"
+      });
+    }
+    const nonSkippedSteps = steps.filter((s) => s.status !== "skipped");
+    const success = nonSkippedSteps.length > 0 && nonSkippedSteps.every((s) => s.status === "success");
     return {
       managerId: this.id,
       managerName: this.name,
@@ -1736,6 +2144,7 @@ function createDefaultManagers() {
     new MacPortsManager(),
     new MacAppStoreManager(),
     new AptManager(),
+    new DnfManager(),
     new FlatpakManager()
   ];
 }
@@ -1872,101 +2281,6 @@ var UpdaterEngine = class {
   }
 };
 
-// src/utils/formatting.ts
-import pc from "picocolors";
-import Table from "cli-table3";
-function formatDuration(ms) {
-  if (ms < 1e3) return `${ms}ms`;
-  const seconds = (ms / 1e3).toFixed(1);
-  return `${seconds}s`;
-}
-function renderUpdatesTable(items) {
-  if (items.length === 0) {
-    return pc.dim("  No updates pending.");
-  }
-  const table = new Table({
-    head: [
-      pc.dim("Manager"),
-      pc.dim("Package"),
-      pc.dim("Type"),
-      pc.dim("Version Transition")
-    ],
-    style: {
-      head: [],
-      border: ["dim"]
-    },
-    chars: {
-      top: "\u2500",
-      "top-mid": "\u2500",
-      "top-left": "\u250C",
-      "top-right": "\u2510",
-      bottom: "\u2500",
-      "bottom-mid": "\u2500",
-      "bottom-left": "\u2514",
-      "bottom-right": "\u2518",
-      left: "\u2502",
-      "left-mid": "\u251C",
-      mid: "\u2500",
-      "mid-mid": "\u253C",
-      right: "\u2502",
-      "right-mid": "\u2524",
-      middle: "\u2502"
-    }
-  });
-  for (const item of items) {
-    const typeLabel = item.type ? pc.dim(`[${item.type}]`) : pc.dim("-");
-    const currentVer = pc.yellow(item.currentVersion || "?");
-    const arrow = pc.dim(" \u2192 ");
-    const latestVer = pc.green(pc.bold(item.latestVersion || "?"));
-    table.push([
-      pc.cyan(item.managerName),
-      pc.bold(pc.white(item.name)),
-      typeLabel,
-      `${currentVer}${arrow}${latestVer}`
-    ]);
-  }
-  return table.toString();
-}
-function renderExecutionSummary(results) {
-  const total = results.length;
-  const successful = results.filter((r) => r.success).length;
-  const failed = results.filter((r) => !r.success).length;
-  const totalUpdated = results.reduce((acc, r) => acc + r.updatedCount, 0);
-  const lines = [];
-  lines.push("");
-  lines.push(pc.dim("\u2500".repeat(60)));
-  lines.push(`  ${pc.bold(pc.cyan("Heimdall"))} ${pc.dim("\u2022 Execution Summary")}`);
-  lines.push(pc.dim("\u2500".repeat(60)));
-  for (const res of results) {
-    const icon = res.icon || "\u{1F4E6}";
-    const status = res.success ? pc.green("\u2714 SUCCESS") : pc.red("\u2716 FAILED");
-    const time = pc.dim(`(${formatDuration(res.durationMs)})`);
-    const count = res.success ? pc.dim(`\u2022 ${res.updatedCount} updated`) : pc.dim(`\u2022 ${res.updatedCount} updated, ${res.steps.filter((s) => s.status === "failed").length} issue(s)`);
-    lines.push(`  ${icon} ${pc.bold(res.managerName)} ${status} ${count} ${time}`);
-    if (!res.success && res.error) {
-      lines.push(`     ${pc.red("\u21B3 Error:")} ${pc.dim(res.error.trim().split("\n")[0])}`);
-    }
-    if (res.steps.length > 0) {
-      for (const step of res.steps) {
-        if (step.status === "skipped") continue;
-        const stepStatus = step.status === "success" ? pc.green("\u2714") : step.status === "failed" ? pc.red("\u2716") : pc.dim("\u25CB");
-        const stepDuration = step.durationMs ? pc.dim(`[${formatDuration(step.durationMs)}]`) : "";
-        const stepError = step.error && step.status === "failed" ? pc.red(` (${step.error.split("\n")[0]})`) : "";
-        lines.push(`       ${stepStatus} ${pc.dim(step.name)} ${stepDuration}${stepError}`);
-      }
-    }
-  }
-  lines.push(pc.dim("\u2500".repeat(60)));
-  const summaryParts = [
-    pc.green(`${successful}/${total} managers succeeded`),
-    failed > 0 ? pc.red(`${failed} failed`) : null,
-    pc.cyan(`${totalUpdated} package(s) updated`)
-  ].filter(Boolean);
-  lines.push(`  ${summaryParts.join(" \u2022 ")}`);
-  lines.push(pc.dim("\u2500".repeat(60)));
-  return lines.join("\n");
-}
-
 // src/utils/version.ts
 import { fileURLToPath } from "url";
 import { dirname, resolve } from "path";
@@ -2154,6 +2468,21 @@ ${pc2.bold("Pending updates")} ${pc2.dim(`(${allUpdates.length} total):`)}`);
     process.exit(0);
   }
   const isSimulated = options.dryRun ?? false;
+  let stopSudoKeepAlive;
+  const selectedIds = new Set(managersToUpdate);
+  const needsSudo = selectedManagers.some((m) => selectedIds.has(m.id) && m.requiresSudo);
+  if (needsSudo && !isSimulated) {
+    p.log.step(pc2.dim("Requesting sudo privileges required by system package managers..."));
+    if (await ensureSudo()) {
+      stopSudoKeepAlive = startSudoKeepAlive();
+    } else {
+      p.log.warn(
+        pc2.yellow(
+          'Sudo privileges not granted: system package managers will fail. Run "sudo -v" in this terminal and retry.'
+        )
+      );
+    }
+  }
   p.log.step(
     pc2.bold(
       pc2.cyan(
@@ -2164,43 +2493,55 @@ ${isSimulated ? "[DRY RUN] Simulating" : "Starting"} updates for ${managersToUpd
   );
   const updateSpinner = p.spinner();
   let managerIndex = 0;
-  const summary = await engine.execute(
-    managersToUpdate,
-    itemsByManager,
-    {
-      verbose: options.verbose,
-      dryRun: isSimulated,
-      onStepStart: (stepName) => {
-        updateSpinner.message(pc2.dim(`Running: ${stepName}...`));
-      },
-      onStepProgress: (stepName, logLine) => {
-        if (logLine) {
-          const truncated = logLine.length > 55 ? logLine.slice(0, 52) + "..." : logLine;
-          updateSpinner.message(pc2.dim(`${stepName} [${truncated}]`));
+  let summary;
+  try {
+    summary = await engine.execute(
+      managersToUpdate,
+      itemsByManager,
+      {
+        verbose: options.verbose,
+        dryRun: isSimulated,
+        confirmAction: async (message) => {
+          if (options.yes) return true;
+          updateSpinner.stop(pc2.dim("Waiting for user confirmation..."));
+          const confirmed = await p.confirm({ message, initialValue: false });
+          updateSpinner.start(pc2.dim("Continuing update..."));
+          return typeof confirmed === "boolean" ? confirmed : false;
+        },
+        onStepStart: (stepName) => {
+          updateSpinner.message(pc2.dim(`Running: ${stepName}...`));
+        },
+        onStepProgress: (stepName, logLine) => {
+          if (logLine) {
+            const truncated = logLine.length > 55 ? logLine.slice(0, 52) + "..." : logLine;
+            updateSpinner.message(pc2.dim(`${stepName} [${truncated}]`));
+          }
+        },
+        onStepEnd: (stepName, success, error, durationMs) => {
+          const mark = success ? pc2.green("\u2714") : pc2.red("\u2716");
+          const durStr = durationMs !== void 0 ? pc2.dim(` [${formatDuration(durationMs)}]`) : "";
+          const detail = error ? pc2.red(` \u21B3 ${error.split("\n")[0]}`) : "";
+          updateSpinner.stop(`  ${mark} ${pc2.dim(stepName)}${durStr}${detail}`);
+          updateSpinner.start(pc2.dim("Working..."));
         }
       },
-      onStepEnd: (stepName, success, error, durationMs) => {
-        const mark = success ? pc2.green("\u2714") : pc2.red("\u2716");
-        const durStr = durationMs !== void 0 ? pc2.dim(` [${formatDuration(durationMs)}]`) : "";
-        const detail = error ? pc2.red(` \u21B3 ${error.split("\n")[0]}`) : "";
-        updateSpinner.stop(`  ${mark} ${pc2.dim(stepName)}${durStr}${detail}`);
-        updateSpinner.start(pc2.dim("Working..."));
-      }
-    },
-    (mgr) => {
-      managerIndex++;
-      console.log(pc2.bold(pc2.cyan(`
+      (mgr) => {
+        managerIndex++;
+        console.log(pc2.bold(pc2.cyan(`
 \u25CF [${managerIndex}/${managersToUpdate.length}] ${mgr.icon} ${mgr.name}`)));
-      updateSpinner.start(pc2.dim("Starting update routine..."));
-    },
-    (mgr, res) => {
-      if (res.success) {
-        updateSpinner.stop(pc2.green(`  \u2714 ${mgr.name} completed in ${formatDuration(res.durationMs)}`));
-      } else {
-        updateSpinner.stop(pc2.red(`  \u2716 ${mgr.name} completed with issues in ${formatDuration(res.durationMs)}`));
+        updateSpinner.start(pc2.dim("Starting update routine..."));
+      },
+      (mgr, res) => {
+        if (res.success) {
+          updateSpinner.stop(pc2.green(`  \u2714 ${mgr.name} completed in ${formatDuration(res.durationMs)}`));
+        } else {
+          updateSpinner.stop(pc2.red(`  \u2716 ${mgr.name} completed with issues in ${formatDuration(res.durationMs)}`));
+        }
       }
-    }
-  );
+    );
+  } finally {
+    stopSudoKeepAlive?.();
+  }
   console.log(renderExecutionSummary(summary.results));
   if (summary.failedCount === 0) {
     p.outro(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dahch/heimdall",
-  "version": "1.0.1",
+  "version": "1.2.0",
   "description": "Heimdall: resilient validator and updater for system and global packages",
   "type": "module",
   "publishConfig": {