@dahch/heimdall 1.1.0 → 1.2.0

package/README.md

@@ -20,7 +20,7 @@
   2. **Aggregated Review & Confirmation**: Shows an interactive tabular overview comparing current and latest package versions across all managers, prompting for confirmation before modifying the system.
 - 🧪 **True Simulated Dry-Run (`--dry-run`)**: Traverses the full engine lifecycle, formats outdated packages, and executes mock update routines step-by-step with real-time feedback without touching system files.
 - ⚡ **High-Speed Registry Queries**: Yarn and pipx bypass heavy CLI subprocess spawning by querying the npm Registry and PyPI JSON APIs directly over HTTP with strict 3-second abort timeouts.
-- 🔐 **Non-Interactive Sudo Pre-Checks**: Privileged managers (MacPorts, Linux APT, Linux DNF) verify cached credentials using `sudo -n true` beforehand, preventing terminal lockups and password prompt hangs.
+- 🔐 **Interactive Sudo Acquisition**: When a selected manager requires elevation (`requiresSudo`), `hmd` verifies the cached ticket with `sudo -n true` and, if missing, prompts for the password exactly once through `sudo -v` on the controlling terminal before any spinner takes over the TTY. A background keep-alive refreshes the ticket during long upgrades, and every privileged step re-verifies non-interactive credentials so subprocesses can never hang on a hidden password prompt. Running `sudo hmd` is neither required nor supported (the CLI lives under the user's `PATH`, which root's `secure_path` does not include).
 - 🎨 **Modern Minimalist UX**: Terminal interface powered by `@clack/prompts`, micro-border tabular layouts with directional version transitions (`current → latest`), persistent real-time step progression with elapsed durations, and actionable error extraction.
 - 🏷 **Dynamic Version Resolution**: Reads package name and version dynamically from `package.json` at runtime via `import.meta.url`, ensuring banners and `--version` flags remain in sync with repository releases.
 - ⚙ **Flexible Targeting**: Run interactively, execute non-interactively with `--yes`, or filter target managers using `--only` and `--exclude`.
@@ -44,9 +44,9 @@ Heimdall (`hmd`) supports 14 package managers across system, runtime, language,
 | **[Ruby Gem](https://rubygems.org)** | 💎 | `language` | `gem outdated` (skips deprecated Apple System Ruby `/usr/bin/gem`) | 1. `gem update --user-install`<br>2. `gem cleanup` |
 | **[MacPorts](https://www.macports.org)** | ⚓ | `system` | `port outdated` + non-interactive `sudo -n true` verification | 1. `sudo port selfupdate`<br>2. `sudo port upgrade outdated` |
 | **[Mac App Store (mas)](https://github.com/mas-cli/mas)** | 🍎 | `appstore` | `mas outdated` | `mas upgrade` |
-| **[APT (Debian/Ubuntu)](https://wiki.debian.org/Apt)** | 🐧 | `system` | `apt list --upgradable` + non-interactive `sudo -n true` check | 1. `sudo apt-get update -y`<br>2. `sudo apt-get upgrade -y`<br>3. `sudo apt-get autoremove -y` |
+| **[APT (Debian/Ubuntu)](https://wiki.debian.org/Apt)** | 🐧 | `system` | `apt list --upgradable` + non-interactive `sudo -n true` check | 1. `sudo apt-get update -y`<br>2. `sudo apt-get upgrade -y --with-new-pkgs` (avoids leaving dependency-gaining upgrades `kept back`)<br>3. `sudo apt-get autoremove -y` (prompted interactively with confirmation prompt, auto-approved with `--yes` or `--dry-run`, skipped when declined or after a failed upgrade) |
 | **[DNF (Fedora/RHEL)](https://docs.fedoraproject.org/en-US/quick-docs/dnf/)** | 📦 | `system` | `dnf check-update -y` (exit code 100 signals updates) + `sudo -n true` check | 1. `sudo dnf upgrade -y --refresh`<br>2. `sudo dnf autoremove -y` (prompted interactively with confirmation prompt, auto-approved with `--yes` or `--dry-run`) |
-| **[Flatpak](https://flatpak.org)** | 📦 | `system` | `flatpak remote-ls --updates` | `flatpak update -y --noninteractive` |
+| **[Flatpak](https://flatpak.org)** | 📦 | `system` | `flatpak remote-ls --user --updates` + `flatpak remote-ls --system --updates` (both scopes, deduplicated) | 1. `flatpak update --user -y --noninteractive`<br>2. `sudo flatpak update --system -y --noninteractive` (marked `failed` with sudo guidance when system apps exist but privileges are unavailable, `skipped` when no system-scope apps are installed) |
 
 ---
 
@@ -157,7 +157,9 @@ Test coverage includes:
 - Concurrency pool bounds and error isolation in [`UpdaterEngine`](src/core/engine.ts).
 - `NpmManager` targeted batch installation, fallback trigger handling, and `--ignore-scripts` resilience.
 - `HomebrewManager` selective formula vs. cask execution branches.
-- Pre-check behaviors (skipping `/usr/bin/gem`, sudo privilege checks for MacPorts and APT).
+- Pre-check behaviors (skipping `/usr/bin/gem`, sudo privilege checks for MacPorts, APT and DNF, interactive sudo acquisition with ticket keep-alive).
+- `FlatpakManager` dual-scope querying (user + system installations) and system-step sudo gating.
+- `AptManager` upgradable parsing (epochs, architecture-qualified names, header/warning lines) and its consent-gated autoremove branch.
 - HTTP registry lookup error handling for Yarn and pipx.
 - Formatting renderers (micro-border table, directional version diffs, execution summary metrics).
 

package/dist/cli.js

@@ -18,6 +18,26 @@ async function commandExists(command) {
     return false;
   }
 }
+var SUDO_REQUIRED_HINT = `Run "sudo -v" in this terminal and retry ("sudo hmd" will not work: hmd is not in root's PATH).`;
+async function ensureSudo() {
+  if (process.getuid?.() === 0) return true;
+  const cachedTicket = await safeExec("sudo", ["-n", "true"], { timeoutMs: 5e3 });
+  if (cachedTicket.success) return true;
+  if (!process.stdin.isTTY || !await commandExists("sudo")) return false;
+  try {
+    const result = await execa("sudo", ["-v"], { stdio: "inherit", reject: false });
+    return result.exitCode === 0;
+  } catch {
+    return false;
+  }
+}
+function startSudoKeepAlive(intervalMs = 6e4) {
+  const timer = setInterval(() => {
+    void safeExec("sudo", ["-n", "-v"], { timeoutMs: 1e4 });
+  }, intervalMs);
+  timer.unref();
+  return () => clearInterval(timer);
+}
 async function safeExec(file, args = [], options = {}) {
   const timeout = options.timeoutMs ?? 3e4;
   try {
@@ -140,6 +160,14 @@ var BasePackageManager = class {
   async isAvailable() {
     return commandExists(this.binary);
   }
+  /**
+   * Verifies that sudo can run without a password prompt (cached ticket or NOPASSWD rule),
+   * so privileged steps fail fast instead of hanging inside a stdin-less subprocess.
+   */
+  async hasPasswordlessSudo() {
+    const result = await safeExec("sudo", ["-n", "true"], { timeoutMs: 3e3 });
+    return result.success;
+  }
   async executeStep(stepName, file, args, options, extraExecOptions) {
     const startTime = Date.now();
     options.onStepStart?.(stepName);
@@ -1311,6 +1339,7 @@ var MacPortsManager = class extends BasePackageManager {
   name = "MacPorts";
   icon = "\u2693";
   category = "system";
+  requiresSudo = true;
   binary = "port";
   async checkUpdates(options) {
     const startTime = Date.now();
@@ -1376,8 +1405,8 @@ var MacPortsManager = class extends BasePackageManager {
     const startTime = Date.now();
     const steps = [];
     if (!options.dryRun && process.getuid?.() !== 0) {
-      const sudoCheck = await safeExec("sudo", ["-n", "true"], { timeoutMs: 3e3 });
-      if (!sudoCheck.success) {
+      if (!await this.hasPasswordlessSudo()) {
+        const error = `MacPorts requires sudo privileges. ${SUDO_REQUIRED_HINT}`;
         return {
           managerId: this.id,
           managerName: this.name,
@@ -1390,10 +1419,10 @@ var MacPortsManager = class extends BasePackageManager {
               name: "sudo privileges",
               command: "sudo -n true",
               status: "failed",
-              error: 'MacPorts requires sudo privileges. Run "sudo -v" in your terminal before hmd.'
+              error
             }
           ],
-          error: 'MacPorts requires sudo privileges. Run "sudo -v" before running hmd.'
+          error
         };
       }
     }
@@ -1614,6 +1643,7 @@ var AptManager = class extends BasePackageManager {
   name = "APT (Debian/Ubuntu)";
   icon = "\u{1F427}";
   category = "system";
+  requiresSudo = true;
   binary = "apt-get";
   async checkUpdates(options) {
     const startTime = Date.now();
@@ -1676,8 +1706,8 @@ var AptManager = class extends BasePackageManager {
     const startTime = Date.now();
     const steps = [];
     if (!options.dryRun && process.getuid?.() !== 0) {
-      const sudoCheck = await safeExec("sudo", ["-n", "true"], { timeoutMs: 3e3 });
-      if (!sudoCheck.success) {
+      if (!await this.hasPasswordlessSudo()) {
+        const error = `APT requires sudo privileges. ${SUDO_REQUIRED_HINT}`;
         return {
           managerId: this.id,
           managerName: this.name,
@@ -1690,10 +1720,10 @@ var AptManager = class extends BasePackageManager {
               name: "sudo privileges",
               command: "sudo -n true",
               status: "failed",
-              error: 'APT requires sudo privileges. Run "sudo -v" in your terminal before hmd.'
+              error
             }
           ],
-          error: 'APT requires sudo privileges. Run "sudo -v" before running hmd.'
+          error
         };
       }
     }
@@ -1707,18 +1737,54 @@ var AptManager = class extends BasePackageManager {
     const upgradeStep = await this.executeStep(
       "sudo apt-get upgrade",
       "sudo",
-      ["apt-get", "upgrade", "-y"],
+      ["apt-get", "upgrade", "-y", "--with-new-pkgs"],
       options
     );
     steps.push(upgradeStep);
-    const cleanupStep = await this.executeStep(
-      "sudo apt-get autoremove",
-      "sudo",
-      ["apt-get", "autoremove", "-y"],
-      options
-    );
-    steps.push(cleanupStep);
-    const success = steps.every((s) => s.status === "success");
+    if (upgradeStep.status === "success") {
+      if (options.dryRun) {
+        const autoremoveStep = await this.executeStep(
+          "sudo apt-get autoremove",
+          "sudo",
+          ["apt-get", "autoremove", "-y"],
+          options
+        );
+        steps.push(autoremoveStep);
+      } else if (options.confirmAction) {
+        const shouldAutoremove = await options.confirmAction(
+          "Do you want to run sudo apt-get autoremove to clean up orphaned packages?"
+        );
+        if (shouldAutoremove) {
+          const autoremoveStep = await this.executeStep(
+            "sudo apt-get autoremove",
+            "sudo",
+            ["apt-get", "autoremove", "-y"],
+            options
+          );
+          steps.push(autoremoveStep);
+        } else {
+          steps.push({
+            name: "sudo apt-get autoremove",
+            command: "sudo apt-get autoremove -y",
+            status: "skipped"
+          });
+        }
+      } else {
+        steps.push({
+          name: "sudo apt-get autoremove",
+          command: "sudo apt-get autoremove -y",
+          status: "skipped"
+        });
+      }
+    } else {
+      steps.push({
+        name: "sudo apt-get autoremove",
+        command: "sudo apt-get autoremove -y",
+        status: "skipped"
+      });
+    }
+    const executedSteps = steps.filter((s) => s.status !== "skipped");
+    const success = executedSteps.length > 0 && executedSteps.every((s) => s.status === "success");
     return {
       managerId: this.id,
       managerName: this.name,
@@ -1736,6 +1802,7 @@ var FlatpakManager = class extends BasePackageManager {
   name = "Flatpak";
   icon = "\u{1F4E6}";
   category = "system";
+  requiresSudo = true;
   binary = "flatpak";
   async checkUpdates(options) {
     const startTime = Date.now();
@@ -1752,23 +1819,43 @@ var FlatpakManager = class extends BasePackageManager {
       };
     }
     try {
-      const execRes = await safeExec("flatpak", ["remote-ls", "--updates"], {
-        timeoutMs: options?.timeoutMs ?? 2e4
-      });
-      const updates = [];
-      const lines = execRes.stdout.split("\n");
-      for (const line of lines) {
-        const trimmed = line.trim();
-        if (!trimmed) continue;
-        const parts = trimmed.split(/\s+/);
-        updates.push({
+      const timeoutMs = options?.timeoutMs ?? 2e4;
+      const [userRes, systemRes] = await Promise.all([
+        safeExec("flatpak", ["remote-ls", "--user", "--updates"], { timeoutMs }),
+        safeExec("flatpak", ["remote-ls", "--system", "--updates"], { timeoutMs })
+      ]);
+      if (!userRes.success && !systemRes.success) {
+        const raw = (systemRes.stderr || userRes.stderr).trim();
+        return {
           managerId: this.id,
           managerName: this.name,
-          name: parts[0],
-          currentVersion: "installed",
-          latestVersion: parts[1] ?? "latest",
-          type: "flatpak"
-        });
+          icon: this.icon,
+          category: this.category,
+          available: true,
+          updates: [],
+          durationMs: Date.now() - startTime,
+          error: raw ? extractErrorMessage(raw) : void 0
+        };
+      }
+      const updates = [];
+      const seen = /* @__PURE__ */ new Set();
+      for (const execRes of [userRes, systemRes]) {
+        for (const line of execRes.stdout.split("\n")) {
+          const trimmed = line.trim();
+          if (!trimmed) continue;
+          const parts = trimmed.split(/\s+/);
+          const name = parts[0];
+          if (seen.has(name)) continue;
+          seen.add(name);
+          updates.push({
+            managerId: this.id,
+            managerName: this.name,
+            name,
+            currentVersion: "installed",
+            latestVersion: parts[1] ?? "latest",
+            type: "flatpak"
+          });
+        }
       }
       return {
         managerId: this.id,
@@ -1792,17 +1879,56 @@ var FlatpakManager = class extends BasePackageManager {
       };
     }
   }
+  async hasSystemScopeApps() {
+    const result = await safeExec("flatpak", ["list", "--system", "--columns=application"], {
+      timeoutMs: 1e4
+    });
+    return result.success && result.stdout.trim().length > 0;
+  }
   async executeUpdate(items, options) {
     const startTime = Date.now();
     const steps = [];
-    const updateStep = await this.executeStep(
-      "flatpak update -y",
+    const userStep = await this.executeStep(
+      "flatpak update --user",
       "flatpak",
-      ["update", "-y", "--noninteractive"],
+      ["update", "--user", "-y", "--noninteractive"],
       options
     );
-    steps.push(updateStep);
-    const success = steps.every((s) => s.status === "success");
+    steps.push(userStep);
+    const sudoStepName = "sudo flatpak update --system";
+    const sudoStepCommand = "sudo flatpak update --system -y --noninteractive";
+    if (options.dryRun) {
+      const systemStep = await this.executeStep(
+        sudoStepName,
+        "sudo",
+        ["flatpak", "update", "--system", "-y", "--noninteractive"],
+        options
+      );
+      steps.push(systemStep);
+    } else if (process.getuid?.() === 0 || await this.hasPasswordlessSudo()) {
+      const systemStep = await this.executeStep(
+        sudoStepName,
+        "sudo",
+        ["flatpak", "update", "--system", "-y", "--noninteractive"],
+        options
+      );
+      steps.push(systemStep);
+    } else if (await this.hasSystemScopeApps()) {
+      steps.push({
+        name: sudoStepName,
+        command: sudoStepCommand,
+        status: "failed",
+        error: `System-wide Flatpak updates require sudo privileges. ${SUDO_REQUIRED_HINT}`
+      });
+    } else {
+      steps.push({
+        name: sudoStepName,
+        command: sudoStepCommand,
+        status: "skipped"
+      });
+    }
+    const executedSteps = steps.filter((s) => s.status !== "skipped");
+    const success = executedSteps.length > 0 && executedSteps.every((s) => s.status === "success");
     return {
       managerId: this.id,
       managerName: this.name,
@@ -1820,6 +1946,7 @@ var DnfManager = class extends BasePackageManager {
   name = "DNF (Fedora/RHEL)";
   icon = "\u{1F4E6}";
   category = "system";
+  requiresSudo = true;
   binary = "dnf";
   async checkUpdates(options) {
     const startTime = Date.now();
@@ -1917,8 +2044,8 @@ var DnfManager = class extends BasePackageManager {
     const startTime = Date.now();
     const steps = [];
     if (!options.dryRun && process.getuid?.() !== 0) {
-      const sudoCheck = await safeExec("sudo", ["-n", "true"], { timeoutMs: 3e3 });
-      if (!sudoCheck.success) {
+      if (!await this.hasPasswordlessSudo()) {
+        const error = `DNF requires sudo privileges. ${SUDO_REQUIRED_HINT}`;
         return {
           managerId: this.id,
           managerName: this.name,
@@ -1931,10 +2058,10 @@ var DnfManager = class extends BasePackageManager {
               name: "sudo privileges",
               command: "sudo -n true",
               status: "failed",
-              error: 'DNF requires sudo privileges. Run "sudo -v" before running hmd.'
+              error
             }
           ],
-          error: 'DNF requires sudo privileges. Run "sudo -v" before running hmd.'
+          error
         };
       }
     }
@@ -2341,6 +2468,21 @@ ${pc2.bold("Pending updates")} ${pc2.dim(`(${allUpdates.length} total):`)}`);
     process.exit(0);
   }
   const isSimulated = options.dryRun ?? false;
+  let stopSudoKeepAlive;
+  const selectedIds = new Set(managersToUpdate);
+  const needsSudo = selectedManagers.some((m) => selectedIds.has(m.id) && m.requiresSudo);
+  if (needsSudo && !isSimulated) {
+    p.log.step(pc2.dim("Requesting sudo privileges required by system package managers..."));
+    if (await ensureSudo()) {
+      stopSudoKeepAlive = startSudoKeepAlive();
+    } else {
+      p.log.warn(
+        pc2.yellow(
+          'Sudo privileges not granted: system package managers will fail. Run "sudo -v" in this terminal and retry.'
+        )
+      );
+    }
+  }
   p.log.step(
     pc2.bold(
       pc2.cyan(
@@ -2351,50 +2493,55 @@ ${isSimulated ? "[DRY RUN] Simulating" : "Starting"} updates for ${managersToUpd
   );
   const updateSpinner = p.spinner();
   let managerIndex = 0;
-  const summary = await engine.execute(
-    managersToUpdate,
-    itemsByManager,
-    {
-      verbose: options.verbose,
-      dryRun: isSimulated,
-      confirmAction: async (message) => {
-        if (options.yes) return true;
-        updateSpinner.stop(pc2.dim("Waiting for user confirmation..."));
-        const confirmed = await p.confirm({ message, initialValue: false });
-        updateSpinner.start(pc2.dim("Continuing update..."));
-        return typeof confirmed === "boolean" ? confirmed : false;
-      },
-      onStepStart: (stepName) => {
-        updateSpinner.message(pc2.dim(`Running: ${stepName}...`));
-      },
-      onStepProgress: (stepName, logLine) => {
-        if (logLine) {
-          const truncated = logLine.length > 55 ? logLine.slice(0, 52) + "..." : logLine;
-          updateSpinner.message(pc2.dim(`${stepName} [${truncated}]`));
+  let summary;
+  try {
+    summary = await engine.execute(
+      managersToUpdate,
+      itemsByManager,
+      {
+        verbose: options.verbose,
+        dryRun: isSimulated,
+        confirmAction: async (message) => {
+          if (options.yes) return true;
+          updateSpinner.stop(pc2.dim("Waiting for user confirmation..."));
+          const confirmed = await p.confirm({ message, initialValue: false });
+          updateSpinner.start(pc2.dim("Continuing update..."));
+          return typeof confirmed === "boolean" ? confirmed : false;
+        },
+        onStepStart: (stepName) => {
+          updateSpinner.message(pc2.dim(`Running: ${stepName}...`));
+        },
+        onStepProgress: (stepName, logLine) => {
+          if (logLine) {
+            const truncated = logLine.length > 55 ? logLine.slice(0, 52) + "..." : logLine;
+            updateSpinner.message(pc2.dim(`${stepName} [${truncated}]`));
+          }
+        },
+        onStepEnd: (stepName, success, error, durationMs) => {
+          const mark = success ? pc2.green("\u2714") : pc2.red("\u2716");
+          const durStr = durationMs !== void 0 ? pc2.dim(` [${formatDuration(durationMs)}]`) : "";
+          const detail = error ? pc2.red(` \u21B3 ${error.split("\n")[0]}`) : "";
+          updateSpinner.stop(`  ${mark} ${pc2.dim(stepName)}${durStr}${detail}`);
+          updateSpinner.start(pc2.dim("Working..."));
         }
       },
-      onStepEnd: (stepName, success, error, durationMs) => {
-        const mark = success ? pc2.green("\u2714") : pc2.red("\u2716");
-        const durStr = durationMs !== void 0 ? pc2.dim(` [${formatDuration(durationMs)}]`) : "";
-        const detail = error ? pc2.red(` \u21B3 ${error.split("\n")[0]}`) : "";
-        updateSpinner.stop(`  ${mark} ${pc2.dim(stepName)}${durStr}${detail}`);
-        updateSpinner.start(pc2.dim("Working..."));
-      }
-    },
-    (mgr) => {
-      managerIndex++;
-      console.log(pc2.bold(pc2.cyan(`
+      (mgr) => {
+        managerIndex++;
+        console.log(pc2.bold(pc2.cyan(`
 \u25CF [${managerIndex}/${managersToUpdate.length}] ${mgr.icon} ${mgr.name}`)));
-      updateSpinner.start(pc2.dim("Starting update routine..."));
-    },
-    (mgr, res) => {
-      if (res.success) {
-        updateSpinner.stop(pc2.green(`  \u2714 ${mgr.name} completed in ${formatDuration(res.durationMs)}`));
-      } else {
-        updateSpinner.stop(pc2.red(`  \u2716 ${mgr.name} completed with issues in ${formatDuration(res.durationMs)}`));
+        updateSpinner.start(pc2.dim("Starting update routine..."));
+      },
+      (mgr, res) => {
+        if (res.success) {
+          updateSpinner.stop(pc2.green(`  \u2714 ${mgr.name} completed in ${formatDuration(res.durationMs)}`));
+        } else {
+          updateSpinner.stop(pc2.red(`  \u2716 ${mgr.name} completed with issues in ${formatDuration(res.durationMs)}`));
+        }
       }
-    }
-  );
+    );
+  } finally {
+    stopSudoKeepAlive?.();
+  }
   console.log(renderExecutionSummary(summary.results));
   if (summary.failedCount === 0) {
     p.outro(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dahch/heimdall",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Heimdall: resilient validator and updater for system and global packages",
   "type": "module",
   "publishConfig": {