@pi-archimedes/sudo 2.7.2 → 2.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-archimedes/sudo",
-  "version": "2.7.2",
+  "version": "2.8.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/danielcherubini/pi-archimedes.git"
@@ -19,7 +19,7 @@
     "./guard": "./src/guard.ts"
   },
   "dependencies": {
-    "@pi-archimedes/core": "2.7.2"
+    "@pi-archimedes/core": "2.8.0"
   },
   "peerDependencies": {
     "@earendil-works/pi-coding-agent": ">=0.1.0",

package/src/prompt.test.ts

@@ -1,7 +1,23 @@
-import { describe, expect, it, vi } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { confirmCommand, maskLine, promptForPassword } from "./prompt.js";
 
+// Mock the bridge BEFORE the prompt module loads — the real module is
+// env-gated and would be inactive, but the tests need per-test control of
+// `active` (same pattern as ask/tool.test.ts). Default: inactive, so the
+// pre-existing headless/TUI tests run against the mock with active=false.
+const bridgeState = vi.hoisted(() => ({
+	active: false,
+	ask: vi.fn(),
+	confirm: vi.fn(),
+	password: vi.fn(),
+	state: vi.fn(() => "idle"),
+}));
+
+vi.mock("@pi-archimedes/core/bridge", () => ({
+	getBridge: () => bridgeState,
+}));
+
 // ── minimal ui.custom fakes ──────────────────────────────────────────────────
 
 interface MaskedComponent {
@@ -147,3 +163,79 @@ describe("promptForPassword — masked component", () => {
 		await expect(promise).resolves.toBe("");
 	});
 });
+
+// ── bridge routing (Task 3) ────────────────────────────────────────────────
+
+function bridgeRpcCtx() {
+	const confirm = vi.fn(async () => true);
+	const custom = vi.fn(async () => "");
+	const ui = { confirm, custom } as unknown as ExtensionContext["ui"];
+	const ctx = { mode: "rpc" as const, hasUI: true, ui } as unknown as ExtensionContext;
+	return { ctx, confirm, custom };
+}
+
+describe("promptForPassword — bridge routing", () => {
+	afterEach(() => {
+		bridgeState.active = false;
+		bridgeState.password.mockReset();
+	});
+
+	it("routes through the bridge in bridge mode (rpc ctx) and never touches ui.custom", async () => {
+		bridgeState.active = true;
+		bridgeState.password.mockResolvedValue("s3cret");
+		const { ctx, custom } = bridgeRpcCtx();
+
+		await expect(promptForPassword(ctx, "apt install ripgrep", "install ripgrep")).resolves.toBe("s3cret");
+		expect(bridgeState.password).toHaveBeenCalledWith({ command: "apt install ripgrep", reason: "install ripgrep" });
+		expect(custom).not.toHaveBeenCalled(); // the Client's modal, not the TUI field
+	});
+
+	it("resolves '' on bridge cancellation (the caller treats '' as cancellation — unchanged)", async () => {
+		bridgeState.active = true;
+		bridgeState.password.mockResolvedValue("");
+		const { ctx } = bridgeRpcCtx();
+
+		await expect(promptForPassword(ctx)).resolves.toBe("");
+	});
+
+	it("still rejects in headless mode when the bridge is inactive (the 0010 gate is unchanged)", async () => {
+		bridgeState.active = false;
+		await expect(promptForPassword(headlessCtx("json"))).rejects.toThrow();
+		expect(bridgeState.password).not.toHaveBeenCalled();
+	});
+});
+
+describe("confirmCommand — bridge routing", () => {
+	afterEach(() => {
+		bridgeState.active = false;
+		bridgeState.confirm.mockReset();
+	});
+
+	it("routes through the bridge in bridge mode (rpc ctx) and never touches ui.confirm", async () => {
+		bridgeState.active = true;
+		bridgeState.confirm.mockResolvedValue(true);
+		const { ctx, confirm, custom } = bridgeRpcCtx();
+
+		await expect(confirmCommand(ctx, "apt install ripgrep", "install ripgrep")).resolves.toBe(true);
+		expect(bridgeState.confirm).toHaveBeenCalledWith({ command: "apt install ripgrep", reason: "install ripgrep" });
+		expect(confirm).not.toHaveBeenCalled(); // the Client's modal, not the TUI confirm
+	});
+
+	it("resolves false on bridge decline", async () => {
+		bridgeState.active = true;
+		bridgeState.confirm.mockResolvedValue(false);
+		const { ctx } = bridgeRpcCtx();
+
+		await expect(confirmCommand(ctx, "reboot", "retry service")).resolves.toBe(false);
+	});
+
+	it("still uses ui.confirm in TUI when the bridge is inactive (unchanged)", async () => {
+		bridgeState.active = false;
+		const confirm = vi.fn(async (_title: string, _message: string) => true);
+		const ctx = { mode: "tui" as const, hasUI: true, ui: { confirm } } as unknown as ExtensionContext;
+
+		await expect(confirmCommand(ctx, "apt install ripgrep", "install ripgrep")).resolves.toBe(true);
+		expect(confirm).toHaveBeenCalledTimes(1);
+		expect(bridgeState.confirm).not.toHaveBeenCalled();
+	});
+});

package/src/prompt.ts

@@ -1,5 +1,6 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { Key, matchesKey, truncateToWidth } from "@earendil-works/pi-tui";
+import { getBridge } from "@pi-archimedes/core/bridge";
 
 /**
  * Render one `•` per typed character — pure, so the masking itself is
@@ -25,6 +26,13 @@ export function maskLine(buffer: string): string {
  * or confirms with an empty buffer — callers treat `""` as cancellation.
  */
 export function promptForPassword(ctx: ExtensionContext, command?: string, reason?: string): Promise<string> {
+	// Bridge mode: the password comes from the Client's masked modal over the
+	// bridge channel — user-paced, 0010-compliant (never a tool parameter). The
+	// 0010 headless gate below is intentionally UNCHANGED: it sits after the
+	// bridge branch, so non-bridge headless sessions still reject verbatim.
+	if (getBridge().active) {
+		return getBridge().password({ command: command ?? "", reason: reason ?? "" });
+	}
 	if (ctx.mode !== "tui") {
 		return Promise.reject(
 			new Error(
@@ -94,6 +102,11 @@ export function promptForPassword(ctx: ExtensionContext, command?: string, reaso
  * prompting for a password.
  */
 export async function confirmCommand(ctx: ExtensionContext, command: string, reason: string): Promise<boolean> {
+	// Bridge mode: the Client's confirm modal (user-paced) replaces the TUI
+	// confirm; the ctx.ui.confirm path below is otherwise unchanged.
+	if (getBridge().active) {
+		return getBridge().confirm({ command, reason });
+	}
 	const message = ["This will run with elevated privileges (password required until cached):", "", `$ ${command}`, "", `Reason: ${reason}`].join("\n");
 	return ctx.ui.confirm("Confirm privileged command", message);
 }

package/src/tool.test.ts

@@ -18,6 +18,20 @@ vi.mock("@pi-archimedes/core/settings-io", () => ({
 	},
 }));
 
+// Mock the bridge — per-test control of `active` (same pattern as ask/tool.test.ts).
+// Default: inactive, so the pre-existing headless/TUI tests are unaffected.
+const bridgeState = vi.hoisted(() => ({
+	active: false,
+	ask: vi.fn(),
+	confirm: vi.fn(),
+	password: vi.fn(),
+	state: vi.fn(() => "idle"),
+}));
+
+vi.mock("@pi-archimedes/core/bridge", () => ({
+	getBridge: () => bridgeState,
+}));
+
 import { buildSudoArgv, createSudoExecTool, probeSudoTicket, scrubSecret } from "./tool.js";
 import type { SudoChild, SudoSpawner } from "./tool.js";
 import { credentialCache } from "./cache.js";
@@ -209,6 +223,89 @@ describe("sudo_exec tool", () => {
 		});
 	});
 
+	describe("bridge mode (Task 3)", () => {
+		afterEach(() => {
+			bridgeState.active = false;
+			bridgeState.confirm.mockReset();
+			bridgeState.password.mockReset();
+		});
+
+		it("bypasses the headless gate in bridge mode: confirm + password route through the bridge and the command runs", async () => {
+			bridgeState.active = true;
+			bridgeState.confirm.mockResolvedValue(true);
+			bridgeState.password.mockResolvedValue("s3cret");
+			const { spawner, last } = makeFakeSpawner({ stdout: "ok\n", stderr: "", code: 0 });
+			const tool = createSudoExecTool({ spawner, authProbe: () => Promise.resolve(true) });
+			const ui = { confirm: vi.fn(async () => true), custom: vi.fn(async () => "") } as unknown as ExtensionContext["ui"];
+			const ctx = { mode: "rpc", hasUI: true, ui } as unknown as ExtensionContext;
+
+			const result = await run(tool, ctx, { command: "apt update", reason: "maintain" });
+
+			expect(result.isError).toBeFalsy();
+			expect(last.command).toBe("sudo");
+			expect(last.args).toEqual(["-S", "apt", "update"]);
+			expect(last.child.stdin.written.join("")).toBe("s3cret\n"); // bridge password → sudo -S stdin
+			expect(ui.confirm).not.toHaveBeenCalled(); // the Client's modal, not the TUI
+			expect(ui.custom).not.toHaveBeenCalled();
+		});
+
+		it("declines via the bridge: 'not confirmed', no password prompt, no spawn", async () => {
+			bridgeState.active = true;
+			bridgeState.confirm.mockResolvedValue(false);
+			bridgeState.password.mockResolvedValue("should-not-be-used");
+			let spawned = false;
+			const tool = createSudoExecTool({
+				spawner: () => {
+					spawned = true;
+					throw new Error("spawner must not be called");
+				},
+			});
+			const ctx = headlessCtx("rpc");
+
+			const result = await run(tool, ctx, { command: "reboot", reason: "x" });
+
+			expect(result.isError).toBe(true);
+			expect((result.content[0] as { text: string }).text).toMatch(/not confirmed/i);
+			expect(spawned).toBe(false);
+			expect(bridgeState.password).not.toHaveBeenCalled();
+		});
+
+		it("bridge password cancel ('' → 'password entry cancelled', nothing cached, no spawn)", async () => {
+			bridgeState.active = true;
+			bridgeState.confirm.mockResolvedValue(true);
+			bridgeState.password.mockResolvedValue("");
+			let spawned = false;
+			const tool = createSudoExecTool({
+				spawner: () => {
+					spawned = true;
+					throw new Error("spawner must not be called");
+				},
+			});
+			const ctx = headlessCtx("rpc");
+
+			const result = await run(tool, ctx, { command: "apt update", reason: "maintain" });
+
+			expect(result.isError).toBe(true);
+			expect((result.content[0] as { text: string }).text).toMatch(/password entry cancelled/i);
+			expect(spawned).toBe(false);
+			expect(credentialCache.get()).toBeNull();
+		});
+
+		it("still rejects in headless mode when the bridge is inactive (the 0010 gate is unchanged)", async () => {
+			bridgeState.active = false;
+			const tool = createSudoExecTool();
+			const ui = { confirm: vi.fn(), custom: vi.fn() } as unknown as ExtensionContext["ui"];
+			const ctx = { mode: "json", hasUI: false, ui } as unknown as ExtensionContext;
+
+			const result = await run(tool, ctx, { command: "apt install ripgrep", reason: "install tool" });
+
+			expect(result.isError).toBe(true);
+			expect((result.content[0] as { text: string }).text).toMatch(/interactive/i);
+			expect(ui.confirm).not.toHaveBeenCalled();
+			expect(ui.custom).not.toHaveBeenCalled();
+		});
+	});
+
 	describe("validation", () => {
 		it("rejects an empty command", async () => {
 			const tool = createSudoExecTool();

package/src/tool.ts

@@ -6,6 +6,7 @@ import { credentialCache } from "./cache.js";
 import { splitCommandIntoArgv } from "./argv-split.js";
 import { loadSudoConfig } from "./config.js";
 import { confirmCommand, promptForPassword } from "./prompt.js";
+import { getBridge } from "@pi-archimedes/core/bridge";
 
 // ── Schemas ──────────────────────────────────────────────────────────────────
 
@@ -410,7 +411,10 @@ export function createSudoExecTool(options: {
 				});
 			}
 
-			if (ctx.mode !== "tui") {
+			// Bridge mode bypasses the 0010 gate: the bridge confirm/password are
+			// user-paced Client modals (0010-compliant). TUI and RPC-no-env behave
+			// exactly as before.
+			if (ctx.mode !== "tui" && !getBridge().active) {
 				return fail("sudo_exec requires an interactive session — run privileged commands from the main session.", {
 					command,
 					reason,