@xynogen/pix-ssh 0.4.1 → 0.4.2

package/README.md

@@ -26,7 +26,7 @@ Lets the agent discover hosts without reading `~/.ssh/config` itself. Read-only:
 ### Authentication
 
 - **SSH login** — tries key/agent/existing-master auth first via a `BatchMode=yes` probe. If that succeeds, no login password is needed. If it fails, a masked overlay (`●` per character) collects the login password, fed to `sshpass -e` through the child's `SSHPASS` env var — never as an argv (no `ps` leak), never written to disk.
-- **Remote sudo** (`sudo: true`) — a separate masked prompt collects the remote sudo password, piped to the remote `sudo -S -p ''` on stdin, so it travels inside the encrypted SSH channel, not as an argv.
+- **Remote sudo** (`sudo: true`) — when the SSH connection is passwordless, `ssh_run` first probes `sudo -n true`; if the remote sudoers is `NOPASSWD` the overlay shows a plain Allow/Deny with no sudo prompt. Otherwise a separate masked prompt collects the remote sudo password, piped to the remote `sudo -S -p ''` on stdin, so it travels inside the encrypted SSH channel, not as an argv.
 
 Both passwords are cached **in-memory per host** for the session (keyed by `user@host:port`), never persisted. A wrong login password drops the login cache; a wrong sudo password drops the sudo cache — the next call re-prompts.
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@xynogen/pix-ssh",
-	"version": "0.4.1",
+	"version": "0.4.2",
 	"description": "Pi tool — ssh_run: run remote commands over SSH with password/key auth and remote sudo",
 	"type": "module",
 	"main": "src/index.ts",

package/src/index.ts

@@ -66,6 +66,7 @@ import {
 	MAX_OUTPUT_LINES,
 	parseHost,
 	probeKeyAuth,
+	probeSudoNoPassword,
 	readSshConfigAliases,
 	resolveHostInfo,
 	resolveSshHost,
@@ -536,7 +537,15 @@ export default function (pi: ExtensionAPI): void {
 			const keyOk = probe === "ok";
 			// Which passwords must the overlay collect this call?
 			const needLogin = probe === "auth" && !creds.loginPassword;
-			const needSudo = sudo && !creds.sudoPassword;
+			// Remote sudo password only when NOT already cached, NOT NOPASSWD, and
+			// the SSH connection is passwordless (so the probe can open its own
+			// channel without prompting). When login still needs a password we
+			// can't probe yet, so fall back to prompting for the sudo password.
+			const sudoNoPassword =
+				sudo && !creds.sudoPassword && !needLogin && (keyOk || Boolean(creds.loginPassword))
+					? await probeSudoNoPassword(spec, controlPath, sig)
+					: false;
+			const needSudo = sudo && !creds.sudoPassword && !sudoNoPassword;
 			// The overlay stage pipeline: any password we still need is prompted
 			// (login first, then sudo). Confirm-only when nothing is missing.
 			const promptFor: ("login" | "sudo")[] = [

package/src/lib.ts

@@ -454,6 +454,33 @@ export function probeKeyAuth(
 	});
 }
 
+/**
+ * Probe whether remote sudo runs without a password (NOPASSWD sudoers) via
+ * `sudo -n true`. Returns true when no sudo password is needed. Requires a
+ * passwordless SSH connection (key/agent/existing-master or a cached login
+ * password) — the probe opens its own channel with `BatchMode=yes`, so callers
+ * must only probe when SSH login auth already succeeds without prompting.
+ */
+export function probeSudoNoPassword(
+	spec: HostSpec,
+	controlPath: string,
+	signal?: AbortSignal,
+): Promise<boolean> {
+	const args = [
+		...baseSshArgs(spec, controlPath),
+		"-o",
+		"BatchMode=yes",
+		hostTarget(spec),
+		"sudo -n true",
+	];
+	return new Promise((resolve) => {
+		const proc = spawn("ssh", args, { stdio: ["ignore", "ignore", "ignore"] });
+		proc.on("error", () => resolve(false));
+		proc.on("close", (code) => resolve(code === 0));
+		signal?.addEventListener("abort", () => proc.kill("SIGTERM"), { once: true });
+	});
+}
+
 /** Connection/DNS-level failure (not an auth rejection) — a password can't fix it. */
 export function isUnreachable(stderr: string): boolean {
 	const lower = stderr.toLowerCase();