@xynogen/pix-ssh 0.4.1 → 0.5.0

package/README.md

@@ -26,7 +26,7 @@ Lets the agent discover hosts without reading `~/.ssh/config` itself. Read-only:
 ### Authentication
 
 - **SSH login** — tries key/agent/existing-master auth first via a `BatchMode=yes` probe. If that succeeds, no login password is needed. If it fails, a masked overlay (`●` per character) collects the login password, fed to `sshpass -e` through the child's `SSHPASS` env var — never as an argv (no `ps` leak), never written to disk.
-- **Remote sudo** (`sudo: true`) — a separate masked prompt collects the remote sudo password, piped to the remote `sudo -S -p ''` on stdin, so it travels inside the encrypted SSH channel, not as an argv.
+- **Remote sudo** (`sudo: true`) — when the SSH connection is passwordless, `ssh_run` first probes `sudo -n true`; if the remote sudoers is `NOPASSWD` the overlay shows a plain Allow/Deny with no sudo prompt. Otherwise a separate masked prompt collects the remote sudo password, piped to the remote `sudo -S -p ''` on stdin, so it travels inside the encrypted SSH channel, not as an argv.
 
 Both passwords are cached **in-memory per host** for the session (keyed by `user@host:port`), never persisted. A wrong login password drops the login cache; a wrong sudo password drops the sudo cache — the next call re-prompts.
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@xynogen/pix-ssh",
-	"version": "0.4.1",
+	"version": "0.5.0",
 	"description": "Pi tool — ssh_run: run remote commands over SSH with password/key auth and remote sudo",
 	"type": "module",
 	"main": "src/index.ts",

package/src/index.ts

@@ -66,6 +66,8 @@ import {
 	MAX_OUTPUT_LINES,
 	parseHost,
 	probeKeyAuth,
+	probePasswordAuth,
+	probeSudoNoPassword,
 	readSshConfigAliases,
 	resolveHostInfo,
 	resolveSshHost,
@@ -100,6 +102,23 @@ function cacheKey(spec: HostSpec): string {
 	return `${spec.user ?? ""}@${spec.host}:${spec.port ?? 22}`;
 }
 
+/**
+ * Overlay password validator for a prompt stage. The login stage tests the
+ * password against the host (wrong one re-prompts up to MAX_PASSWORD_ATTEMPTS);
+ * the sudo stage can't be probed before login, so it only rejects a blank entry
+ * and surfaces a real failure on the run.
+ */
+export function validatorFor(
+	stage: "login" | "sudo",
+	spec: HostSpec,
+	controlPath: string,
+	sig?: AbortSignal,
+): (pw: string) => Promise<boolean> {
+	if (stage !== "login") return (pw) => Promise.resolve(pw.trim().length > 0);
+	return (pw) =>
+		pw.trim().length === 0 ? Promise.resolve(false) : probePasswordAuth(spec, controlPath, pw, sig);
+}
+
 type SshOutcome =
 	| "awaiting-approval"
 	| "running"
@@ -536,7 +555,15 @@ export default function (pi: ExtensionAPI): void {
 			const keyOk = probe === "ok";
 			// Which passwords must the overlay collect this call?
 			const needLogin = probe === "auth" && !creds.loginPassword;
-			const needSudo = sudo && !creds.sudoPassword;
+			// Remote sudo password only when NOT already cached, NOT NOPASSWD, and
+			// the SSH connection is passwordless (so the probe can open its own
+			// channel without prompting). When login still needs a password we
+			// can't probe yet, so fall back to prompting for the sudo password.
+			const sudoNoPassword =
+				sudo && !creds.sudoPassword && !needLogin && (keyOk || Boolean(creds.loginPassword))
+					? await probeSudoNoPassword(spec, controlPath, sig)
+					: false;
+			const needSudo = sudo && !creds.sudoPassword && !sudoNoPassword;
 			// The overlay stage pipeline: any password we still need is prompted
 			// (login first, then sudo). Confirm-only when nothing is missing.
 			const promptFor: ("login" | "sudo")[] = [
@@ -638,7 +665,11 @@ export default function (pi: ExtensionAPI): void {
 							timeoutMs: PROMPT_TIMEOUT_MS,
 							maxPasswordAttempts: MAX_PASSWORD_ATTEMPTS,
 							passwordLabel: `${label}:`,
-							validatePassword: (pw) => Promise.resolve(pw.trim().length > 0),
+							// Login stage: actually test the password against the host so a
+							// wrong one re-prompts (up to MAX_PASSWORD_ATTEMPTS), mirroring
+							// pix-sudo. Sudo stage can't be validated until login succeeds, so
+							// it keeps the non-empty check and surfaces failures on the run.
+							validatePassword: validatorFor(stage, spec, controlPath, sig),
 							choices: [
 								{
 									value: "yes",

package/src/lib.ts

@@ -454,6 +454,84 @@ export function probeKeyAuth(
 	});
 }
 
+/**
+ * Validate an SSH *login* password by attempting one real password auth. Forces
+ * password auth (no pubkey/agent) with a single prompt, fed via `sshpass -e`
+ * (env, never argv). Returns true only on a clean login; an auth rejection
+ * returns false so the overlay can re-prompt. Unreachable/spawn errors return
+ * true — a password can't fix connectivity, so defer to the real run instead of
+ * burning retry attempts. ponytail: each call is one fresh connection (its own
+ * MaxAuthTries counter, NumberOfPasswordPrompts=1), so retries don't stack
+ * toward a per-connection lockout; a host with fail2ban-style IP banning is the
+ * ceiling — then drop back to a single prompt.
+ */
+export function probePasswordAuth(
+	spec: HostSpec,
+	controlPath: string,
+	password: string,
+	signal?: AbortSignal,
+): Promise<boolean> {
+	const args = [
+		"-e",
+		"ssh",
+		...baseSshArgs(spec, controlPath),
+		"-o",
+		"BatchMode=no",
+		"-o",
+		"PubkeyAuthentication=no",
+		"-o",
+		"PreferredAuthentications=password",
+		"-o",
+		"NumberOfPasswordPrompts=1",
+		hostTarget(spec),
+		"true",
+	];
+	return new Promise((resolve) => {
+		let stderr = "";
+		const proc = spawn("sshpass", args, {
+			stdio: ["ignore", "ignore", "pipe"],
+			env: { ...process.env, SSHPASS: password },
+		});
+		proc.stderr.on("data", (c: Buffer) => {
+			stderr += c.toString();
+		});
+		proc.on("error", () => resolve(true));
+		proc.on("close", (code) => {
+			if (code === 0) return resolve(true);
+			if (isUnreachable(stderr)) return resolve(true);
+			resolve(false);
+		});
+		signal?.addEventListener("abort", () => proc.kill("SIGTERM"), { once: true });
+	});
+}
+
+/**
+ * Probe whether remote sudo runs without a password (NOPASSWD sudoers) via
+ * `sudo -n true`. Returns true when no sudo password is needed. Requires a
+ * passwordless SSH connection (key/agent/existing-master or a cached login
+ * password) — the probe opens its own channel with `BatchMode=yes`, so callers
+ * must only probe when SSH login auth already succeeds without prompting.
+ */
+export function probeSudoNoPassword(
+	spec: HostSpec,
+	controlPath: string,
+	signal?: AbortSignal,
+): Promise<boolean> {
+	const args = [
+		...baseSshArgs(spec, controlPath),
+		"-o",
+		"BatchMode=yes",
+		hostTarget(spec),
+		"sudo -n true",
+	];
+	return new Promise((resolve) => {
+		const proc = spawn("ssh", args, { stdio: ["ignore", "ignore", "ignore"] });
+		proc.on("error", () => resolve(false));
+		proc.on("close", (code) => resolve(code === 0));
+		signal?.addEventListener("abort", () => proc.kill("SIGTERM"), { once: true });
+	});
+}
+
 /** Connection/DNS-level failure (not an auth rejection) — a password can't fix it. */
 export function isUnreachable(stderr: string): boolean {
 	const lower = stderr.toLowerCase();