sido-askpass 0.1.1 → 0.3.0

package/README.md

@@ -1,65 +1,185 @@
 # sido-askpass
 
-`SUDO_ASKPASS` shim for environments without a usable TTY — tmux, Herdr, and coding agents (Codex, OpenCode, Pi).
+**Name:** sido-askpass
+**Author:** patdx
+**Repo:** https://github.com/patdx/sido-askpass
 
-When sudo needs a password and can't read from the terminal, it runs this program instead. Passwords never touch disk (FIFOs / stdout only).
+`SUDO_ASKPASS` shim for tmux, Herdr, coding agents, and other environments
+without a usable TTY.
 
-## Install
+When sudo uses askpass, `sido-askpass` opens a hidden password prompt and
+returns the password to sudo. Passwords never touch a regular file.
+
+Works with:
+
+- **Linux** — hidden GUI or terminal password prompts
+- **macOS** — hidden native password dialog
+- **Codex automatic review** — approved retries can authenticate outside the sandbox
+- **Codex Full Access** — sudo authentication from agent-run commands
+- **tmux** — hidden popup prompt without stealing the agent's TTY
+- **Herdr** — temporary password prompt pane that closes automatically
+- **Raw terminals** — `/dev/tty` fallback when no GUI or multiplexer is available
+
+Supports Linux and macOS. Requires **Node.js 24+**. Bash is required for the
+tmux, Herdr, and `/dev/tty` backends; tmux and Herdr also require `mkfifo`.
+Linux GUI prompting requires either `zenity` or `kdialog`. Windows is not
+supported.
+
+## Quick start
+
+### User setup (recommended)
+
+Install the command, add `SUDO_ASKPASS` to `~/.profile`, and load it into the
+current shell:
 
 ```bash
-npm i -g sido-askpass
-# or: pnpm add -g sido-askpass
+npm install -g sido-askpass && sido-askpass install --user && . ~/.profile
 ```
 
-Requires **Node.js 24+**.
+If `.profile` already exports another `SUDO_ASKPASS`, installation prints the
+old and new values before replacing it. Uninstall removes only the entry marked
+as managed by sido.
+
+### System setup
+
+Install the command and configure `Path askpass` in `/etc/sudo.conf`:
 
-## Setup
+```bash
+npm install -g sido-askpass && sido-askpass install --system
+```
 
-Session-only:
+System setup runs `sudo tee` to update `/etc/sudo.conf`, so the installation
+command itself must be run somewhere sudo can authenticate.
+
+For a single session without changing a profile or sudo configuration:
 
 ```bash
 export SUDO_ASKPASS=$(command -v sido-askpass)
 ```
 
-Persist:
+Alternatively, inject `SUDO_ASKPASS` for one command:
 
 ```bash
-sido-askpass install --user    # ~/.profile → SUDO_ASKPASS
-# or
-sido-askpass install --system  # /etc/sudo.conf → Path askpass
+sido-askpass run sudo -A <command>
 ```
 
-Then:
+Everything after `run` is run directly without shell parsing. `run` sets
+`SUDO_ASKPASS` but does not add `-A` or otherwise rewrite the command, so pass
+`-A` explicitly when sudo must use askpass even if a TTY is available.
+
+## Using sudo
+
+For the most reliable behavior, explicitly tell sudo to use askpass:
 
 ```bash
 sudo -A <command>
 ```
 
-On modern Fedora, plain `sudo` often falls back to askpass automatically when there is no TTY.
+On modern sudo installations, plain sudo commonly falls back to askpass when
+there is no usable TTY. This automatic fallback has been verified on Fedora:
+
+```bash
+sudo <command>
+```
+
+TTY allocation is the important distinction:
+
+- Without a TTY, plain sudo can automatically use the configured askpass
+  helper.
+- With a real or pseudo-TTY, plain sudo prompts on that terminal instead and
+  does not call askpass.
+- Some coding agents start background commands with a pseudo-TTY, so automatic
+  fallback cannot be assumed even when the agent UI has no visible terminal.
+- `sudo -A` requests askpass regardless of whether a TTY exists.
+
+For interactive shells, an optional alias can make askpass the default:
 
 ```bash
-sido-askpass status [--user|--system]
-sido-askpass uninstall --user|--system
+alias sudo='sudo -A'
+```
+
+Shell aliases usually do not affect commands launched directly by coding
+agents or other non-interactive processes. `sido-askpass` may automate this in
+the future, but it currently does not install an alias, rewrite sudo commands,
+or add `-A`.
+
+## Codex test matrix
+
+| Platform and terminal        | Codex permissions | Prompt backend | Command        | Result      | Notes                                                                                                                                 |
+| ---------------------------- | ----------------- | -------------- | -------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------- |
+| Linux, tmux 3.7b             | Automatic review  | tmux popup     | `sudo -A`      | Tested      | The sandbox cannot reach tmux; the approved retry outside the sandbox succeeds.                                                       |
+| Linux, Herdr 0.7.5           | Automatic review  | Herdr pane     | `sudo -A`      | Tested      | The sandbox cannot reach Herdr; the approved retry outside the sandbox succeeds.                                                      |
+| Fedora 44, raw Wayland shell | Automatic review  | Zenity 4.2.2   | `sudo -A true` | Tested      | 2026-07-30, sudo 1.9.17p2, Node.js 24.18.0; no tmux, Herdr, or stdin TTY.                                                             |
+| Linux, any terminal          | Full Access       | First matching | `sudo -A`      | Supported   | sudo and the selected prompt backend can run outside the sandbox.                                                                     |
+| Linux, any terminal          | Workspace-write   | None           | Any sudo       | Unsupported | `no_new_privileges` blocks sudo; changing the askpass backend cannot bypass this.                                                     |
+| Linux, pseudo-TTY command    | Any sudo-capable  | Askpass        | Plain `sudo`   | Skipped     | sudo uses the allocated TTY instead of askpass; use `sudo -A` to force askpass.                                                       |
+| Linux, raw terminal          | Automatic review  | `/dev/tty`     | `sudo -A`      | Untested    | No tmux, Herdr, `DISPLAY`, or Wayland; requires an accessible controlling terminal.                                                   |
+| Linux, pi (no TTY, GUI)      | Automatic review  | Zenity         | Plain `sudo`   | Tested      | 2026-07-30, sudo 1.9.17p2, Node.js 24.18.0: no tmux, Herdr, or TTY; `DISPLAY`+zenity available. Plain sudo auto-fell back to askpass. |
+| macOS                        | Any               | AppleScript    | `sudo -A`      | Untested    | The dialog backend exists, but Codex sandbox and approval behavior has not been tested.                                               |
+
+Codex automatic approval review does not widen the sandbox itself. It is useful
+because it can approve an eligible retry outside the sandbox. Full Access also
+works, but grants Codex substantially broader system access.
+
+When a sandboxed Linux Codex process cannot reach tmux, `sido-askpass` exits
+immediately instead of hanging and prints:
+
+```text
+[sido] tmux access denied; retry the sudo command with escalated permissions
 ```
 
-## How it prompts
+This gives Codex an actionable reason to retry with escalated permission.
+
+## Other clients
+
+| Client   | Compatibility | Notes                                                                                                                       |
+| -------- | ------------- | --------------------------------------------------------------------------------------------------------------------------- |
+| Pi       | Tested        | No TTY — plain `sudo` auto-falls back to askpass; zenity GUI prompt. 2026-07-30, Fedora 44, Node.js 24.18.0, sudo 1.9.17p2. |
+| OpenCode | Tested        | 2026-07-30, Fedora 44, Node.js 24.18.0, `/dev/tty` fallback, `sudo -A whoami` → `root`.                                     |
+
+## Prompt backend compatibility
 
-| Context                      | Method                                                 |
-| ---------------------------- | ------------------------------------------------------ |
-| `$TMUX` set                  | `tmux command-prompt -N` (secret), FIFO back to parent |
-| `$HERDR_ENV=1`               | Herdr pane split + bash `read -s`, FIFO back           |
-| macOS + GUI                  | `osascript` hidden dialog                              |
-| Linux + `$DISPLAY` / Wayland | `zenity` → `kdialog`                                   |
-| else                         | `read -s` on `/dev/tty`                                |
+The first matching context is used:
 
-### tmux
+| Context                      | Prompt method                                    | Status                  |
+| ---------------------------- | ------------------------------------------------ | ----------------------- |
+| `$TMUX` set                  | tmux popup with Bash `read -s`; FIFO return      | Tested on Linux         |
+| `$HERDR_ENV=1`               | Temporary Herdr pane with `read -s`; FIFO return | Tested on Linux         |
+| macOS                        | Hidden `osascript` dialog                        | Implemented, unverified |
+| Linux + `$DISPLAY` / Wayland | `zenity`, then `kdialog`                         | Tested on Linux         |
+| Other environment            | Hidden `read -s` prompt on `/dev/tty`            | Fallback                |
 
-Inside a tmux session, sudo password entry uses tmux's built-in secret prompt — no GUI dialog, no extra pane. Works well when agents or nested shells run under tmux and can't steal the TTY.
+The prompt also shows the requesting command when the parent process command
+line is available. If process inspection is blocked, it silently shows the
+normal password prompt without the command. The displayed command includes its
+arguments, which may reveal sensitive arguments to anyone who can see the
+prompt.
 
-### Agents / Herdr
+## Status and removal
+
+Inspect the active environment and installed configuration:
+
+```bash
+sido-askpass status
+sido-askpass status --user
+sido-askpass status --system
+```
+
+Remove either setup:
+
+```bash
+sido-askpass uninstall --user
+sido-askpass uninstall --system
+```
 
-In Herdr (`HERDR_ENV=1`), a temporary pane collects the password. Same idea for Codex / OpenCode / Pi: point `SUDO_ASKPASS` at this binary so privilege prompts don't hang the session.
+`--user` and `--system` are mutually exclusive for install, uninstall, and
+status. Omitting both is supported only by status.
 
 ## Security
 
-Passwords are passed through kernel FIFOs (tmux / Herdr) or process stdout (GUI / TTY). Nothing is written to a regular file.
+Password input is hidden. tmux and Herdr return the password through a kernel
+FIFO; GUI and TTY backends return it through process stdout. Each tmux or Herdr
+prompt uses a private temporary directory. Its FIFO, prompt, and helper script
+are accessible only to the current user and are removed when prompting ends.
+The temporary prompt file contains the displayed command and prompt, but never
+the password.

package/dist/sido-askpass.js

@@ -3,19 +3,53 @@
 import { spawnSync } from 'node:child_process'
 import {
   existsSync,
+  mkdtempSync,
   readFileSync,
+  rmSync,
   writeFileSync,
-  unlinkSync,
-  chmodSync,
 } from 'node:fs'
 import { tmpdir, userInfo, hostname, homedir } from 'node:os'
 import { join, resolve } from 'node:path'
-import { randomUUID } from 'node:crypto'
 import { parseArgs } from 'node:util'
+import package_json from '../package.json' with { type: 'json' }
 
 const self_path = resolve(process.argv[1] )
 const command = process.argv[2]
 
+if (command === '_inner_prompt_receiver') {
+  const prompt_file = process.argv[3]
+  const fifo = process.argv[4]
+  if (!prompt_file || !fifo) process.exit(1)
+  inner_prompt_receiver(prompt_file, fifo)
+  process.exit(0)
+}
+
+// ── help / version ──────────────────────────────────────────────────────────
+
+if (command === '--help' || command === '-h' || command === 'help') {
+  console.log(`sido-askpass — SUDO_ASKPASS shim for headless agent environments
+
+Name:    sido-askpass
+Version: ${package_json.version}
+Author:  patdx
+Repo:    https://github.com/patdx/sido-askpass
+
+Usage:
+  sido-askpass                        askpass mode (invoked by sudo)
+  sido-askpass install --user|--system
+  sido-askpass uninstall --user|--system
+  sido-askpass status [--user|--system]
+  sido-askpass run <command> [args...]  run <command> with SUDO_ASKPASS set
+  sido-askpass --help
+  sido-askpass --version`)
+  process.exit(0)
+}
+
+if (command === '--version' || command === '-V' || command === 'version') {
+  console.log(package_json.version)
+  process.exit(0)
+}
+
 // ── install / uninstall / status ────────────────────────────────────────────
 
 if (command === 'install' || command === 'uninstall') {
@@ -43,32 +77,77 @@ if (command === 'status') {
       user: { type: 'boolean' },
       system: { type: 'boolean' },
     },
-    strict: false,
   })
+  if (values.user && values.system) {
+    console.error(`[sido] usage: ${self_path} status [--user|--system]`)
+    process.exit(1)
+  }
   const scope = values.user ? '--user' : values.system ? '--system' : undefined
   do_status(scope)
   process.exit(0)
 }
 
+if (command === 'run') {
+  if (!process.argv[3]) {
+    console.error(`[sido] usage: ${self_path} run <command> [args...]`)
+    process.exit(1)
+  }
+  do_run(process.argv[3], process.argv.slice(4))
+}
+
 // ── askpass mode ───────────────────────────────────────────────────────────
 
 const prompt = (command || `[sudo] password for ${userInfo().username}: `)
   .replace(/%u/g, userInfo().username)
   .replace(/%h/g, hostname())
-
-const isTmux = !!process.env.TMUX
-const isHerdr = process.env.HERDR_ENV === '1'
-const isMac = process.platform === 'darwin'
-const isLinux = process.platform === 'linux'
+const requesting_command = get_requesting_command()
+const display_prompt = requesting_command
+  ? `Command: ${requesting_command}\n${prompt}`
+  : prompt
+
+const is_tmux = !!process.env.TMUX
+const is_herdr = process.env.HERDR_ENV === '1'
+const is_mac = process.platform === 'darwin'
+const is_linux = process.platform === 'linux'
 const has_display = !!(process.env.DISPLAY || process.env.WAYLAND_DISPLAY)
-const can_gui = isMac || (isLinux && has_display)
-
-function tmp()         {
-  return join(tmpdir(), `sido-${randomUUID()}`)
+const can_gui = is_mac || (is_linux && has_display)
+
+                           
+             
+              
+                     
+ 
+
+function create_prompt_resources()                  {
+  const dir = mkdtempSync(join(tmpdir(), 'sido-'))
+  const fifo = join(dir, 'password')
+  const result = spawnSync('mkfifo', ['-m', '600', fifo], {
+    stdio: ['pipe', 'pipe', 'pipe'],
+  })
+  if (result.error || result.status !== 0) {
+    rmSync(dir, { recursive: true, force: true })
+    const detail =
+      result.error?.message ||
+      result.stderr?.toString().trim() ||
+      'unknown error'
+    throw new Error(`mkfifo failed: ${detail}`)
+  }
+  const resources = {
+    dir,
+    fifo,
+    prompt_file: join(dir, 'prompt'),
+  }
+  try {
+    writeFileSync(resources.prompt_file, display_prompt, { mode: 0o600 })
+    return resources
+  } catch (error) {
+    rmSync(dir, { recursive: true, force: true })
+    throw error
+  }
 }
 
-function mkfifo(p        )       {
-  spawnSync('mkfifo', [p], { stdio: ['pipe', 'pipe', 'pipe'] })
+function remove_prompt_resources(resources                 )       {
+  rmSync(resources.dir, { recursive: true, force: true })
 }
 
 function read_stdout(r   
@@ -79,9 +158,56 @@ function read_stdout(r
   return r.stdout.toString().replace(/\r?\n$/, '')
 }
 
+function read_secret(prompt        )         {
+  const r = spawnSync(
+    'bash',
+    [
+      '-c',
+      'read -s -p "$1" pw < /dev/tty && printf \'%s\\n\' "$pw"',
+      'sido',
+      prompt,
+    ],
+    { stdio: ['ignore', 'pipe', 'inherit'] },
+  )
+  return read_stdout(r)
+}
+
+function inner_prompt_receiver(prompt_file        , fifo        )       {
+  const prompt = readFileSync(prompt_file, 'utf8')
+  writeFileSync(fifo, `${read_secret(prompt)}\n`)
+}
+
+function get_requesting_command()                     {
+  try {
+    let value        
+    if (process.platform === 'linux') {
+      value = readFileSync(`/proc/${process.ppid}/cmdline`, 'utf8').replace(
+        /\0/g,
+        ' ',
+      )
+    } else {
+      const r = spawnSync(
+        'ps',
+        ['-o', 'command=', '-p', String(process.ppid)],
+        { stdio: ['pipe', 'pipe', 'pipe'] },
+      )
+      if (r.status !== 0) return
+      value = r.stdout?.toString() ?? ''
+    }
+
+    value = value
+      .replace(/[\u0000-\u001f\u007f-\u009f]/g, ' ')
+      .replace(/\s+/g, ' ')
+      .trim()
+    return value || undefined
+  } catch {
+    return
+  }
+}
+
 function main()       {
-  if (isTmux) return void tmux_prompt()
-  if (isHerdr) return void herdr_prompt()
+  if (is_tmux) return void tmux_prompt()
+  if (is_herdr) return void herdr_prompt()
   if (can_gui) return void gui_prompt()
   tty_prompt()
 }
@@ -94,15 +220,41 @@ function user_profile_path()         {
   return join(homedir(), '.profile')
 }
 
+function do_run(command        , args          )        {
+  const proc = spawnSync(command, args, {
+    env: { ...process.env, SUDO_ASKPASS: self_path },
+    stdio: 'inherit',
+  })
+  if (proc.error) {
+    console.error(`[sido] failed to run ${command}: ${proc.error.message}`)
+    process.exit(1)
+  }
+  if (proc.signal) {
+    process.kill(process.pid, proc.signal)
+  }
+  process.exit(proc.status ?? 1)
+}
+
 function do_install(scope        )       {
   if (scope === '--user') {
     const path = user_profile_path()
     const line = `export SUDO_ASKPASS="${self_path}"`
     let content = existsSync(path) ? readFileSync(path, 'utf-8') + '\n' : ''
-    if (/^export SUDO_ASKPASS=/m.test(content)) {
-      content = content.replace(/^export SUDO_ASKPASS=.*$/gm, line)
+    const managed_pattern = /^# sido\nexport SUDO_ASKPASS=.*$/gm
+    if (managed_pattern.test(content)) {
+      content = content.replace(managed_pattern, `# sido\n${line}`)
+    } else if (/^export SUDO_ASKPASS=.*$/m.test(content)) {
+      const old_values = [
+        ...content.matchAll(/^export SUDO_ASKPASS=(.*)$/gm),
+      ].map((match) => match[1])
+      for (const old_value of old_values) {
+        console.error(
+          `[sido] warning: replacing SUDO_ASKPASS=${old_value} with "${self_path}"`,
+        )
+      }
+      content = content.replace(/^export SUDO_ASKPASS=.*$/gm, `# sido\n${line}`)
     } else {
-      content += `\n# sido\nexport SUDO_ASKPASS="${self_path}"\n`
+      content += `\n# sido\n${line}\n`
     }
     writeFileSync(path, content)
     console.error(`[sido] installed to ${path}`)
@@ -115,8 +267,19 @@ function do_install(scope        )       {
       const r = spawnSync('cat', [path], { stdio: ['pipe', 'pipe', 'pipe'] })
       content = r.stdout?.toString() ?? ''
     }
-    if (/^Path askpass /m.test(content)) {
-      content = content.replace(/^Path askpass .*$/gm, line)
+    const managed_pattern = /^# sido\nPath askpass .*$/gm
+    if (managed_pattern.test(content)) {
+      content = content.replace(managed_pattern, `# sido\n${line}`)
+    } else if (/^Path askpass /m.test(content)) {
+      const old_values = [...content.matchAll(/^Path askpass (.*)$/gm)].map(
+        (match) => match[1],
+      )
+      for (const old_value of old_values) {
+        console.error(
+          `[sido] warning: replacing Path askpass ${old_value} with "${self_path}"`,
+        )
+      }
+      content = content.replace(/^Path askpass .*$/gm, `# sido\n${line}`)
     } else {
       content += `\n# sido\n${line}\n`
     }
@@ -141,8 +304,7 @@ function do_uninstall(scope        )       {
       process.exit(1)
     }
     let content = readFileSync(path, 'utf-8')
-    content = content.replace(/^# sido\n/gm, '')
-    content = content.replace(/^export SUDO_ASKPASS=.*$/gm, '')
+    content = content.replace(/^# sido\nexport SUDO_ASKPASS=.*$\n?/gm, '')
     content = content.replace(/\n{3,}/g, '\n\n').trim()
     writeFileSync(path, content + '\n')
     console.error(`[sido] removed from ${path}`)
@@ -207,32 +369,73 @@ function do_status(scope         )       {
   }
 }
 
+// Background `cat` drains the FIFO back to the parent while a blocking command
+// (tmux popup / herdr pane run) fills it. Shell job control reaps the reader on
+// cancel — see AGENTS.md: native fs open() on a FIFO cannot be cancelled from JS,
+// but the shell naturally reaps the background cat on cancel.
+function fifo_drain_script(
+  fifo_ref        ,
+  block_cmd        ,
+  status_var        ,
+)         {
+  return [
+    `cat "${fifo_ref}" &`,
+    `reader=$!`,
+    block_cmd,
+    `${status_var}=$?`,
+    `if [ "$${status_var}" -ne 0 ]; then`,
+    `  kill "$reader" 2>/dev/null`,
+    `  wait "$reader" 2>/dev/null`,
+    `  exit "$${status_var}"`,
+    `fi`,
+    `wait "$reader" 2>/dev/null`,
+  ].join('\n')
+}
+
 // ── tmux ────────────────────────────────────────────────────────────────────
 //
-// We use a single bash spawnSync combining a background cat on the FIFO
-// (reader) and the blocking tmux command-prompt (writer). Shell job control
-// (&, wait) keeps both in one sync call. Native fs.readFile on a FIFO
-// can't be cancelled mid-open (libuv threadpool blocking op), whereas the
-// shell naturally reaps the background cat on cancel.
+// tmux command-prompt cannot hide input (-N means numeric-only, not secret).
+// Use a popup running bash read -s instead. The password still travels only
+// through a FIFO in a private temporary directory.
 
 function tmux_prompt()       {
-  const fifo = tmp()
-  mkfifo(fifo)
+  const check = spawnSync('tmux', ['display-message', '-p', '#S'], {
+    stdio: ['pipe', 'pipe', 'pipe'],
+  })
+  if (check.status !== 0) {
+    const detail = check.stderr?.toString().trim()
+    if (detail) console.error(detail)
+    console.error(
+      '[sido] tmux access denied; retry the sudo command with escalated permissions',
+    )
+    process.exit(1)
+  }
 
-  const safe_prompt = prompt.replace(/"/g, '\\"')
-  const script = [
-    `cat "${fifo}" &`,
-    `reader=$!`,
-    `tmux command-prompt -N -p "${safe_prompt}" "run-shell 'echo \\"%1\\" > \\"${fifo}\\"'"`,
-    `wait "$reader" 2>/dev/null`,
+  let resources                 
+  try {
+    resources = create_prompt_resources()
+  } catch (error) {
+    console.error(`[sido] ${String(error)}`)
+    process.exit(1)
+  }
+
+  const block_cmd = [
+    `tmux display-popup -E -w 60% -h 5 \\`,
+    `  -e "SIDO_ASKPASS=$2" -e "SIDO_PROMPT=$3" -e "SIDO_FIFO=$1" \\`,
+    `  '"$SIDO_ASKPASS" _inner_prompt_receiver "$SIDO_PROMPT" "$SIDO_FIFO"'`,
   ].join('\n')
+  const script = fifo_drain_script('$1', block_cmd, 'popup_status')
 
-  const r = spawnSync('bash', ['-c', script], {
-    stdio: ['inherit', 'pipe', 'inherit'],
-  })
+  let r
   try {
-    unlinkSync(fifo)
-  } catch {}
+    r = spawnSync(
+      'bash',
+      ['-c', script, 'sido', resources.fifo, self_path, resources.prompt_file],
+      { stdio: ['inherit', 'pipe', 'inherit'] },
+    )
+  } finally {
+    remove_prompt_resources(resources)
+  }
   process.stdout.write(read_stdout(r))
 }
 
@@ -242,23 +445,6 @@ function tmux_prompt()       {
 // call and reaps the background cat on cancel.
 
 function herdr_prompt()       {
-  const fifo = tmp()
-  const prompt_file = tmp()
-  const script_file = tmp()
-
-  mkfifo(fifo)
-  writeFileSync(prompt_file, prompt)
-  writeFileSync(
-    script_file,
-    [
-      `#!/usr/bin/env bash`,
-      `prompt=$(cat "${prompt_file}")`,
-      `read -s -p "$prompt" pw`,
-      `echo "$pw" > "${fifo}"`,
-    ].join('\n'),
-  )
-  chmodSync(script_file, 0o755)
-
   let direction = 'right'
   try {
     const layout = spawnSync('herdr', ['pane', 'layout', '--current'], {
@@ -284,30 +470,41 @@ function herdr_prompt()       {
     ?.pane_id
   if (!pane_id) return void fallback_herdr()
 
-  const runner_script = [
-    `cat "${fifo}" &`,
-    `reader=$!`,
-    `herdr pane run "${pane_id}" bash "${script_file}"`,
-    `wait "$reader" 2>/dev/null`,
-  ].join('\n')
+  let resources                 
+  try {
+    resources = create_prompt_resources()
+  } catch (error) {
+    spawnSync('herdr', ['pane', 'close', pane_id], {
+      stdio: ['pipe', 'pipe', 'pipe'],
+    })
+    console.error(`[sido] ${String(error)}`)
+    process.exit(1)
+  }
 
-  const r = spawnSync('bash', ['-c', runner_script], {
-    stdio: ['inherit', 'pipe', 'inherit'],
-  })
+  const block_cmd = `herdr pane run "$1" "$3" _inner_prompt_receiver "$4" "$2"`
+  const runner_script = fifo_drain_script('$2', block_cmd, 'run_status')
 
+  let r
   try {
-    unlinkSync(fifo)
-  } catch {}
-  try {
-    unlinkSync(prompt_file)
-  } catch {}
-  try {
-    unlinkSync(script_file)
-  } catch {}
-  spawnSync('herdr', ['pane', 'close', pane_id], {
-    stdio: ['pipe', 'pipe', 'pipe'],
-  })
-
+    r = spawnSync(
+      'bash',
+      [
+        '-c',
+        runner_script,
+        'sido',
+        pane_id,
+        resources.fifo,
+        self_path,
+        resources.prompt_file,
+      ],
+      { stdio: ['inherit', 'pipe', 'inherit'] },
+    )
+  } finally {
+    remove_prompt_resources(resources)
+    spawnSync('herdr', ['pane', 'close', pane_id], {
+      stdio: ['pipe', 'pipe', 'pipe'],
+    })
+  }
   process.stdout.write(read_stdout(r))
 }
 
@@ -320,30 +517,34 @@ function fallback_herdr()       {
 // ── GUI (macOS / Linux) ────────────────────────────────────────────────────
 
 function gui_prompt()       {
-  if (isMac) return void mac_gui()
+  if (is_mac) return void mac_gui()
   linux_gui()
 }
 
 function mac_gui()       {
-  const safe_prompt = prompt.replace(/"/g, '\\"')
   const r = spawnSync(
     'osascript',
     [
       '-e',
-      `display dialog "${safe_prompt}" with hidden answer default answer ""`,
+      'on run argv',
+      '-e',
+      'display dialog (item 1 of argv) with hidden answer default answer ""',
       '-e',
       'text returned of result',
+      '-e',
+      'end run',
+      display_prompt,
     ],
     { stdio: ['inherit', 'pipe', 'inherit'] },
   )
   if (r.status !== 0) process.exit(1)
-  process.stdout.write(r.stdout?.toString().trim() ?? '')
+  process.stdout.write(r.stdout?.toString().replace(/\r?\n$/, '') ?? '')
 }
 
 function linux_gui()       {
   for (const prog of [
-    ['zenity', '--password', '--title', prompt],
-    ['kdialog', '--password', prompt],
+    ['zenity', '--password', '--title', display_prompt],
+    ['kdialog', '--password', display_prompt],
   ]) {
     const [cmd, ...args] = prog                         
     const r = spawnSync(cmd, args, { stdio: ['inherit', 'pipe', 'inherit'] })
@@ -359,13 +560,7 @@ function linux_gui()       {
 // ── TTY fallback ───────────────────────────────────────────────────────────
 
 function tty_prompt()       {
-  const safe_prompt = prompt.replace(/"/g, '\\"')
-  const r = spawnSync(
-    'bash',
-    ['-c', `read -s -p "${safe_prompt}" pw && echo "$pw"`],
-    { stdio: ['inherit', 'pipe', 'inherit'] },
-  )
-  process.stdout.write(read_stdout(r))
+  process.stdout.write(read_secret(display_prompt))
 }
 
 main()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sido-askpass",
-  "version": "0.1.1",
+  "version": "0.3.0",
   "description": "SUDO_ASKPASS shim for headless agent environments (tmux, Herdr, GUI, TTY)",
   "license": "MIT",
   "type": "module",
@@ -38,6 +38,7 @@
   },
   "scripts": {
     "build": "node scripts/build.ts",
+    "e2e": "node e2e/run.ts",
     "typecheck": "tsc",
     "format": "prettier --write .",
     "format:check": "prettier --check ."