feat: remove the need for repeated sudo passwords

Author: kevinwang5658

package.json

@@ -150,7 +150,7 @@
     "prepublishOnly": "npm run build && npm run build:npm",
     "postpublish": "npm run restore-npm"
   },
-  "version": "1.2.3",
+  "version": "1.3.0-beta.2",
   "bugs": "https://github.com/codifycli/codify/issues",
   "keywords": [
     "oclif",

src/common/base-command.ts

@@ -47,7 +47,8 @@ export abstract class BaseCommand extends Command {
 
     let cachedSudoPassword: string | null = flags.sudoPassword ?? null;
 
-    if (this.reporter instanceof DefaultReporter) {
+    // Secure mode never caches the sudo password, so no cache is registered with the reporter
+    if (this.reporter instanceof DefaultReporter && !flags.secure) {
       if (cachedSudoPassword !== null) {
         this.reporter.setSudoPasswordCached();
       }

src/ui/components/default-component.tsx

@@ -101,7 +101,8 @@ export function DefaultComponent(props: {
           title={(renderData as { title?: string }).title}
           hasError={(renderData as { hasError: boolean }).hasError}
           cancellable={(renderData as { cancellable: boolean }).cancellable}
-          onSubmit={(password) => emitter.emit(RenderEvent.SUDO_PROMPT_RESULT, password)}
+          savable={(renderData as { savable: boolean }).savable}
+          onSubmit={(password, save) => emitter.emit(RenderEvent.SUDO_PROMPT_RESULT, { password, save })}
           onCancel={() => emitter.emit(RenderEvent.SUDO_PASSWORD_CANCEL)}
         />
       )

src/ui/components/widgets/SudoPasswordInput.tsx

@@ -7,10 +7,11 @@ export function SudoPasswordInput(props: {
   title?: string;
   hasError: boolean;
   cancellable: boolean;
-  onSubmit: (password: string) => void;
+  savable: boolean;
+  onSubmit: (password: string, save: boolean) => void;
   onCancel: () => void;
 }) {
-  const { title, hasError, cancellable, onSubmit, onCancel } = props;
+  const { title, hasError, cancellable, savable, onSubmit, onCancel } = props;
   const [value, setValue] = useState('');
   const [isChecking, setIsChecking] = useState(false);
 
@@ -24,9 +25,10 @@ export function SudoPasswordInput(props: {
       return;
     }
 
-    if (key.return) {
+    // Enter saves the password for the rest of the session (when savable). Tab submits without saving.
+    if (key.return || (key.tab && savable)) {
       setIsChecking(true);
-      onSubmit(value);
+      onSubmit(value, savable && key.return);
       setValue('');
       return;
     }
@@ -64,7 +66,12 @@ export function SudoPasswordInput(props: {
         </Box>
       )}
       {hasError && <Text color="red">Incorrect password, try again</Text>}
-      {!isChecking && <Text dimColor>Enter to confirm{cancellable ? ' · Esc to cancel' : ''}</Text>}
+      {!isChecking && (
+        <Text dimColor>
+          {savable ? 'Enter to confirm and save for this session · Tab to confirm without saving' : 'Enter to confirm'}
+          {cancellable ? ' · Esc to cancel' : ''}
+        </Text>
+      )}
     </Box>
   );
 }

src/ui/reporters/default-reporter.tsx

@@ -248,9 +248,19 @@ export class DefaultReporter implements Reporter {
     ctx.log(`Plugin: "${pluginName}" requires root access to run command: "sudo ${data.command}"`);
     const title = `Plugin: "${pluginName}" requires root access to run command: "sudo ${data.command}"`;
 
-    const password = await this.promptSudoPassword({ title, cancellable: false });
+    // Saving is only offered when a cache is registered (i.e. not in secure mode)
+    const savable = this.sudoPasswordSubmittedCallback !== null;
+    const result = await this.promptSudoPassword({ title, cancellable: false, savable });
+
+    if (result?.save) {
+      const isValid = await this.sudoPasswordSubmittedCallback!(result.password);
+      if (isValid) {
+        store.set(store.isSudoPasswordCached, true);
+      }
+    }
+
     await this.displayProgress();
-    return password;
+    return result?.password;
   }
 
   async displayPlan(plan: Plan): Promise<void> {
@@ -380,10 +390,10 @@ export class DefaultReporter implements Reporter {
 
   private async handleInlineSudoPassword(): Promise<void> {
     ctx.log('Prompting sudo to save password for rest of requests');
-    const password = await this.promptSudoPassword({ cancellable: true });
+    const result = await this.promptSudoPassword({ cancellable: true, savable: false });
 
-    if (password != null) {
-      const isValid = await (this.sudoPasswordSubmittedCallback?.(password) ?? Promise.resolve(false));
+    if (result != null) {
+      const isValid = await (this.sudoPasswordSubmittedCallback?.(result.password) ?? Promise.resolve(false));
       if (isValid) {
         store.set(store.isSudoPasswordCached, true);
       }
@@ -393,35 +403,38 @@ export class DefaultReporter implements Reporter {
   }
 
   // Shared prompt loop for both inline (cancellable) and blocking (non-cancellable) sudo password entry.
-  // Returns the validated password, or undefined if the user cancelled (only possible when cancellable=true).
-  private async promptSudoPassword(opts: { title?: string; cancellable: boolean }): Promise<string | undefined> {
-    const { title, cancellable } = opts;
+  // Returns the validated password and whether the user chose to save it, or undefined if the user cancelled
+  // (only possible when cancellable=true).
+  private async promptSudoPassword(
+    opts: { title?: string; cancellable: boolean; savable: boolean }
+  ): Promise<{ password: string; save: boolean } | undefined> {
+    const { title, cancellable, savable } = opts;
     let hasError = false;
     let attemptCount = 0;
 
     while (true) {
       attemptCount++;
       const result = (await Promise.all([
-        this.updateRenderState(RenderStatus.SUDO_PROMPT, { attemptCount, hasError, cancellable, title }),
+        this.updateRenderState(RenderStatus.SUDO_PROMPT, { attemptCount, hasError, cancellable, savable, title }),
         Promise.race([
-          this.awaitEvent<string>(RenderEvent.SUDO_PROMPT_RESULT),
+          this.awaitEvent<{ password: string; save: boolean }>(RenderEvent.SUDO_PROMPT_RESULT),
           ...(cancellable
             ? [this.awaitEvent<'cancel'>(RenderEvent.SUDO_PASSWORD_CANCEL).then(() => Symbol.for('cancel'))]
             : []),
         ]),
-      ])).at(1) as string | symbol;
+      ])).at(1) as { password: string; save: boolean } | symbol;
 
       if (result === Symbol.for('cancel')) {
         return undefined;
       }
 
-      const password = result as string;
+      const { password, save } = result as { password: string; save: boolean };
       const isValid = await SudoUtils.validate(password);
 
       if (isValid) {
         ctx.log('Sudo password successful!');
         await SudoUtils.invalidate();
-        return password;
+        return { password, save };
       }
 
       hasError = true;