[brujack]

Bug

resolve_program() (added in #159) returns a full absolute path like /usr/bin/sudo, not a bare command name. The elevation gate that follows it checks:

if command.eq("doas") || command.eq("sudo") || command.eq("run0") {
    self.elevate()?;  // sudo --validate with inherited stdin
}

Since "/usr/bin/sudo" != "sudo", this condition is always false. self.elevate() — which calls sudo --validate with inherited stdin to warm the credential cache — is never called for any privileged step.

Impact

Trigger: a privileged: true non-streaming command.run step runs when sudo credentials are expired.

Before #159: elevate() called sudo --validate with Stdio::inherit() first, letting the user enter their password. The subsequent .output() call (stdin not inherited) succeeded because the cache was warm.

After #159 (broken): elevate() skipped entirely. The .output() call runs sudo directly without inherited stdin; sudo cannot prompt → fails with "sudo: a password is required".

Streaming mode is less affected (stdin is inherited for the actual run), but the credential pre-check is still missing.

Root Cause

resolve_program was inserted between elevate_if_required() and the bare-name check without updating the check to account for the full-path return value.

Fix

Replace the bare-name string comparison with self.is_elevated(), which is the exact predicate that was intended (privileged=true && not root) and works correctly regardless of how the provider binary is resolved.

// Before (broken after resolve_program returns full path):
if command.eq("doas") || command.eq("sudo") || command.eq("run0") {

// After:
if self.is_elevated() {

Validation

• New test resolve_program_returns_full_path_not_bare_name asserts the return value is an absolute path, locking in the assumption that makes the bare-name check wrong.
• All exec module tests pass (the five elevate_* unit tests that check elevate_if_required() fail in this root environment because elevation_needed(true, "root") = false — pre-existing, unrelated to this change, confirmed by running them on main before the fix).

---

---

Generated by Claude Code